Specify configuration overrides

The Apigee hybrid installer uses defaults for many settings; however, there are a few settings that do not have defaults. You must provide values for these settings, as explained next.

Before you begin

We recommend you review the following scenarios to determine if you want to configure your cluster for them. These configurations are optional.

• If you are planning on installing hybrid in multiple regions, readMulti-region deployment before continuing.
• Apigee hybrid provides default passwords for the Cassandra users; however, we recommend that you change the default user passwords. SeeConfiguring TLS for Cassandra for details.
• If you want to configure the storage and heap settings for Cassandra, see Configure storage and heap settings.
• For production installation scenarios, configurepersistent solid state disk (SSD) storage for Cassandra. We do not support usinglocal SSDs for Apigee hybrid. For details, see Add SSD storage for production deployments.

Configure the cluster

By convention, configuration overrides are written in a file namedoverrides.yaml in your$HYBRID_FILES/overrides directory.

1. Create a new file namedoverrides.yaml in your$HYBRID_FILES/overrides directory. For example:

   vi $HYBRID_FILES/overrides/overrides.yaml

   Theoverrides.yaml provides the configuration for your unique Apigee hybrid installation. The overrides file in this step provides a basic configuration for a small-footprint hybrid runtime installation, suitable for your first installation.

2. Inoverrides.yaml, add the required property values, shown below. A detailed description of each property is also provided below.

   If you are installing Apigee hybrid on GKE and you plan to use Workload Identity to authenticate hybrid components, select theGKE - Workload Identity tab to configure youroverrides.yaml file.

   For all other installations, select the tab for either non-production,Non-prod or production,Prod environments, depending on your choice inStep 4: Create service accounts and credentials.

   For installations in production environments, look at the storage requirements for the Cassandra database inConfigure Cassandra for production.

   GKE - Workload Identity

   Make sure theoverrides.yaml file has the following structure and syntax. Values inred, bold italics are property values that you must provide. They are described in thetable below.

   If you are installing Apigee hybrid onGKE, you have an alternative to authenticate and make requests to Google APIs,Workload Identity. For overviews of Workload Identity, see:

   • Introducing Workload Identity: Better authentication for your GKE applications
   • Using Workload Identity

   To use Workload Identity with Apigee hybrid on GKE, use this template and then follow the steps inStep 8: Install hybrid runtime to create the Kubernetes service accounts and associate them with the Google service accounts you created inStep 4: Create service accounts and credentials.

   gcp:  region:ANALYTICS_REGION  projectID:GCP_PROJECT_IDworkloadIdentityEnabled: truek8sCluster:  name:CLUSTER_NAME  region:CLUSTER_LOCATION # Must be the closest Google Cloud region to your cluster.org:ORG_NAMEinstanceID: "UNIQUE_INSTANCE_IDENTIFIER"  ao:  image:    url: "gcr.io/apigee-release/hybrid/apigee-operators"    tag: "1.11.2-hotfix.3" # Required for Apigee hybrid v1.11.2runtime:  image:    url: "gcr.io/apigee-release/hybrid/apigee-runtime"    tag: "1.11.2-hotfix.3" # Required for Apigee hybrid v1.11.2 cassandra:  hostNetwork:false    #false for all GKE installations.    # SeeMulti-region deployment: Prerequisites  replicaCount:3    # Use 1 for demo installations and multiples of 3 for production.    # SeeConfigure Cassandra for production for guidelines.  backup:    enabled: true    # Set to true for initial installation.    # This triggers apigeectl to create the apigee-cassandra-backup Kubernetes service account.    # SeeCassandra backup overview for instructions on using cassandra.backup.virtualhosts:- name:ENVIRONMENT_GROUP_NAME  selector:    app: apigee-ingressgateway    ingress_name:INGRESS_NAME  sslCertPath: ./certs/CERT_NAME.pem  sslKeyPath: ./certs/KEY_NAME.keyingressGateways:- name:INGRESS_NAME # maximum 17 characters.  replicaCountMin: 2  replicaCountMax: 10  svcAnnotations:  # optional. If you are on AKS, seeKnown issue #260772383SVC_ANNOTATIONS_KEY:SVC_ANNOTATIONS_VALUE  svcLoadBalancerIP:SVC_LOAD_BALANCER_IP  # optionalenvs:- name:ENVIRONMENT_NAMElogger:  enabled:false # Set tofalse for all GKE installations.

   Non-prod

   Make sure theoverrides.yaml file has the following structure and syntax. Values inred, bold italics are property values that you must provide. They are described in thetable below.

