Step 6: Configure the hybrid runtime

Stay organized with collections Save and categorize content based on your preferences.

Specify configuration overrides

The Apigee hybrid installer uses defaults for many settings; however, there are a few settings that do not have defaults. You must provide values for these settings, as explained next.

By convention, configuration overrides are written in a file named overrides.yaml in your $HYBRID_FILES/overrides directory.

1. Create a new file named overrides.yaml in your $HYBRID_FILES/overrides directory. For example:

   vi $HYBRID_FILES/overrides/overrides.yaml

   The overrides.yaml provides the configuration for your unique Apigee hybrid installation. The overrides file in this step provides a basic configuration for a small-footprint hybrid runtime installation, suitable for your first installation.

2. In overrides.yaml, add the required property values, shown below. A detailed description of each property is also provided below:

   Non-prod

   Make sure the overrides.yaml file has the following structure and syntax. Values in red, bold italics are property values that you must provide. They are described in the table below.

   There are differences between the different platforms for the Google Cloud project region and Kubernetes cluster region. Choose the platform where you are installing Apigee hybrid.

    gcp: region: ANALYTICS_REGION projectID: GCP_PROJECT_ID k8sCluster: name: CLUSTER_NAME region: CLUSTER_LOCATION # Must be the closest Google Cloud region to your cluster. org: ORG_NAME instanceID: "UNIQUE_INSTANCE_IDENTIFIER" cassandra: hostNetwork: false # Set to false for single region installations and multi-region installations # with connectivity between pods in different clusters, for example GKE installations. # Set to true for multi-region installations with no communication between # pods in different clusters, for example GKE On-prem, GKE on AWS, Anthos on bare metal, # AKS, EKS, and OpenShift installations. # See Multi-region deployment: Prerequisites virtualhosts: - name: ENVIRONMENT_GROUP_NAME selector: app: apigee-ingressgateway ingress_name: INGRESS_NAME sslCertPath: ./certs/CERT_NAME.pem sslKeyPath: ./certs/KEY_NAME.key ao: args: # This configuration is introduced in hybrid v1.8 disableIstioConfigInAPIServer: true # This configuration is introduced in hybrid v1.8 ingressGateways: - name: INGRESS_NAME # maximum 17 characters. replicaCountMin: 2 replicaCountMax: 10 # You do not need to set Annotations or LoadBalancerIP if you are creating your own Kubernetes # service for ingress deployment. In prod, it's recommended to create your own Kubernetes service. # See: Expose Apigee ingress gateway. svcAnnotations: # optional. If you are on AKS, see Known issue #260772383. SVC_ANNOTATIONS_KEY: SVC_ANNOTATIONS_VALUE svcLoadBalancerIP: SVC_LOAD_BALANCER_IP # optional envs: - name: ENVIRONMENT_NAME serviceAccountPaths: synchronizer: NON_PROD_SERVICE_ACCOUNT_FILEPATH # For example: "./service-accounts/GCP_PROJECT_ID-apigee-non-prod.json" udca: NON_PROD_SERVICE_ACCOUNT_FILEPATH runtime: NON_PROD_SERVICE_ACCOUNT_FILEPATH mart: serviceAccountPath: NON_PROD_SERVICE_ACCOUNT_FILEPATH connectAgent: serviceAccountPath: NON_PROD_SERVICE_ACCOUNT_FILEPATH metrics: serviceAccountPath: NON_PROD_SERVICE_ACCOUNT_FILEPATH udca: serviceAccountPath: NON_PROD_SERVICE_ACCOUNT_FILEPATH watcher: serviceAccountPath: NON_PROD_SERVICE_ACCOUNT_FILEPATH logger: enabled: false # Set to false to disable logger for GKE installations. # Set to true for all platforms other than GKE. # See apigee-logger in Service accounts and roles used by hybrid components. serviceAccountPath: NON_PROD_SERVICE_ACCOUNT_FILEPATH

   Prod

   Make sure the overrides.yaml file has the following structure and syntax. Values in red, bold italics are property values that you must provide. They are described in the table below.

   For installations in production environments, look at the storage requirements for the Cassandra database in Configure Cassandra for production.

   There are differences between the different platforms for the Google Cloud project region and Kubernetes cluster region. Choose the platform where you are installing Apigee hybrid.

