Default value:IfNotPresent

Determines when kubelet pulls the pod's Docker image. Possible values include:

• IfNotPresent: Do not pull a new image if it already exists.
• Always: Always pull the image, regardless of whether it exists already.

For more information, seeUpdating images.

Default value:1.18.7-asm.4-distroless

The version label for this service's Docker image.

Default value: None

The location of the Docker image for this service.

Useapigee-pull-push --list to see the current repository URL for this component.

Default value: None

Required

Node selector label key used to target dedicated Kubernetes nodes for ingress gateway services.

See Configuring dedicated node pools.

Default value: None

Optional node selector label value used to target dedicated Kubernetes nodes for ingress gateway services and override thenodeSelector.apigeeData settings.

SeenodeSelector.

Default value:4

The maximum number of pods that hybrid can automatically add for the ingress gateway available for autoscaling.

Default value:2

The minimum number of pods for the ingress gateway available for autoscaling.

Default value:75

The threshold of CPU usage for scaling the number of pods in the ReplicaSet, as a percentage of total available CPU resources.

When CPU usage goes above this value, then hybrid will gradually increase the number of pods in the ReplicaSet, up toapigeeIngressGateway.replicaCountMax.

For more information on scaling in Kubernetes, seeHorizontal Pod Autoscaling in the Kubernetes documentation.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

effect specifies the effect that matching a toleration with a taint will have. Values foreffect can be:

• NoExecute
• NoSchedule
• PreferNoSchedule

SeeTaints and Tolerations: Concepts for details.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

key identifies pods to which the toleration can be applied.

SeeTaints and Tolerations: Concepts for details.

Default value:"Equal"

Required to use theTaints and Tolerations feature of Kubernetes.

operator specifies the operation used to trigger theeffect. Values foroperator can be:

• Equal matches the value set invalue.
• Exists ignores the value set invalue.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

tolerationSeconds defines in seconds how long a pod stays bound to a failing or unresponsive node.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

value is the value that triggers theeffect whenoperator is set toEqual.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Optional key/value map used to annotate pods. For more information, seeCustom annotations.

Default value:iloveapis123

Required

Password for the Cassandra administrator. The admin user is used for any administrative activities performed on the Cassandra cluster, such as backup and restore.

Default value:iloveapis123

Required

Password for the Cassandra Data Definition Language (DDL) user. Used by MART for any of the data definition tasks like keyspace creation, update, and deletion.

Default value:iloveapis123

Required

The password for the default Cassandra user created when Authentication is enabled. This password must be reset when configuring Cassandra authentication. SeeConfiguring TLS for Cassandra.

Default value:iloveapis123

Required

Password for the Cassandra Data Manipulation Language (DML) user. The DML user is used by the client communication to read and write data to Cassandra.

Default value:IfNotPresent

Determines when kubelet pulls the pod's Docker image. Possible values include:

• IfNotPresent: Do not pull a new image if it already exists.
• Always: Always pull the image, regardless of whether it exists already.

For more information, seeUpdating images.

Default value:1.12.4

The version label for this service's Docker image.

Default value: None

The location of the Docker image for this service.

Useapigee-pull-push --list to see the current repository URL for this component.

Default value:iloveapis123

Required

Password for the Cassandra JMX operations user. Used to authenticate and communicate with the Cassandra JMX interface.

Default value:jmxuser

Required

Username for the Cassandra JMX operations user. Used to authenticate and communicate with the Cassandra JMX interface.

Default value:iloveapis123

Required

Password for the Cassandra Jolokia JMX operations user. Used to authenticate and communicate with the Cassandra JMX API.

Default value:apigee

Required

Username for the Cassandra Jolokia JMX operations user. Used to authenticate and communicate with the Cassandra JMX API.

Default value: None

The name of the file stored in a Kubernetes secret that contains the Cassandra users and passwords. You can create the secret using following the following instructions:Create the Secret.

See also:

• Storing data in a Kubernetes secret
• Secrets in the Kubernetes documentation
• Creating a Secret Using kubectl in the Kubernetes documentation

Default value: None

The Cassandra secret storage policy. When set, it must match the SecretProviderClass which references the external secret provider, like Hashicorp Vault. When unset, Apigee hybrid uses either the usernames and passwords stored in:

• cassandra.auth.admin.password
• cassandra.auth.ddl.password
• cassandra.auth.default.password
• cassandra.auth.dml.password
• cassandra.auth.jmx.password
• cassandra.auth.jmx.username
• cassandra.auth.jolokia.password
• cassandra.auth.jolokia.username

or the Kubernetes secret stored in:

• cassandra.auth.secret

SeeStoring Cassandra secrets in Hashicorp Vault for instructions to create the policy.

Default value:GCP

The name of a backup provider. Supported values:GCP,HYBRID, andCSI. Set the value to:

• GCP to store backup archives on Google Cloud Storage.
• HYBRID to store backup archives on a remote SSH server.
• CSI (recommended) to utilize Kubernetes CSIVolume Snapshots for backup. For information onCSI backup and restore for cloud platforms such as Google Cloud, AWS, and Azure, seeCSI backup and restore.

Default value: None

Required if backup is enabled andcassandra.backup.cloudProvider is set toGCP.

Must be in the formatgs://BUCKET_NAME (thegs:// prefix is required).

The name of an existing Google Cloud Storage bucket that will be used to store backup archives. See Creating buckets if you need to create one.

Default value:false

Data backup is not enabled by default. To enable, set totrue.

SeeCassandra backup and recovery.

Default value:IfNotPresent

Determines when kubelet pulls the pod's Docker image. Possible values include:

• IfNotPresent: Do not pull a new image if it already exists.
• Always: Always pull the image, regardless of whether it exists already.

For more information, seeUpdating images.

Default value:1.12.4

The version label for this service's Docker image.

Default value: None

The location of the Docker image for this service.

Useapigee-pull-push --list to see the current repository URL for this component.

Default value: None

Required if backup is enabled andcassandra.backup.cloudProvider is set toHYBRID.

The path on your local file system to the SSH private key file.

Default value:0 2 * * *

The schedule for the backup cron job.

SeeCassandra backup and recovery.

Default value: None

Required if backup is enabled andcassandra.backup.cloudProvider is set toHYBRID.

The IP address of your remote SSH backup server.

Default value: None

Path to aGoogle Service Account key file that has theStorage Object Admin (roles/storage.objectAdmin) role. This Google Service Account will be used for uploading backup archives to a specifiedcassandra.backup.dbStorageBucket.

If backup is enabled andcassandra.backup.cloudProvider is set toGCP, one of the following is required to ensure Apigee Hybrid can access the Google Cloud Storage bucket to upload backup archives:

• Specifiedcassandra.backup.serviceAccountPath.
• Specifiedcassandra.backup.serviceAccountRef.
• ConfiguredWorkload Identity for Apigee Hybrid in GKE.
• ConfiguredWorkload Identity Federation for Apigee Hybrid in AKS or EKS.

Default value: None

The name of an existing Kubernetes secret that stores the content of aGoogle Service Account key file that has theStorage Object Admin (roles/storage.objectAdmin) role. This Google Service Account will be used for uploading backup archives to a specifiedcassandra.backup.dbStorageBucket.

If backup is enabled andcassandra.backup.cloudProvider is set toGCP, one of the following is required to ensure Apigee Hybrid can access the Google Cloud Storage bucket to upload backup archives:

• Specifiedcassandra.backup.serviceAccountPath.
• Specifiedcassandra.backup.serviceAccountRef.
• ConfiguredWorkload Identity for Apigee Hybrid in GKE.
• ConfiguredWorkload Identity Federation for Apigee Hybrid in AKS or EKS.

Default value: None

Required if backup is enabled andcassandra.backup.cloudProvider is set toHYBRID.

Can either be an absolute or relative path to theapigee user's home directory.

