You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This article describes the "Failed to update API Management service hostnames" error that you may experience when you add a custom domain for the Azure API Management service. This article provides troubleshooting steps to help you resolve the issue.
19
+
This article describes the "Failed to update API Management service hostnames" error, which might occur when you add a custom domain for the Azure API Management service. The following steps can help you resolve the issue.
20
20
21
-
## Symptoms
21
+
## Symptom
22
22
23
23
When you try to add a custom domain for your API Management service by using a certificate from Azure Key Vault, you receive the following error message:
24
24
25
-
- Failed to update API Management service hostnames. Request to resource 'https://vaultname.vault.azure.net/secrets/secretname/?api-version=7.0' failed with StatusCode: Forbidden for RequestId: . Exception message: Operation returned an invalid status code 'Forbidden'.
25
+
```output
26
+
Failed to update API Management service hostnames. Request to resource 'https://vaultname.vault.azure.net/secrets/secretname/?api-version=7.0' failed with StatusCode: Forbidden for RequestId: . Exception message: Operation returned an invalid status code 'Forbidden'.
27
+
```
26
28
27
29
## Cause
28
30
29
-
The API Management service does not have permission to access the key vault that you're trying to use for the custom domain.
31
+
The API Management service doesn't have permission to access the key vault that you're trying to use for the custom domain.
30
32
31
33
## Solution
32
34
33
35
To resolve this issue, follow these steps:
34
36
35
-
1. Go to the [Azure portal](https://portal.azure.com), select your API Management instance, and then select **Managed identities**. Make sure that the **Register with Microsoft Entra ID** option is set to **Yes**.
36
-
37
-
1. In the Azure portal, open the **Key vaults** service, and select the key vault that you're trying to use for the custom domain.
38
-
1. Select **Access policies**, and check whether there is a service principal that matches the name of the API Management service instance. If there is, select the service principal, and make sure that it has the **Get** permission listed under **Secret permissions**.
39
-
40
-
1. If the API Management service is not in the list, select **Add access policy**, and then create the following access policy:
37
+
1. Sign in to the [Azure portal](https://portal.azure.com), then select your API Management instance. Under **Security** in the sidebar menu, select **Managed identities**. Make sure that the **Status** setting is set to **On**.
38
+
39
+
:::image type="content" source="media/api-management-troubleshoot-cannot-add-custom-domain/register-with-entra.png" alt-text="Screenshot of managed identity setting to register with Entra ID.":::
40
+
41
+
1. From the Azure portal, open the **Key vaults** service, and select the key vault that you're trying to use for the custom domain.
42
+
43
+
1. Select **Access policies**, and check if a service principal matches the name of the API Management service instance. If so, select that service principal, and make sure that it has the **Get** permission listed under **Secret permissions**.
44
+
45
+
1. If the API Management service isn't in the list, select **Add access policy**, and then create the following access policy:
41
46
-**Configure from Template**: None
42
47
-**Select principal**: Search the name of the API Management service, and then select it from the list
43
48
-**Key permissions**: None
44
49
-**Secret permissions**: Get
45
50
-**Certificate permissions**: None
51
+
46
52
1. Select **OK** to create the access policy.
53
+
47
54
1. Select **Save** to save the changes.
48
55
49
-
Check whether the issue is resolved. To do this, try to create the custom domain in the API Management service by using the Key Vault certificate.
56
+
To check whether the issue is resolved, try to create the custom domain in the API Management service by using the Key Vault certificate.
50
57
51
58
## Related content
52
-
Learn more about API Management service:
53
-
54
-
- Check out more videos about API Management.
55
-
* For other ways to secure your back-end service, see [Mutual Certificate authentication](api-management-howto-mutual-certificates.md).
56
59
57
-
*[Create an API Management service instance](get-started-create-service-instance.md).
58
-
*[Manage your first API](import-and-publish.md).
60
+
*[Secure backend services by using client certificate authentication in Azure API Management](api-management-howto-mutual-certificates.md)
61
+
*[Quickstart: Create a new Azure API Management instance by using the Azure portal](get-started-create-service-instance.md)
62
+
*[Tutorial: Import and publish your first API](import-and-publish.md)
[Helm][helm] is an open-source packaging tool that helps you install and manage the lifecycle of Kubernetes applications. It allows you to manage Kubernetes charts, which are packages of pre-configured Kubernetes resources.
16
+
[Helm][helm] is an open-source packaging tool that helps you install and manage the lifecycle of Kubernetes applications. Helm allows you to manage Kubernetes charts, which are packages of preconfigured Kubernetes resources.
17
17
18
-
This article provides the steps for deploying self-hosted gateway component of Azure API Management to a Kubernetes cluster by using Helm.
18
+
This article explains how to deploy a self-hosted gateway component of Azure API Management to a Kubernetes cluster by using Helm.