    gcp: region: ANALYTICS_REGION projectID: GCP_PROJECT_ID k8sCluster: name: CLUSTER_NAME region: CLUSTER_LOCATION # Must be the closest Google Cloud region to your cluster. org: ORG_NAME instanceID: "UNIQUE_INSTANCE_IDENTIFIER" cassandra: hostNetwork: false # Set to false for single region installations and multi-region installations # with connectivity between pods in different clusters, for example GKE installations. # Set to true for multi-region installations with no communication between # pods in different clusters, for example GKE On-prem, GKE on AWS, Anthos on bare metal, # AKS, EKS, and OpenShift installations. # See Multi-region deployment: Prerequisites storage: capacity: 500Gi resources: requests: cpu: 7 memory: 15Gi maxHeapSize: 8192M heapNewSize: 1200M # Minimum storage requirements for a production environment. # See Configure Cassandra for production. virtualhosts: - name: ENVIRONMENT_GROUP_NAME selector: app: apigee-ingressgateway ingress_name: INGRESS_NAME sslCertPath: ./certs/CERT_NAME.pem sslKeyPath: ./certs/KEY_NAME.key ao: args: # This configuration is introduced in hybrid v1.8 disableIstioConfigInAPIServer: true # This configuration is introduced in hybrid v1.8 ingressGateways: - name: INGRESS_NAME # maximum 17 characters. replicaCountMin: 2 replicaCountMax: 10 svcAnnotations: # optional. If you are on AKS, see Known issue #260772383. SVC_ANNOTATIONS_KEY: SVC_ANNOTATIONS_VALUE envs: - name: ENVIRONMENT_NAME serviceAccountPaths: synchronizer: SYNCHRONIZER_SERVICE_ACCOUNT_FILEPATH # For example: "./service-accounts/GCP_PROJECT_ID-apigee-synchronizer.json" udca: UDCA_SERVICE_ACCOUNT_FILEPATH # For example: "./service-accounts/GCP_PROJECT_ID-apigee-udca.json" runtime: RUNTIME_SERVICE_ACCOUNT_FILEPATH # For example: "./service-accounts/GCP_PROJECT_ID-apigee-runtime.json" mart: serviceAccountPath: MART_SERVICE_ACCOUNT_FILEPATH # For example: "./service-accounts/GCP_PROJECT_ID-apigee-mart.json" connectAgent: serviceAccountPath: MART_SERVICE_ACCOUNT_FILEPATH # Use the same service account for mart and connectAgent metrics: serviceAccountPath: METRICS_SERVICE_ACCOUNT_FILEPATH # For example: "./service-accounts/GCP_PROJECT_ID-apigee-metrics.json" udca: serviceAccountPath: UDCA_SERVICE_ACCOUNT_FILEPATH # For example: "./service-accounts/GCP_PROJECT_ID-apigee-udca.json" watcher: serviceAccountPath: WATCHER_SERVICE_ACCOUNT_FILEPATH # For example: "./service-accounts/GCP_PROJECT_ID-apigee-watcher.json" logger: enabled: false # Set to false to disable logger for GKE installations. # Set to true for all platforms other than GKE. # See apigee-logger in Service accounts and roles used by hybrid components. serviceAccountPath: LOGGER_SERVICE_ACCOUNT_FILEPATH # For example: "./service-accounts/GCP_PROJECT_ID-apigee-logger.json" 

   Example

   The following example shows a completed overrides file with example property values added:

   gcp: region: us-central1 projectID: hybrid-example k8sCluster: name: apigee-hybrid region: us-central1 org: hybrid-example instanceID: "my_hybrid_example" cassandra: hostNetwork: false virtualhosts: - name: example-env-group selector: app: apigee-ingressgateway ingress_name: my-ingress-1 sslCertPath: ./certs/keystore.pem sslKeyPath: ./certs/keystore.key ao: args: disableIstioConfigInAPIServer: true ingressGateways: - name: my-ingress-1 replicaCountMin: 2 replicaCountMax: 10 envs: - name: test serviceAccountPaths: synchronizer: ./service-accounts/my-hybrid-project-apigee-non-prod.json # for production environments, my-hybrid-project-apigee-synchronizer.json udca: ./service-accounts/my-hybrid-project-apigee-non-prod.json # for production environments, my-hybrid-project-apigee-udca.json runtime: ./service-accounts/my-hybrid-project-apigee-non-prod.json # for production environments, my-hybrid-project-apigee-runtime.json mart: serviceAccountPath: ./service-accounts/my-hybrid-project-apigee-non-prod.json # for production environments, my-hybrid-project-apigee-mart.json connectAgent: serviceAccountPath: ./service-accounts/my-hybrid-project-apigee-non-prod.json # for production environments, example-hybrid-apigee-mart.json metrics: serviceAccountPath: ./service-accounts/my-hybrid-project-apigee-non-prod.json # for production environments, my-hybrid-project-apigee-metrics.json udca: serviceAccountPath: ./service-accounts/my-hybrid-project-apigee-non-prod.json # for production environments, my-hybrid-project-apigee-udca.json watcher: serviceAccountPath: ./service-accounts/my-hybrid-project-apigee-non-prod.json # for production environments, my-hybrid-project-apigee-watcher.json logger: enabled: false # Set to "false" for GKE. Set to "true" for all other Kubernetes platforms. serviceAccountPath: ./service-accounts/my-hybrid-project-apigee-non-prod.json # for production environments, LOGGER_SERVICE_ACCOUNT_NAME.json 

3. When you are finished, save the file.

The following table describes each of the property values that you must provide in the overrides file. For more information, see Configuration property reference.

sslCertPath: ./certs/keystore.pem sslKeyPath: ./certs/keystore.key

Summary

The configuration file tells Kubernetes how to deploy the hybrid components to a cluster. Next, you will enable synchronizer access so the Apigee runtime and management planes will be able to communicate.