The name of the backup directory on your backup SSH server.

Default value:apigeecluster

Specifies the name of the Cassandra cluster.

Default value:dc-1

Specifies the datacenter of the Cassandra node.

Default value: None

Note: In Apigee hybrid v1.3, this property is no longer supported.

When you sethostNetwork to true, the DNS policy is set toClusterFirstWithHostNet for you.

Default value: None

Hostname or IP of a Cassandra cluster node. If not set, the Kubernetes local service is used.

Default value:100M

The amount ofJVM system memory allocated to newer objects, in megabytes.

Default value:false

Enables the KuberneteshostNetwork feature. Apigee uses this feature in multi-region installations to communicate between pods if the pod network namespace does not have connectivity between clusters (the clusters are running in "island network mode"), which is the default case in non-GKE installations, including Google Distributed Cloud on VMware or bare metal, GKE on AWS, AKS, EKS, and OpenShift.

Setcassandra.hostNetwork tofalse for single region installations and multi-region installations with connectivity between pods in different clusters, for example GKE installations.

Setcassandra.hostNetwork totrue for multi-region installations with no communication between between pods in different clusters, for example Google Distributed Cloud on VMware or bare metal, GKE on AWS, AKS, EKS, and OpenShift installations. SeeMulti-region deployment: Prerequisites.

Whentrue,DNS policy is automatically set toClusterFirstWithHostNet.

Default value:IfNotPresent

Determines when kubelet pulls the pod's Docker image. Possible values include:

• IfNotPresent: Do not pull a new image if it already exists.
• Always: Always pull the image, regardless of whether it exists already.

For more information, seeUpdating images.

Default value:1.12.4

The version label for this service's Docker image.

Default value: None

The location of the Docker image for this service.

Useapigee-pull-push --list to see the current repository URL for this component.

Default value:512M

The upper limit ofJVM system memory available for Cassandra operations, in megabytes.

Default value: None

IP address of an existing Cassandra cluster used to expand the existing cluster to a new region. SeeConfigure the multi-region seed host.

Default value: None

Required

Node selector label key used to target dedicated Kubernetes nodes forcassandra data services.

See Configuring dedicated node pools.

Default value: None

Optional node selector label value used to target dedicated Kubernetes nodes forcassandra data services and override thenodeSelector.apigeeData settings.

SeenodeSelector.

Default value:9042

Port number used to connect to cassandra.

Default value:ra-1

Specifies the rack of the Cassandra node.

Default value:2

The number of times Kubernetes will verify that readiness probes have failed before marking the podunready. The minimum value is 1.

Default value:0

The number of seconds after a container is started before a readiness probe is initiated.

Default value:10

Determines how often to perform a readiness probe, in seconds. The minimum value is 1.

Default value:1

The minimum consecutive successes needed for a readiness probe to be considered successful after a failure. The minimum value is 1.

Default value:5

The number of seconds after which a liveness probe times out. The minimum value is 1.

Default value:1

Cassandra is a replicated database. This property specifies the number of Cassandra nodes employed as aStatefulSet.

Default value:500m

The CPU needed for normal operation of the resource in a Kubernetes container, in millicores.

Default value:1Gi

The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes.

Default value:GCP

The name of a restore provider. Supported values:GCP,HYBRID, andCSI. Set the value to:

• GCP to restore data from a backup stored on Google Cloud Storage.
• HYBRID to restore data from a backup stored on a remote SSH server.
• CSI (recommended) to utilize Kubernetes CSIVolume Snapshots for restore. For information onCSI backup and restore for cloud platforms such as Google Cloud, AWS, and Azure, seeCSI backup and restore.

Default value: None

Required if restore is enabled andcassandra.restore.cloudProvider is set toGCP.

Must be in the formatgs://BUCKET_NAME (thegs:// prefix is required).

The name of a Google Cloud Storage bucket that stores backup archives to be used for data restoration.

Default value:false

Data restoration is not enabled by default. To enable, set totrue.

SeeCassandra backup and recovery.

Default value:IfNotPresent

Determines when kubelet pulls the pod's Docker image. Possible values include:

• IfNotPresent: Do not pull a new image if it already exists.
• Always: Always pull the image, regardless of whether it exists already.

For more information, seeUpdating images.

Default value:1.12.4

The version label for this service's Docker image.

Default value: None

The location of the Docker image for this service.

Useapigee-pull-push --list to see the current repository URL for this component.

Default value: None

Path to aGoogle Service Account key file that has theStorage Object Admin (roles/storage.objectAdmin) role. This Google Service Account will be used to download backup archives from a specifiedcassandra.restore.dbStorageBucket.

If restore is enabled andcassandra.restore.cloudProvider is set toGCP, one of the following is required to ensure Apigee Hybrid can access the Google Cloud Storage bucket to download backup archives for restoration:

• Specifiedcassandra.restore.serviceAccountPath.
• Specifiedcassandra.restore.serviceAccountRef.
• ConfiguredWorkload Identity for Apigee Hybrid in GKE.
• ConfiguredWorkload Identity Federation for Apigee Hybrid in AKS or EKS.

Default value: None

The name of an existing Kubernetes secret that stores the content of aGoogle Service Account key file that has theStorage Object Admin (roles/storage.objectAdmin) role. This Google Service Account will be used to download backup archives from a specifiedcassandra.restore.dbStorageBucket.

If restore is enabled andcassandra.restore.cloudProvider is set toGCP, one of the following is required to ensure Apigee Hybrid can access the Google Cloud Storage bucket to download backup archives for restoration:

• Specifiedcassandra.restore.serviceAccountPath.
• Specifiedcassandra.restore.serviceAccountRef.
• ConfiguredWorkload Identity for Apigee Hybrid in GKE.
• ConfiguredWorkload Identity Federation for Apigee Hybrid in AKS or EKS.

Default value: None

Required if restore is enabled.

Timestamp of the backup that should be restored.

Default value: None

The path on your system to a TLS certificate file.

Default value: None

The path on your system to the TLS private key file.

Default value: None

The certificate chain to the root CA (certificate authority).

Default value:10Gi

Required ifstorage.storageclass is specified

Specifies the disk size required, in mebibytes (Mi) or gibibytes (Gi).

Default value: None

Specifies the class of on-prem storage being used.

Default value:10Gi

Required ifstorage.storageclass is specified

Specifies the disk size required, in mebibytes (Mi) or gibibytes (Gi).

Default value:300

The time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

effect specifies the effect that matching a toleration with a taint will have. Values foreffect can be:

• NoExecute
• NoSchedule
• PreferNoSchedule

SeeTaints and Tolerations: Concepts for details.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

key identifies pods to which the toleration can be applied.

SeeTaints and Tolerations: Concepts for details.

Default value:"Equal"

Required to use theTaints and Tolerations feature of Kubernetes.

operator specifies the operation used to trigger theeffect. Values foroperator can be:

• Equal matches the value set invalue.
• Exists ignores the value set invalue.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

tolerationSeconds defines in seconds how long a pod stays bound to a failing or unresponsive node.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

value is the value that triggers theeffect whenoperator is set toEqual.

SeeTaints and Tolerations: Concepts for details.

Default value:cert-manager

The namespace forcert-manager.

SeeRunning cert-manager in a custom namespace.

Default value: None

Optional key/value map used to annotate pods. For more information, seeCustom annotations.

Default value: None

Helm only: The email address of the Google IAM service account (GSA) for connectAgent to associate with the corresponding Kubernetes service account when enabling Workload Identity on GKE clusters using Helm charts. Set this when you have setgcp.workloadIdentity.enabled totrue.

GSA_NAME@PROJECT_ID.iam.gserviceaccount.com

apigee-mart@my-hybrid-project.iam.gserviceaccount.com

gcloud iam service-accounts list --project ${PROJECT_ID} --filter "apigee"

SeeEnabling Workload Identity on GKE orEnabling Workload Identity Federation on AKS and EKS.