19
19
20
20
> [!NOTE]
21
-
> You can also deploy self-hosted gateway to an [Azure Arc-enabled Kubernetes cluster](how-to-deploy-self-hosted-gateway-azure-arc.md) as a [cluster extension](/azure/azure-arc/kubernetes/extensions).
21
+
> You can also deploy a self-hosted gateway to an [Azure Arc-enabled Kubernetes cluster](how-to-deploy-self-hosted-gateway-azure-arc.md) as a [cluster extension](/azure/azure-arc/kubernetes/extensions).
22
22
23
23
## Prerequisites
24
24
25
-
- Create a Kubernetes cluster, or have access to an existing one.
25
+
- Create an Azure Kubernetes cluster, or have access to an existing one.
26
26
> [!TIP]
27
-
> [Single-node clusters](https://kubernetes.io/docs/setup/#learning-environment) work well for development and evaluation purposes. Use [Kubernetes Certified](https://kubernetes.io/partners/#conformance) multi-node clusters on-premises or in the cloud for production workloads.
28
-
*[Create an Azure API Management instance](get-started-create-service-instance.md).
29
-
*[Provision a gateway resource in your API Management instance](api-management-howto-provision-self-hosted-gateway.md).
30
-
*[Install Helm v3][helm-install].
27
+
> [Single-node clusters](https://kubernetes.io/docs/setup/#learning-environment) work well for development and evaluation purposes. Use [Kubernetes Certified](https://kubernetes.io/partners/#iframe-landscape-conformance) multi-node clusters on-premises or in the cloud for production workloads.
28
+
* Create an [Azure API Management instance](get-started-create-service-instance.md).
29
+
* Provision a [gateway resource in your API Management instance](api-management-howto-provision-self-hosted-gateway.md).
30
+
* Install [Helm v3 or later][helm-install].
31
31
32
-
## Adding the Helm repository
32
+
## Add the Helm repository
33
33
34
-
1. Add Azure API Management as a new Helm repository.
34
+
1. Add Azure API Management as a new Helm repository by using the following command.
1. Select **Gateways** from under **Deployment and infrastructure**.
59
-
2. Select the self-hosted gateway resource you intend to deploy.
60
-
3. Select **Deployment**.
61
-
4. A new token in the **Token** text box was autogenerated for you using the default **Expiry** and **Secret Key** values. Adjust either or both if desired and select **Generate** to create a new token.
62
-
5. Take note of your **Token** and **Configuration URL**
63
-
6. Install the self-hosted gateway by using the Helm chart
63
+
1. In the [Azure portal](https://portal.azure.com), navigate to your API Management instance.
64
+
65
+
1. Under **Deployment and infrastructure** in the sidebar menu, select **Self-hosted gateways**.
66
+
67
+
1. Select the self-hosted gateway resource you intend to deploy.
68
+
69
+
1. Select **Deployment**.
70
+
71
+
1. A new token in the **Token** text box was autogenerated for you using the default **Expiry** and **Secret Key** values. Adjust either or both if desired, and select **Generate** to create a new token.
72
+
73
+
1. Take note of your **Token** and **Configuration URL**.
74
+
75
+
1. Install the self-hosted gateway by using the Helm chart.
64
76
65
77
```console
66
78
helm install azure-api-management-gateway \
@@ -69,23 +81,23 @@ This article provides the steps for deploying self-hosted gateway component of A
69
81
azure-apim-gateway/azure-api-management-gateway
70
82
```
71
83
72
-
7. Execute the command. The command instructs your Kubernetes cluster to:
84
+
1. Execute the command. The command instructs your Kubernetes cluster to:
73
85
* Download the image of the self-hosted gateway from the Microsoft Container Registry and run it as a container.
74
86
* Configure the container to expose HTTP (8080) and HTTPS (8081) ports.
75
87
76
88
> [!IMPORTANT]
77
-
> By default, the gateway is using a ClusterIP service and is only exposed inside the cluster.
89
+
> By default, the gateway uses a ClusterIP service and is only exposed inside the cluster.
78
90
> You can change this by specifying the type of Kubernetes service during installation.
79
91
>
80
92
> For example, you can expose it through a load balancer by adding `--set service.type=LoadBalancer`
81
93
82
94
83
95
## Related content
84
96
85
-
*Learn more about the self-hosted gateway, see [Azure API Management self-hosted gateway overview](self-hosted-gateway-overview.md).
86
-
*Learn more about guidance for [running the self-hosted gateway on Kubernetes in production](how-to-self-hosted-gateway-on-kubernetes-in-production.md).
87
-
*Learn [how to deploy API Management self-hosted gateway to Azure Arc-enabled Kubernetes clusters](how-to-deploy-self-hosted-gateway-azure-arc.md).
88
-
*Learn more about the [observability capabilities of the Azure API Management gateways](observability.md).
0 commit comments