   There are differences between the different platforms for the Google Cloud project region and Kubernetes cluster region. Choose the platform where you are installing Apigee hybrid.

   gcp:  region:ANALYTICS_REGION  projectID:GCP_PROJECT_IDk8sCluster:  name:CLUSTER_NAME  region:CLUSTER_LOCATION # Must be the closest Google Cloud region to your cluster.org:ORG_NAMEinstanceID: "UNIQUE_INSTANCE_IDENTIFIER"  ao:  image:    url: "gcr.io/apigee-release/hybrid/apigee-operators"    tag: "1.11.2-hotfix.3" # Required for Apigee hybrid v1.11.2runtime:  image:    url: "gcr.io/apigee-release/hybrid/apigee-runtime"    tag: "1.11.2-hotfix.3" # Required for Apigee hybrid v1.11.2 cassandra:  replicaCount:1    # Use 1 for non-prod or "demo" installations and multiples of 3 for production.    # SeeConfigure Cassandra for production for guidelines.  hostNetwork:false    # Set tofalse for single region installations and multi-region installations    # with connectivity between pods in different clusters, for example GKE installations.    # Set totrue  for multi-region installations with no communication between    # pods in different clusters, for example GKE On-prem, GKE on AWS, Anthos on bare metal,    # AKS, EKS, and OpenShift installations.    # SeeMulti-region deployment: Prerequisitesvirtualhosts:- name:ENVIRONMENT_GROUP_NAME  selector:    app: apigee-ingressgateway    ingress_name:INGRESS_NAME  sslCertPath: ./certs/CERT_NAME.pem  sslKeyPath: ./certs/KEY_NAME.keyingressGateways:- name:INGRESS_NAME # maximum 17 characters.  replicaCountMin: 2  replicaCountMax: 10  svcAnnotations:  # optional. If you are on AKS, seeKnown issue #260772383SVC_ANNOTATIONS_KEY:SVC_ANNOTATIONS_VALUE  svcLoadBalancerIP:SVC_LOAD_BALANCER_IP  # optionalenvs:- name:ENVIRONMENT_NAME  serviceAccountPaths:    synchronizer:NON_PROD_SERVICE_ACCOUNT_FILEPATH      # For example: "./service-accounts/GCP_PROJECT_ID-apigee-non-prod.json"    udca:NON_PROD_SERVICE_ACCOUNT_FILEPATH    runtime:NON_PROD_SERVICE_ACCOUNT_FILEPATHmart:  serviceAccountPath:NON_PROD_SERVICE_ACCOUNT_FILEPATHconnectAgent:  serviceAccountPath:NON_PROD_SERVICE_ACCOUNT_FILEPATHmetrics:  serviceAccountPath:NON_PROD_SERVICE_ACCOUNT_FILEPATHudca:  serviceAccountPath:NON_PROD_SERVICE_ACCOUNT_FILEPATHwatcher:  serviceAccountPath:NON_PROD_SERVICE_ACCOUNT_FILEPATHlogger:  enabled:false        # Set tofalse to disable logger for GKE installations.        # Set totrue for all platforms other than GKE.        # Seeapigee-logger inService accounts and roles used by hybrid components.  serviceAccountPath:NON_PROD_SERVICE_ACCOUNT_FILEPATH

   Prod

   Make sure theoverrides.yaml file has the following structure and syntax. Values inred, bold italics are property values that you must provide. They are described in thetable below.

   There are differences between the different platforms for the Google Cloud project region and Kubernetes cluster region. Choose the platform where you are installing Apigee hybrid.