Default value:INFO

The level of log reporting. Values can be:

• INFO: Informational messages in addition to warning, error, and fatal messages. Most useful for debugging.
• WARNING: Non-fatal warnings in addition to error and fatal messages.
• ERROR: Internal errors and errors that are not returned to the user in addition to fatal messages.
• FATAL: Unrecoverable errors and events that cause Apigee Connect to crash.

Default value:IfNotPresent

Determines when kubelet pulls the pod's Docker image. Possible values include:

• IfNotPresent: Do not pull a new image if it already exists.
• Always: Always pull the image, regardless of whether it exists already.

For more information, seeUpdating images.

Default value:1.12.4

The version label for this service's Docker image.

Default value: None

The location of the Docker image for this service.

Useapigee-pull-push --list to see the current repository URL for this component.

Default value:5

Maximum number of replicas available for autoscaling.

Default value:1

Minimum number of replicas available for autoscaling.

In production, you may want to increasereplicaCountMin to 1, to have a greater number of connections to the control plane for reliability and scalability.

Default value:512m

The CPU limit for the resource in a Kubernetes container, in millicores.

Default value:512Mi

The memory limit for the resource in a Kubernetes container, in mebibytes.

Default value:100m

The CPU needed for normal operation of the resource in a Kubernetes container, in millicores.

Default value:30Mi

The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes.

Default value:apigeeconnect.googleapis.com:443

The location of the server and port for this service.

Default value: None

One of eitherserviceAccountPath orserviceAccountRef is required.

Path to Google Service Account key file for theapigee-mart service account.

In most installations, the value ofconnectAgent.serviceAccountPath must match the value ofmart.serviceAccountPath.

Default value: None

One of eitherserviceAccountPath orserviceAccountRef is required.

In most installations, the value ofconnectAgent.serviceAccountRef must match the value ofmart.serviceAccountRef.

Default value:75

Target CPU utilization for the Apigee Connect agent on the pod. The value of this field enables Apigee Connect to auto-scale when CPU utilization reaches this value, up toreplicaCountMax.

Default value:600

The time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

effect specifies the effect that matching a toleration with a taint will have. Values foreffect can be:

• NoExecute
• NoSchedule
• PreferNoSchedule

SeeTaints and Tolerations: Concepts for details.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

key identifies pods to which the toleration can be applied.

SeeTaints and Tolerations: Concepts for details.

Default value:"Equal"

Required to use theTaints and Tolerations feature of Kubernetes.

operator specifies the operation used to trigger theeffect. Values foroperator can be:

• Equal matches the value set invalue.
• Exists ignores the value set invalue.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

tolerationSeconds defines in seconds how long a pod stays bound to a failing or unresponsive node.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

value is the value that triggers theeffect whenoperator is set toEqual.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Required

The name of the Google Cloud storage bucket where your diagnostic data will be deposited.

SeeCreating storage buckets.

Default value: None

Required

This specifies which type of pod you are capturing data from. The values can be one of:

• "apigee-cassandra" captures data about the Cassandra databgase. The istio-cassandra pods runs in the apigee namespace.
• "apigee-mart-server" captures data about MART. The apigee-mart-server pods runs in the apigee namespace.
• "apigee-runtime" captures data about the Message Processor. The apigee-runtime pods runs in the apigee namespace.
• "apigee-synchronizer" captures data about the Synchronizer. The apigee-synchronizer pods runs in the apigee namespace.
• "apigee-udca" captures data about UDCA. The apigee-udca pods runs in the apigee namespace.
• "apigee-watcher" captures data about Watcher. The apigee-watcher pods runs in the apigee namespace.
• "istio-proxy" captures data about the Istio ingress gateway. The istio-proxy pods runs in the istio-system namespace.

Default value: None

Required if the diagnostic collection operation is "LOGGING" (set withoperation: "LOGGING")

The duration in milliseconds of the log data collected. A typical value is30000.

Seediagnostic.operation

Default value: None

Required if the diagnostic collection operation is "LOGGING" (set withoperation: "LOGGING")

Specifies by name which loggers to collect data from. For Apigee hybrid version 1.6.0, the only value supported isALL, meaning all loggers. For example:

diagnostic:loggingDetails:loggerNames:-ALL

Default value: None

Required if the diagnostic collection operation is "LOGGING" (set withoperation: "LOGGING")

Specifies the granularity of the logging data to collect. In Apigee hybrid 1.6, OnlyFINE is supported.

Default value: None

Required

The Kubernetes namespace in which the pods you are collecting data on reside. The namespace must be the correct one for the container you specify withdiagnostic.container:

apigee for

• apigee-runtime
• apigee-synchronizer
• apigee-udca
• apigee-watcher
• apigee-cassandra
• apigee-mart-server

istio-system for

• istio-proxy

Default value: None

Required

Specifies whether to collect all statistics or just logs.

Values are:

• "ALL"
• "LOGGING"

  If you setdiagnostic.operation to"LOGGING", the following properties are required:

  • diagnostic.loggingDetails.logDuration
  • diagnostic.loggingDetails.loggerNames
  • diagnostic.loggingDetails.logLevel

Default value: None

Required

The names of the Kubernetes pods for which you are collecting data. For example:

diagnostic:podNames:-apigee-runtime-eng-hybrid-example-3b2ebf3-150-8vfoj-2wcjn-apigee-runtime-eng-hybrid-example-3b2ebf3-150-8vfoj-6xzn2

Default value: None

Required

The path to a service account key file (.json) for the service account with the Storage Admin role (roles/storage.admin). In most Apigee hybrid installations, this is theapigee-cassandra service account.

SeeAbout service accounts.

Default value: None

One of eitherdiagnostic.tcpDumpDetails.maxMsgs ordiagnostic.tcpDumpDetails.timeoutInSeconds isRequired if you are usingdiagnostic.tcpDumpDetails.

Sets the maximum number oftcpDump messages to collect. Apigee recommends a maximum value no greater than1000.

Default value: None

One of eitherdiagnostic.tcpDumpDetails.maxMsgs ordiagnostic.tcpDumpDetails.timeoutInSeconds isRequired if you are usingdiagnostic.tcpDumpDetails.

Sets the amount of time in seconds to wait fortcpDump to return messages.

Default value: None

Bothdiagnostic.threadDumpDetails.delayInSeconds anddiagnostic.threadDumpDetails.iterations areRequired if you are usingdiagnostic.threadDumpDetails.

The delay in seconds between collecting each thread dump.

Default value: None

Bothdiagnostic.threadDumpDetails.delayInSeconds anddiagnostic.threadDumpDetails.iterations areRequired if you are usingdiagnostic.threadDumpDetails.

The number of jstack thread dump iterations to collect.

Default value: None

One of eithercacheEncryptionKey,cacheEncryptionPath, orcacheEncryptionSecret is required.

A base64-encoded encryption key. SeeData encryption.

Default value: None

One of eithercacheEncryptionKey,cacheEncryptionPath, orcacheEncryptionSecret is required.

The path to a file containing a base64-encoded encryption key. SeeData encryption.

Default value: None

One of eithercacheEncryptionKey,cacheEncryptionPath, orcacheEncryptionSecret is required.

The key of aKubernetes secret containing a base64-encoded encryption key. SeeData encryption.

Default value: None

One of eithercacheEncryptionKey, orcacheEncryptionPath, orcacheEncryptionSecret is required.

The name of aKubernetes secret containing a base64-encoded encryption key. SeeData encryption.

Default value: 4

Maximum number of replicas for autoscaling. Overridesruntime.replicaCountMax if specified.

Default value: 1

Minimum number of replicas for autoscaling. Overridesruntime.replicaCountMin if specified.

