A financial enterprise runs a distributed microservices application inside an on-premises Kubernetes cluster managed with an Istio service mesh. The enterprise needs to expose several services to partner developers while implementing centralized API governance. The solution must satisfy the following architectural requirements: Enforce API key verification, OAuth authorization, and quota management. Collect API traffic metrics into centralized analytics dashboards. Maintain low network latency by keeping local service-to-service and ingress API traffic within the on-premises data center perimeter. Avoid the resource footprint and operational complexity of hosting a full Apigee runtime plane on-premises. Which solution should the cloud architect recommend?

Deploy the Apigee Adapter for Envoy within the on-premises service mesh to act as a local Policy Decision Point connected to the Apigee cloud management plane.: ### What Apigee Adapter for Envoy is **Apigee Adapter for Envoy** is an API gateway integration solution that combines the lightweight proxy capabilities of **Envoy** (and **Istio**) with the centralized governance and analytics features of the **Apigee** platform. It allows organizations to deploy a lightweight data plane directly adjacent to backend services while maintaining centralized management in Google Cloud. ### How it meets the requirements - **Security and Quota Enforcement**: The Envoy proxy intercepts API calls and queries the local **Apigee Remote Service**, which acts as a **Policy Decision Point (PDP)** to validate API keys, verify OAuth tokens, and enforce rate-limiting quotas. - **Centralized Analytics**: The adapter asynchronously transmits traffic metrics and operational data to the cloud-hosted **Apigee management plane**, providing full access to Apigee analytics dashboards and reporting APIs without blocking request flows. - **Low Latency and Data Perimeter**: API requests are evaluated and routed locally inside the on-premises cluster, keeping runtime traffic strictly within enterprise boundaries and eliminating unnecessary cross-network hops. - **Reduced Footprint**: Unlike a full Apigee on-premises deployment—which requires substantial infrastructure for message processors, Cassandra stores, and local management services—the Envoy adapter provides a compact, containerized footprint ideal for service meshes. ### Key advantages - **Asynchronous Telemetry**: Analytics and operational metadata are uploaded asynchronously, preventing management plane calls from adding overhead to the critical path. - **Resilience and Caching**: Verified API keys and configuration policies are cached locally, allowing the proxy to maintain routing decisions during transient network blips. - **Standardized Ingress**: Seamlessly integrates into existing Kubernetes and Istio architectures using native service mesh constructs.

StudyCerts

Apigee Adapter Envoy Service Mesh Integration | Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam! | StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Apigee Adapter Envoy Service Mesh Integration

Section: Supporting the application design

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A financial enterprise runs a distributed microservices application inside an on-premises Kubernetes cluster managed with an Istio service mesh. The enterprise needs to expose several services to partner developers while implementing centralized API governance.

The solution must satisfy the following architectural requirements:

Enforce API key verification, OAuth authorization, and quota management.
Collect API traffic metrics into centralized analytics dashboards.
Maintain low network latency by keeping local service-to-service and ingress API traffic within the on-premises data center perimeter.
Avoid the resource footprint and operational complexity of hosting a full Apigee runtime plane on-premises.

Which solution should the cloud architect recommend?

Route all on-premises microservice requests through a Google Cloud-hosted Apigee X instance using an external Cloud Load Balancer.

Deploy the Apigee Adapter for Envoy within the on-premises service mesh to act as a local Policy Decision Point connected to the Apigee cloud management plane.

Deploy a complete on-premises Apigee hybrid runtime plane in the data center to process API management traffic locally.

Disable sidecar injection on the microservice Pods and implement JWT authentication and quota enforcement directly inside the application code.

Professional Cloud Architect

Apigee Adapter Envoy Service Mesh Integration

Related questions