   gcp:  region:ANALYTICS_REGION  projectID:GCP_PROJECT_IDk8sCluster:  name:CLUSTER_NAME  region:CLUSTER_LOCATION # Must be the closest Google Cloud region to your cluster.org:ORG_NAMEinstanceID: "UNIQUE_INSTANCE_IDENTIFIER"  ao:  image:    url: "gcr.io/apigee-release/hybrid/apigee-operators"    tag: "1.11.2-hotfix.3" # Required for Apigee hybrid v1.11.2runtime:  image:    url: "gcr.io/apigee-release/hybrid/apigee-runtime"    tag: "1.11.2-hotfix.3" # Required for Apigee hybrid v1.11.2 cassandra:  hostNetwork:false    # Set tofalse for single region installations and multi-region installations    # with connectivity between pods in different clusters, for example GKE installations.    # Set totrue  for multi-region installations with no communication between    # pods in different clusters, for example GKE On-prem, GKE on AWS, Anthos on bare metal,    # AKS, EKS, and OpenShift installations.    # SeeMulti-region deployment: Prerequisites  replicaCount:3    # Use multiples of 3 for production.    # SeeConfigure Cassandra for production for guidelines.  storage:    capacity: 500Gi  resources:    requests:      cpu: 7      memory: 15Gi  maxHeapSize: 8192M  heapNewSize: 1200M    # Minimum storage requirements for a production environment.    # SeeConfigure Cassandra for production.virtualhosts:- name:ENVIRONMENT_GROUP_NAME  selector:    app: apigee-ingressgateway    ingress_name:INGRESS_NAME  sslCertPath: ./certs/CERT_NAME.pem  sslKeyPath: ./certs/KEY_NAME.keyingressGateways:- name:INGRESS_NAME # maximum 17 characters.  replicaCountMin: 2  replicaCountMax: 10  svcAnnotations:  # optional. If you are on AKS, seeKnown issue #260772383SVC_ANNOTATIONS_KEY:SVC_ANNOTATIONS_VALUEenvs:- name:ENVIRONMENT_NAME  serviceAccountPaths:    synchronizer:SYNCHRONIZER_SERVICE_ACCOUNT_FILEPATH      # For example: "./service-accounts/GCP_PROJECT_ID-apigee-synchronizer.json"    udca:UDCA_SERVICE_ACCOUNT_FILEPATH      # For example: "./service-accounts/GCP_PROJECT_ID-apigee-udca.json"    runtime:RUNTIME_SERVICE_ACCOUNT_FILEPATH      # For example: "./service-accounts/GCP_PROJECT_ID-apigee-runtime.json"mart:  serviceAccountPath:MART_SERVICE_ACCOUNT_FILEPATH        # For example: "./service-accounts/GCP_PROJECT_ID-apigee-mart.json"connectAgent:  serviceAccountPath:MART_SERVICE_ACCOUNT_FILEPATH        #Use the same service account for mart and connectAgentmetrics:  serviceAccountPath:METRICS_SERVICE_ACCOUNT_FILEPATH        # For example: "./service-accounts/GCP_PROJECT_ID-apigee-metrics.json"udca:  serviceAccountPath:UDCA_SERVICE_ACCOUNT_FILEPATH        # For example: "./service-accounts/GCP_PROJECT_ID-apigee-udca.json"watcher:  serviceAccountPath:WATCHER_SERVICE_ACCOUNT_FILEPATH        # For example: "./service-accounts/GCP_PROJECT_ID-apigee-watcher.json"logger:  enabled:false        # Set tofalse to disable logger for GKE installations.        # Set totrue for all platforms other than GKE.        # Seeapigee-logger inService accounts and roles used by hybrid components.  serviceAccountPath:LOGGER_SERVICE_ACCOUNT_FILEPATH        # For example: "./service-accounts/GCP_PROJECT_ID-apigee-logger.json"

   Example

   The following example shows a completed overrides file with example property values added:

   gcp:  region: us-central1  projectID: hybrid-examplek8sCluster:  name: apigee-hybrid  region: us-central1org: hybrid-exampleinstanceID: "my_hybrid_example"  ao:  image:    url: "gcr.io/apigee-release/hybrid/apigee-operators"    tag: "1.11.2-hotfix.3" # Required for Apigee hybrid v1.11.2runtime:  image:    url: "gcr.io/apigee-release/hybrid/apigee-runtime"    tag: "1.11.2-hotfix.3" # Required for Apigee hybrid v1.11.2 cassandra:  hostNetwork: false  replicaCount: 3virtualhosts:- name: example-env-group  selector:    app: apigee-ingressgateway    ingress_name: my-ingress-1  sslCertPath: ./certs/keystore.pem  sslKeyPath: ./certs/keystore.keyingressGateways:- name: my-ingress-1  replicaCountMin: 2  replicaCountMax: 10envs:- name: test  serviceAccountPaths:    synchronizer: ./service-accounts/my-hybrid-project-apigee-non-prod.json      # for production environments, my-hybrid-project-apigee-synchronizer.json    udca: ./service-accounts/my-hybrid-project-apigee-non-prod.json      # for production environments, my-hybrid-project-apigee-udca.json    runtime: ./service-accounts/my-hybrid-project-apigee-non-prod.json      # for production environments, my-hybrid-project-apigee-runtime.jsonmart:  serviceAccountPath: ./service-accounts/my-hybrid-project-apigee-non-prod.json    # for production environments, my-hybrid-project-apigee-mart.jsonconnectAgent:  serviceAccountPath: ./service-accounts/my-hybrid-project-apigee-non-prod.json    # for production environments, example-hybrid-apigee-mart.jsonmetrics:  serviceAccountPath: ./service-accounts/my-hybrid-project-apigee-non-prod.json    # for production environments, my-hybrid-project-apigee-metrics.jsonudca:  serviceAccountPath: ./service-accounts/my-hybrid-project-apigee-non-prod.json    # for production environments, my-hybrid-project-apigee-udca.jsonwatcher:  serviceAccountPath: ./service-accounts/my-hybrid-project-apigee-non-prod.json    # for production environments, my-hybrid-project-apigee-watcher.jsonlogger:  enabled: false # Set to "false" for GKE. Set to "true" for all other Kubernetes platforms.  serviceAccountPath: ./service-accounts/my-hybrid-project-apigee-non-prod.json    # for production environments, LOGGER_SERVICE_ACCOUNT_NAME.json

3. When you are finished, save the file.

The following table describes each of the property values that you must provide in the overrides file. For more information, seeConfiguration property reference.

sslCertPath: ./certs/keystore.pemsslKeyPath: ./certs/keystore.key

Summary

The configuration file tells Kubernetes how to deploy the hybrid components to a cluster. Next, you will enable synchronizer access so the Apigee runtime and management planes will be able to communicate.