Default value: 4

Maximum number of replicas for autoscaling. Overridessynchronizer.replicaCountMax if specified.

Default value: 1

Minimum number of replicas for autoscaling. Overridessynchronizer.replicaCountMin if specified.

Default value: 4

Maximum number of replicas for autoscaling. Overridesudca.replicaCountMax if specified.

Default value: 1

Minimum number of replicas for autoscaling. Overridesudca.replicaCountMin if specified.

Default value: None

Helm only: The email address of the runtime Google IAM service account to associate with the corresponding Kubernetes service account when enabling Workload Identity on GKE clusters using Helm charts.

gcloud iam service-accounts list --project ${PROJECT_ID} --filter "apigee"

SeeEnabling Workload Identity on GKE orEnabling Workload Identity Federation on AKS and EKS.

Default value: None

Helm only: The email address of the synchronizer Google IAM service account to associate with the corresponding Kubernetes service account when enabling Workload Identity on GKE clusters using Helm charts.

gcloud iam service-accounts list --project ${PROJECT_ID} --filter "apigee"

SeeEnabling Workload Identity on GKE orEnabling Workload Identity Federation on AKS and EKS.

Default value: None

Helm only: The email address of the udca Google IAM service account for env-scoped udca to associate with the corresponding Kubernetes service account when enabling Workload Identity on GKE clusters using Helm charts.

gcloud iam service-accounts list --project ${PROJECT_ID} --filter "apigee"

SeeEnabling Workload Identity on GKE orEnabling Workload Identity Federation on AKS and EKS.

Default value: None

Deprecated: Starting in Hybrid version 1.4 the runtime plane receives this information from the management plane. SeeAbout environments and environment groups.

Default value: None

Specifies the host name or IP address where the HTTP proxy is running.

ListhttpProxy properties in the orderscheme,host,port. For example:

envs:  - name: test    httpProxy:      scheme: HTTP      host: 10.12.0.47      port: 3128      ...

See also:Configure forward proxying for API proxies.

Default value: None

Specifies the port on which the HTTP proxy is running. If this property is omitted, by default it uses port80 for HTTP and port443 for HTTPS.

Default value:HTTPS

Specifies the type of the HTTP proxy as HTTP or HTTPS. By default, it usesHTTPS.

Default value: None

If the HTTP proxy requires basic authentication, then use this property to provide a username.

Default value: None

If the HTTP proxy requires basic authentication, then use this property to provide a password.

Default value: None

Required

Apigee environment name to be synchronized.

Default value: None

Interval used for polling organization and environment synchronization changes, in seconds.

Default value: None

TCP port number for HTTPS traffic.

Default value: None

Path to file on local system to a Google Service Account key with theCloud Trace Agent role, usually theapigee-runtime service account. See theAbout service accounts for the default names of the service accounts and their assigned roles.

Default value: None

Path to file on local system to a Google Service Account key with theApigee Synchronizer Manager role.

Default value: None

Path to file on local system to a Google Service Account key with theApigee Analytic Agent role.

Only set this property iforgScopedUDCA is set tofalse.

Default value: None

The name of the environment-specific secret provider class (SecretProviderClass) used for storing service account keys in Vault.

SeeStoring service account keys in Hashicorp Vault.

Default value: None

The name of aKubernetes secret. You mustcreate the secret using a Google Service Account key with theCloud Trace Agent role as its input.

Default value: None

The name of aKubernetes secret. You mustcreate the secret using a Google Service Account key with theApigee Synchronizer Manager role as its input.

Default value: None

The name of aKubernetes secret. You mustcreate the secret using a Google Service Account key with theApigee Analytic Agent role as its input.

Only set this property iforgScopedUDCA is set tofalse.

Default value: None

EithersslCertPath/sslKeyPath orsslSecret is required.

The path on your system to a TLS certificate file.

Default value: None

EithersslCertPath/sslKeyPath orsslSecret is required.

The path on your system to the TLS private key file.

Default value: None

EithersslCertPath/sslKeyPath orsslSecret is required.

The name of a file stored in a Kubernetes secret that contains the TLS certificate and private key. You must create the secret using the TLS certificate and key data as its input.

See also:

• Storing data in a Kubernetes secret
• Secrets in the Kubernetes documentation
• Creating a Secret Using kubectl in the Kubernetes documentation

Default value: None

The allowed audience of the Workload Identity Provider on non-GKE platforms.

SeeEnabling Workload Identity Federation on AKS and EKS.

Default value: None

The filename and path to the credential source file used by Workload Identity Federation to obtain the credentials for the service accounts. This is the value you provide forcredential-source-file when you configure Workload Identity Federation with thecreate-cred-config command.

SeeEnabling Workload Identity Federation on AKS and EKS.

Default value:false

Enables Workload Identity Federation on non-GKE platforms. Must not be settrue ifgcp.workloadIdentity.enabled is set totrue in the same cluster.

SeeEnabling Workload Identity Federation on AKS and EKS.

Default value:3600

The lifetime of the token in seconds.

SeeEnabling Workload Identity Federation on AKS and EKS.

Default value: None

Required

Identifies the Google Cloud project whereapigee-logger and theapigee-metrics push their data.

Default value: None

Identifies the runtime Kubernetes cluster project.

TheprojectIDRuntime property is optional. If not used, it is assumed that theprojectID value is used for both the Apigee organization's Google Cloud project and the runtime K8S cluster's project.

Default value:us-central1

Required

Identifies the Google Cloudregion where theapigee-logger and theapigee-metrics push their data.

Default value:false

Helm only: Enables using Workload Identity on GKE. Workload Identity allows workloads in your GKE clusters to impersonate Identity and Access Management (IAM) service accounts to access Google Cloud services.

Must not be settrue ifgcp.federatedWorkloadIdentity.enabled is set totrue in the same cluster.

Whenenabled isfalse, the default, Apigee uses the IAM service accounts for each Apigee hybrid component. SeeAbout service accounts.

WhenworkloadIdentityEnabled istrue, Apigee uses Kubernetes service accounts and maps them to the appropriate IAM service accounts for each component. Specify the IAM service accounts to map to the Kubernetes service accounts with:

• gcp.workloadIdentity.gsa
• connectAgent.gsa
• envs.gsa.runtime
• envs.gsa.synchronizer
• envs.gsa.udca
• logger.gsa
• mart.gsa
• metrics.gsa
• udca.gsa
• watcher.gsa

Default value: None

Helm only: The email address of the Google IAM service account (GSA) for all components to associate with the corresponding Kubernetes service account when enabling Workload Identity on GKE clusters using Helm charts. Set this when you have setgcp.workloadIdentity.enabled totrue.

gcp.workloadIdentity.gsa applies to all hybrid components. If you specify a value forgcp.workloadIdentity.gsa, you do not need to provide a GSA for any individual hybrid components. If you do supply a GSA for an individual component, that component's GSA overridesgcp.workloadIdentity.gsa for that component only.

GSA email addresses typically have the format of:

GSA_NAME@PROJECT_ID.iam.gserviceaccount.com

For example:

apigee-non-prod@my-hybrid-project.iam.gserviceaccount.com

gcloud iam service-accounts list --project ${PROJECT_ID} --filter "apigee"

SeeEnabling Workload Identity on GKE.

Default value:false

apigeectl only: Enables using Workload Identity. Workload Identity allows workloads in your GKE clusters to impersonate Identity and Access Management (IAM) service accounts to access Google Cloud services.

WhenworkloadIdentityEnabled isfalse, the default, Apigee uses the IAM service accounts for each Apigee hybrid component. SeeAbout service accounts.

WhenworkloadIdentityEnabled istrue, Apigee uses Kubernetes service accounts instead of IAM service accounts and will ignore the following configuration properties:

• validateServiceAccounts
• cassandra.backup.serviceAccountPath
• cassandra.backup.serviceAccountRef
• cassandra.restore.serviceAccountPath
• cassandra.restore.serviceAccountRef
• envs[].serviceAccountPaths.*
• logger.serviceAccountPath
• logger.serviceAccountRef
• mart.serviceAccountPath
• mart.serviceAccountRef
• metrics.serviceAccountPath
• metrics.serviceAccountRef
• synchronizer.serviceAccountPath
• synchronizer.serviceAccountRef
• udca.serviceAccountPath
• udca.serviceAccountRef
• watcher.serviceAccountPath
• watcher.serviceAccountRef

Default value: None

The hostname of the HTTP Proxy.

Default value: None

The port of the HTTP Proxy.

Default value:HTTPS

The scheme used by the proxy. Values can beHTTP orHTTPS. Values must be uppercase only.

Default value: None

If the HTTP proxy requires basic authentication, then use this property to provide a username.

Default value: None

If the HTTP proxy requires basic authentication, then use this property to provide a password.

Default value: None

Required

The name of ingress gateway. Other services will use this name to address traffic to the gateway. The name must meet the following requirements:

• have a maximum length of 17 characters
• contain only lowercase alphanumeric characters, '-' or '.'
• start with an alphanumeric character
• end with an alphanumeric character

For more information, seeDNS Subdomain Names in the Kubernetes documentation.

Default value:2000m

The CPU limit for the resource, in millicores.

Default value:1Gi

The memory limit for the resource, in mebibytes.

Default value:300m

The CPU needed for normal operation of the resource, in millicores.

Default value:128Mi

The memory needed for normal operation of the resource, in mebibytes.

Default value:10

The maximum number of pods that hybrid can automatically add for the ingress gateway available for autoscaling.

Default value:2

The minimum number of pods for the ingress gateway available for autoscaling.

Default value: None

Optional key/value map used to annotate the ingress gateway on platforms that support annotation. For example:

ingressGateways:  svcAnnotations:    networking.gke.io/load-balancer-type: "Internal"

Default value: None

On platforms that support specifying the load balancer IP address, the load balancer will be created with this IP address. On platforms that do not allow you to specify the load balancer IP address, this property is ignored.

Default value: LoadBalancer

Used to change the type of the default k8s service for ingress deployment. Set the value toClusterIP if you want to disable creation of default load balancer. Possible values:

• ClusterIP
• LoadBalancer

Default value:75

The threshold of CPU usage for scaling the number of pods in the ReplicaSet, as a percentage of total available CPU resources.

When CPU usage goes above this value, then hybrid will gradually increase the number of pods in the ReplicaSet, up toingressGateways[].replicaCountMax.

For more information on scaling in Kubernetes, seeHorizontal Pod Autoscaling in the Kubernetes documentation.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

effect specifies the effect that matching a toleration with a taint will have. Values foreffect can be:

• NoExecute
• NoSchedule
• PreferNoSchedule

SeeTaints and Tolerations: Concepts for details.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

key identifies pods to which the toleration can be applied.

SeeTaints and Tolerations: Concepts for details.

Default value:"Equal"

Required to use theTaints and Tolerations feature of Kubernetes.

operator specifies the operation used to trigger theeffect. Values foroperator can be:

• Equal matches the value set invalue.
• Exists ignores the value set invalue.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

tolerationSeconds defines in seconds how long a pod stays bound to a failing or unresponsive node.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

value is the value that triggers theeffect whenoperator is set toEqual.

SeeTaints and Tolerations: Concepts for details.

Default value:/dev/stdout

The file address for the ingress access log, for example/dev/stdout.

Leaving this value undefined disables access logging.

The format for the ingress access log.

Leaving this value undefined results in using the proxy's default access log format.

Default access log format:

'{"start_time":"%START_TIME%","remote_address":"%DOWNSTREAM_DIRECT_REMOTE_ADDRESS%","user_agent":"%REQ(USER-AGENT)%","host":"%REQ(:AUTHORITY)%","request":"%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%","request_time":"%DURATION%","status":"%RESPONSE_CODE%","status_details":"%RESPONSE_CODE_DETAILS%","bytes_received":"%BYTES_RECEIVED%","bytes_sent":"%BYTES_SENT%","upstream_address":"%UPSTREAM_HOST%","upstream_response_flags":"%RESPONSE_FLAGS%","upstream_response_time":"%RESPONSE_DURATION%","upstream_service_time":"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%","upstream_cluster":"%UPSTREAM_CLUSTER%","x_forwarded_for":"%REQ(X-FORWARDED-FOR)%","request_method":"%REQ(:METHOD)%","request_path":"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%","request_protocol":"%PROTOCOL%","tls_protocol":"%DOWNSTREAM_TLS_VERSION%","request_id":"%REQ(X-REQUEST-ID)%","sni_host":"%REQUESTED_SERVER_NAME%","apigee_dynamic_data":"%DYNAMIC_METADATA(envoy.lua)%"}'

The following is a copy of the default access log format with line breaks added for readability.

'{"start_time":"%START_TIME%",  "remote_address":"%DOWNSTREAM_DIRECT_REMOTE_ADDRESS%",  "user_agent":"%REQ(USER-AGENT)%",  "host":"%REQ(:AUTHORITY)%",  "request":"%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%",  "request_time":"%DURATION%",  "status":"%RESPONSE_CODE%",  "status_details":"%RESPONSE_CODE_DETAILS%",  "bytes_received":"%BYTES_RECEIVED%",  "bytes_sent":"%BYTES_SENT%",  "upstream_address":"%UPSTREAM_HOST%",  "upstream_response_flags":"%RESPONSE_FLAGS%",  "upstream_response_time":"%RESPONSE_DURATION%",  "upstream_service_time":"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%",  "upstream_cluster":"%UPSTREAM_CLUSTER%",  "x_forwarded_for":"%REQ(X-FORWARDED-FOR)%",  "request_method":"%REQ(:METHOD)%",  "request_path":"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%",  "request_protocol":"%PROTOCOL%",  "tls_protocol":"%DOWNSTREAM_TLS_VERSION%",  "request_id":"%REQ(X-REQUEST-ID)%",  "sni_host":"%REQUESTED_SERVER_NAME%",  "apigee_dynamic_data":"%DYNAMIC_METADATA(envoy.lua)%"}'

Default value:SANITIZE_SET

Determines how the Envoy proxy (for the Apigee ingress gateway) handles thex-forwarded-client-cert (XFCC) HTTP header.

Possible values are:

• SANITIZE_SET (default) When the client connection is mTLS, reset the XFCC header with the client certificate information and send it to the next hop.
• FORWARD_ONLY When the client connection is mTLS (Mutual TLS), forward the XFCC header in the request only.
• APPEND_FORWARD When the client connection is mTLS, append the client certificate information to the request's XFCC header and forward it.
• SANITIZE Do not forward the XFCC header.
• ALWAYS_FORWARD_ONLY Always forward the XFCC header in the request, regardless of whether the client connection is mTLS.

For more information on these values, see the Envoy documentation forEnum extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ForwardClientCertDetails.

If you change this setting after installing Hybrid, apply it withapigeectl init and then restart your Apigee ingress gateway pods.

Default values:

- "GoogleStackdriverMonitoring-UptimeChecks(https://cloud.google.com/monitoring)"- "Edge Health Probe"

Enables non-Google Cloud loadbalancers to check the ingress gateway's health check endpoints (/healthz/ingress and/healthz) by overriding the default user-agent allow list in hybrid.

istiod:  healthCheckUserAgents:   - "CUSTOM_USER_AGENT_1"  - "CUSTOM_USER_AGENT_2"

istiod:  healthCheckUserAgents: []

Default value:IfNotPresent

Determines when kubelet pulls the pod's Docker image. Possible values include:

• IfNotPresent: Do not pull a new image if it already exists.
• Always: Always pull the image, regardless of whether it exists already.

For more information, seeUpdating images.

Default value:1.18.7-asm.4-distroless

The version label for this service's Docker image.

Default value: None

The location of the Docker image for this service.

Useapigee-pull-push --list to see the current repository URL for this component.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

effect specifies the effect that matching a toleration with a taint will have. Values foreffect can be:

• NoExecute
• NoSchedule
• PreferNoSchedule

SeeTaints and Tolerations: Concepts for details.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

key identifies pods to which the toleration can be applied.

SeeTaints and Tolerations: Concepts for details.

Default value:"Equal"

Required to use theTaints and Tolerations feature of Kubernetes.

operator specifies the operation used to trigger theeffect. Values foroperator can be:

• Equal matches the value set invalue.
• Exists ignores the value set invalue.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

tolerationSeconds defines in seconds how long a pod stays bound to a failing or unresponsive node.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

value is the value that triggers theeffect whenoperator is set toEqual.

SeeTaints and Tolerations: Concepts for details.

Default value: None

The name of the Kubernetes cluster where the hybrid runtime is installed.

Default value: None

Identifies the Google Cloudregion in which your Kubernetes cluster was created.

Default value:IfNotPresent

Determines when kubelet pulls the pod's Docker image. Possible values include:

• IfNotPresent: Do not pull a new image if it already exists.
• Always: Always pull the image, regardless of whether it exists already.

For more information, seeUpdating images.

Default value:v0.14.2

The version label for this service's Docker image.

Default value: None

The location of the Docker image for this service.

Useapigee-pull-push --list to see the current repository URL for this component.

Default value:500m

The CPU limit for the resource in a Kubernetes container, in millicores.

Default value:128Mi

The memory limit for the resource in a Kubernetes container, in mebibytes.

Default value:5m

The CPU needed for normal operation of the resource in a Kubernetes container, in millicores.

Default value:64Mi

The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes.

Default value: None

Optional key/value map used to annotate pods. For more information, seeCustom annotations.

Default value: 256k

The initial buffer size to read log files.

Default value: 104857600

The limit of the buffer size per monitored file. Files exceeding this limit are removed from the monitored file list.

Default value: 150MB

The limit of memory that logger can consumed. If reach, the logger will momentarily pause reading more data until the existing data is flushed in memory.

Default value:false

Enables or disables logging on the cluster. For non-GKE set totrue, for GKE on Google Cloud or Google Distributed Cloud set tofalse.

Default value: None

Allows you to include theNO_PROXY Fluent Bit environment variable, which specifies URLs for which traffic is not routed through the HTTP proxy. TheNO_PROXY variable should be defined as a comma-separated string of host names, in the format:

logger:  ...  envVars:    NO_PROXY: '<comma-separated-values>'

for example:

  envVars:    NO_PROXY: 'kubernetes.default.svc,oauth2.googleapis.com,logging.googleapis.com'

UseenvVars: NO_PROXY optionally when you have HTTP forward proxy enabled.

SeeNO_PROXY in the Fluent Bit documentation.

Default value: 1

The interval to wait before invoking the next buffer flushed, in seconds.

Default value: None

Helm only: The email address of theapigee-logger Google IAM service account (GSA) to associate with the corresponding Kubernetes service account when enabling Workload Identity on GKE clusters using Helm charts. Set this when you have setgcp.workloadIdentity.enabled totrue.

GSA email addresses typically have the format of:

GSA_NAME@PROJECT_ID.iam.gserviceaccount.com

For example:

apigee-logger@my-hybrid-project.iam.gserviceaccount.com

gcloud iam service-accounts list --project ${PROJECT_ID} --filter "apigee"

SeeEnabling Workload Identity on GKE orEnabling Workload Identity Federation on AKS and EKS.

Default value:IfNotPresent

Determines when kubelet pulls the pod's Docker image. Possible values include:

• IfNotPresent: Do not pull a new image if it already exists.
• Always: Always pull the image, regardless of whether it exists already.

For more information, seeUpdating images.

Default value:1.9.9

The version label for this service's Docker image.

Default value: None

The location of the Docker image for this service.

Useapigee-pull-push --list to see the current repository URL for this component.

Default value:3

The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1.

Default value:0

The number of seconds after a container is started before a liveness probe is initiated.

Default value:60

Determines how often to perform a liveness probe, in seconds. The minimum value is 1.

Default value:1

The minimum consecutive successes needed for a liveness probe to be considered successful after a failure. The minimum value is 1.

Default value:1

The number of seconds after which a liveness probe times out. The minimum value is 1.

Default value:apigee.com/apigee-logger-enabled

Required

Node selector label key used to target dedicated Kubernetes nodes forlogger runtime services.

See Configuring dedicated node pools.

Default value:true

Required

Node selector label value used to target dedicated Kubernetes nodes forlogger runtime services.

See Configuring dedicated node pools.

Default value:200m

The CPU limit for the resource in a Kubernetes container, in millicores.

Default value:500Mi

The memory limit for the resource in a Kubernetes container, in mebibytes.

Default value:100m

The CPU needed for normal operation of the resource in a Kubernetes container, in millicores.

Default value:250Mi

The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes.

Default value: None

One of eitherserviceAccountPath orserviceAccountRef is required.

Path to Google Service Account key file withLogs Writer role.

Default value: None

One of eitherserviceAccountPath orserviceAccountRef is required.

Default value: 128

The maximum number of chunks that can be up in memory. Chunks exceeding the limit will be saved in the file system.

Default value:30

The time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

effect specifies the effect that matching a toleration with a taint will have. Values foreffect can be:

• NoExecute
• NoSchedule
• PreferNoSchedule

SeeTaints and Tolerations: Concepts for details.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

key identifies pods to which the toleration can be applied.

SeeTaints and Tolerations: Concepts for details.

Default value:"Equal"

Required to use theTaints and Tolerations feature of Kubernetes.

operator specifies the operation used to trigger theeffect. Values foroperator can be:

• Equal matches the value set invalue.
• Exists ignores the value set invalue.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

tolerationSeconds defines in seconds how long a pod stays bound to a failing or unresponsive node.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

value is the value that triggers theeffect whenoperator is set toEqual.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Optional key/value map used to annotate pods. For more information, seeCustom annotations.

Default value: None

Helm only: The email address of theapigee-mart Google IAM service account (GSA) to associate with the corresponding Kubernetes service account when enabling Workload Identity on GKE clusters using Helm charts. Set this when you have setgcp.workloadIdentity.enabled totrue.

GSA email addresses typically have the format of:

GSA_NAME@PROJECT_ID.iam.gserviceaccount.com

For example:

apigee-mart@my-hybrid-project.iam.gserviceaccount.com

gcloud iam service-accounts list --project ${PROJECT_ID} --filter "apigee"

SeeEnabling Workload Identity on GKE orEnabling Workload Identity Federation on AKS and EKS.

Default value: None

The host alias pointing to theMART object. You can set this property to* or a fully-qualified domain name.

Default value:IfNotPresent

Determines when kubelet pulls the pod's Docker image. Possible values include:

• IfNotPresent: Do not pull a new image if it already exists.
• Always: Always pull the image, regardless of whether it exists already.

For more information, seeUpdating images.

Default value:1.12.4

The version label for this service's Docker image.

Default value: None

The location of the Docker image for this service.

Useapigee-pull-push --list to see the current repository URL for this component.

Default value:10m

The amount of CPU resources allocated to the initialization check of the Cloud Foundry process.

Default value:12

The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1.

Default value:15

The number of seconds after a container is started before a liveness probe is initiated.

Default value:5

Determines how often to perform a liveness probe, in seconds. The minimum value is 1.

Default value:1

The number of seconds after which a liveness probe times out. The minimum value is 1.

Default value:/v1/server/metrics

Default value: None

Optional node selector label key for targeting Kubernetes nodes formart runtime services. If you do not specify a key for mart.nodeselector, then your runtime uses the node specified in thenodeSelector object.

See Configuring dedicated node pools.

Default value: None

Optional node selector label value for targeting Kubernetes nodes formart runtime services. See also thenodeSelector object.

See Configuring dedicated node pools.

Default value:2

The number of times Kubernetes will verify that readiness probes have failed before marking the podunready. The minimum value is 1.

Default value:15

The number of seconds after a container is started before a readiness probe is initiated.

Default value:5

Determines how often to perform a readiness probe, in seconds. The minimum value is 1.

Default value:1

The minimum consecutive successes needed for a readiness probe to be considered successful after a failure. The minimum value is 1.

Default value:1

The number of seconds after which a liveness probe times out. The minimum value is 1.

Default value:5

Maximum number of replicas available for autoscaling.

Default value:1

Minimum number of replicas available for autoscaling.

Default value:2000m

The CPU limit for the resource in a Kubernetes container, in millicores.

Default value:5Gi

The memory limit for the resource in a Kubernetes container, in mebibytes.

Default value:500m

The CPU needed for normal operation of the resource in a Kubernetes container, in millicores.

Default value:512Mi

The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes.

Default value: None

One of eitherserviceAccountPath orserviceAccountRef is required.

Path to Google Service Account key file withno role.

Default value: None

One of eitherserviceAccountPath orserviceAccountRef is required.

Default value: None

EithersslCertPath/sslKeyPath orsslSecret is required.

Local file system path for loading and encoding the SSL cert to a Secret.

Default value: None

EithersslCertPath/sslKeyPath orsslSecret is required.

Local file system path for loading and encoding the SSL key to a Secret.

Default value: None

EithersslCertPath/sslKeyPath orsslSecret is required.

The name of a file stored in a Kubernetes secret that contains the TLS certificate and private key. You must create the secret using the TLS certificate and key data as its input.

See also:

• Storing data in a Kubernetes secret
• Secrets in the Kubernetes documentation
• Creating a Secret Using kubectl in the Kubernetes documentation

Default value:75

Target CPU utilization for the MART process on the pod. The value of this field enables MART to auto-scale when CPU utilization reaches this value, up toreplicaCountMax.

Default value:30

The time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

effect specifies the effect that matching a toleration with a taint will have. Values foreffect can be:

• NoExecute
• NoSchedule
• PreferNoSchedule

SeeTaints and Tolerations: Concepts for details.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

key identifies pods to which the toleration can be applied.

SeeTaints and Tolerations: Concepts for details.

Default value:"Equal"

Required to use theTaints and Tolerations feature of Kubernetes.

operator specifies the operation used to trigger theeffect. Values foroperator can be:

• Equal matches the value set invalue.
• Exists ignores the value set invalue.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

tolerationSeconds defines in seconds how long a pod stays bound to a failing or unresponsive node.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

value is the value that triggers theeffect whenoperator is set toEqual.

SeeTaints and Tolerations: Concepts for details.

Default value:IfNotPresent

Determines when kubelet pulls the pod's Docker image. Possible values include:

• IfNotPresent: Do not pull a new image if it already exists.
• Always: Always pull the image, regardless of whether it exists already.

For more information, seeUpdating images.

Default value:v0.11.0

The version label for this service's Docker image.

Default value: None

The location of the Docker image for this service.

Useapigee-pull-push --list to see the current repository URL for this component.

Default value:500m

The CPU needed for normal operation of the aggregator in a Kubernetes container, in millicores.

Default value:512Mi

The memory needed for normal operation of the aggregator in a Kubernetes container, in mebibytes.

Default value:500m

The CPU limit for the aggregator resource in a Kubernetes container, in millicores.

Default value:3Gi

The memory limit for the aggregator resource in a Kubernetes container, in gibibytes.

Default value: None

Optional key/value map used to annotate pods. For more information, seeCustom annotations.

Default value:500m

The CPU needed for normal operation of the app in a Kubernetes container, in millicores.

Default value:512Mi

The memory needed for normal operation of the app in a Kubernetes container, in mebibytes.

Default value:500m

The CPU limit for the app resource in a Kubernetes container, in millicores.

Default value:1Gi

The memory limit for the app resource in a Kubernetes container, in gibibytes.

Default value:128m

The CPU needed for normal operation of the stackdriverExporter in a Kubernetes container, in millicores.

Default value:512Mi

The memory needed for normal operation of the stackdriverExporter in a Kubernetes container, in mebibytes.

Default value:500m

The CPU limit for the stackdriverExporter resource in a Kubernetes container, in millicores.

Default value:1Gi

The memory limit for the stackdriverExporter resource in a Kubernetes container, in gibibytes.

Default value:IfNotPresent

Determines when kubelet pulls the pod's Docker image. Possible values include:

• IfNotPresent: Do not pull a new image if it already exists.
• Always: Always pull the image, regardless of whether it exists already.

For more information, seeUse a private image repository with Apigee hybrid.

Default value:v0.93.0

The version label for this service's Docker image.

Default value: None

The location of the Docker image for this service.

Useapigee-pull-push --list to see the current repository URL for this component.

Default value:500m

The CPU needed for normal operation of the app in a Kubernetes container, in millicores.

Default value:512Mi

The memory needed for normal operation of the app in a Kubernetes container, in mebibytes.

Default value:500m

The CPU limit for the app resource in a Kubernetes container, in millicores.

Default value:1Gi

The memory limit for the app resource in a Kubernetes container, in gibibytes.

Default value:5

The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1.

Default value:30

The number of seconds after a container is started before a liveness probe is initiated.

Default value:10

Determines how often to perform a liveness probe, in seconds. The minimum value is 1.

Default value:1

The minimum consecutive successes needed for a liveness probe to be considered successful after a failure. The minimum value is 1.

Default value:5

The number of seconds after which a liveness probe times out. The minimum value is 1.

Default value:3

The number of times Kubernetes will verify that readiness probes have failed before marking the pod unready. The minimum value is 1.

Default value:30

The number of seconds after a container is started before a readiness probe is initiated.

Default value:10

Determines how often to perform a readiness probe, in seconds. The minimum value is 1.

Default value:1

The minimum consecutive successes needed for a readiness probe to be considered successful after a failure. The minimum value is 1.

Default value:5

The number of seconds after which a liveness probe times out. The minimum value is 1.

Default value:true

Metrics forProxyV2 andTargetV2 monitored resources are not emitted when set totrue. Use metrics forProxy andTarget monitored resources instead.

Default value:true

Enables Apigee metrics. Set totrue to enable metrics. Set tofalse to disable metrics.

Default value: None

Helm only: The email address of theapigee-metrics Google IAM service account (GSA) to associate with the corresponding Kubernetes service account when enabling Workload Identity on GKE clusters using Helm charts. Set this when you have setgcp.workloadIdentity.enabled totrue.

GSA email addresses typically have the format of:

GSA_NAME@PROJECT_ID.iam.gserviceaccount.com

For example:

apigee-metrics@my-hybrid-project.iam.gserviceaccount.com

gcloud iam service-accounts list --project ${PROJECT_ID} --filter "apigee"

SeeEnabling Workload Identity on GKE orEnabling Workload Identity Federation on AKS and EKS.

Default value: None

Required

Node selector label key used to target dedicated Kubernetes nodes formetrics runtime services.

See Configuring dedicated node pools.

Default value: None

Required

Node selector label value used to target dedicated Kubernetes nodes formetrics runtime services.

See Configuring dedicated node pools.

Default value:9090

The port to connect to the Prometheus metrics service.

Default value:IfNotPresent

Determines when kubelet pulls the pod's Docker image. Possible values include:

• IfNotPresent: Do not pull a new image if it already exists.
• Always: Always pull the image, regardless of whether it exists already.

For more information, seeUpdating images.

Default value:v2.45.0

The version label for this service's Docker image.

Default value: None

The location of the Docker image for this service.

Useapigee-pull-push --list to see the current repository URL for this component.

Default value:6

The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1.

Default value:5

Determines how often to perform a liveness probe, in seconds. The minimum value is 1.

Default value:3

The number of seconds after which a liveness probe times out. The minimum value is 1.

Default value:120

The number of times Kubernetes will verify that readiness probes have failed before marking the podunready. The minimum value is 1.

Default value:5

Determines how often to perform a readiness probe, in seconds. The minimum value is 1.

Default value:3

The number of seconds after which a liveness probe times out. The minimum value is 1.

Default value: None

Required

Path to the SSL cert for the Prometheus metrics collection process. Prometheus is a tool Apigee can use for collecting and processing metrics.

See:

• metrics
• For background information, thePrometheus website

Default value: None

Required

Path to the SSL Key for the Prometheus metrics collection process. Prometheus is a tool Apigee can use for collecting and processing metrics.

See:

• metrics
• For background information, thePrometheus website

Default value:500m

The CPU needed for normal operation of the proxy in a Kubernetes container, in millicores.

Default value:512Mi

The memory needed for normal operation of the proxy in a Kubernetes container, in mebibytes.

Default value:500m

The CPU limit for the proxy resource in a Kubernetes container, in millicores.

Default value:1Gi

The memory limit for the proxy resource in a Kubernetes container, in gibibytes.

Default value:128m

The CPU needed for normal operation of the stackdriverExporter in a Kubernetes container, in millicores.

Default value:512Mi

The memory needed for normal operation of the stackdriverExporter in a Kubernetes container, in mebibytes.

Default value:500m

The CPU limit for the stackdriverExporter resource in a Kubernetes container, in millicores.

Default value:1Gi

The memory limit for the stackdriverExporter resource in a Kubernetes container, in gibibytes.

Default value: None

URL for the metrics process sidecar proxy in the Kubernetes cluster.

Default value:9091

The port for connecting to the Cloud Monitoring metrics service.

Default value:IfNotPresent

Determines when Kubelet pulls this service's Docker image. Possible values include:

• IfNotPresent: Do not pull a new image if it already exists
• Always: Always pull the policy, even if it already exists

  For more information, see Updating images.

Default value:v0.9.0

The version label for this service's Docker image.

Default value: None

The location of the Docker image for this service.

Useapigee-pull-push --list to see the current repository URL for this component.

Default value: None

One of eitherserviceAccountPath orserviceAccountRef is required.

Path to Google Service Account key file withMonitoring Metric Writer role.

Default value: None

One of eitherserviceAccountPath orserviceAccountRef is required.

Deprecated: Starting in Hybrid version 1.8,metrics:stackdriverExporter has been replaced withmetrics:appStackdriverExporter andmetrics:proxyStackdriverExporter. See:

• metrics.appStackdriverExporter.resources.requests.cpu
• metrics.proxyStackdriverExporter.resources.requests.cpu

Deprecated: Starting in Hybrid version 1.8,metrics:stackdriverExporter has been replaced withmetrics:appStackdriverExporter andmetrics:proxyStackdriverExporter. See:

• metrics.appStackdriverExporter.resources.requests.memory
• metrics.proxyStackdriverExporter.resources.requests.memory

Deprecated: Starting in Hybrid version 1.8,metrics:stackdriverExporter has been replaced withmetrics:appStackdriverExporter andmetrics:proxyStackdriverExporter. See:

• metrics.appStackdriverExporter.resources.limits.cpu
• metrics.proxyStackdriverExporter.resources.limits.cpu

Deprecated: Starting in Hybrid version 1.8,metrics:stackdriverExporter has been replaced withmetrics:appStackdriverExporter andmetrics:proxyStackdriverExporter. See:

• metrics.appStackdriverExporter.resources.limits.memory
• metrics.proxyStackdriverExporter.resources.limits.memory

Default value:300

The time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

effect specifies the effect that matching a toleration with a taint will have. Values foreffect can be:

• NoExecute
• NoSchedule
• PreferNoSchedule

SeeTaints and Tolerations: Concepts for details.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

key identifies pods to which the toleration can be applied.

SeeTaints and Tolerations: Concepts for details.

Default value:"Equal"

Required to use theTaints and Tolerations feature of Kubernetes.

operator specifies the operation used to trigger theeffect. Values foroperator can be:

• Equal matches the value set invalue.
• Exists ignores the value set invalue.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

tolerationSeconds defines in seconds how long a pod stays bound to a failing or unresponsive node.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

value is the value that triggers theeffect whenoperator is set toEqual.

SeeTaints and Tolerations: Concepts for details.

Default value:IfNotPresent

Determines when kubelet pulls the pod's Docker image. Possible values include:

• IfNotPresent: Do not pull a new image if it already exists.
• Always: Always pull the image, regardless of whether it exists already.

For more information, seeUpdating images.

Default value:1.12.4

The version label for this service's Docker image.

Default value: None

The location of the Docker image for this service.

Useapigee-pull-push --list to see the current repository URL for this component.

Default value:2000m

The CPU limit for the resource in a Kubernetes container, in millicores.

Default value:4Gi

The memory limit for the resource in a Kubernetes container, in mebibytes.

Default value:500m

The CPU needed for normal operation of the resource in a Kubernetes container, in millicores.

Default value:512Mi

The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

effect specifies the effect that matching a toleration with a taint will have. Values foreffect can be:

• NoExecute
• NoSchedule
• PreferNoSchedule

SeeTaints and Tolerations: Concepts for details.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

key identifies pods to which the toleration can be applied.

SeeTaints and Tolerations: Concepts for details.

Default value:"Equal"

Required to use theTaints and Tolerations feature of Kubernetes.

operator specifies the operation used to trigger theeffect. Values foroperator can be:

• Equal matches the value set invalue.
• Exists ignores the value set invalue.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

tolerationSeconds defines in seconds how long a pod stays bound to a failing or unresponsive node.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

value is the value that triggers theeffect whenoperator is set toEqual.

SeeTaints and Tolerations: Concepts for details.

Default value:cloud.google.com/gke-nodepool

ApigeeData is the node for the Cassandra database. Node selector label key for targeting Kubernetes nodes for working with Apigee services data.

SeeConfigure dedicated node pools.

Default value:apigee-data

apigee-data is the node for the Cassandra database. Node selector label value for targeting Kubernetes nodes for working with Apigee services data.

SeeConfigure dedicated node pools.

Default value:cloud.google.com/gke-nodepool

Apigee Runtime is the node for the runtime environment for the project. Node selector label key for targeting Kubernetes nodes for Apigee runtime services.

SeeConfigure dedicated node pools.

Default value:apigee-runtime

apigee-runtime is the node for the runtime environment for the project. Node selector label value for targeting Kubernetes nodes for Apigee runtime services.

SeeConfigure dedicated node pools.

Default value: true

TherequiredForScheduling property defaults totrue. Whentrue, it means that if Kubernetes cannot find nodes with the label key/value that is configured then the underlying Pods will not get scheduled on VM worker nodes.

For production,nodeSelector.requiredForScheduling should be set to true.

SeeConfigure dedicated node pools.

Default value:iloveapis123

Required

Password for the Redis administrator. The admin user is used for any administrative activities performed on the Redis cluster.

Default value: None

The name of the file stored in a Kubernetes secret that contains the password for the Redis administrator. The secret file should contain the key:

data:redis.auth.password:encoded_value

See also:

• redis.auth.password
• Storing data in a Kubernetes secret
• Secrets in the Kubernetes documentation
• Creating a Secret Using kubectl in the Kubernetes documentation

Default value:IfNotPresent

Determines when kubelet pulls the pod's Docker image. Possible values include:

• IfNotPresent: Do not pull a new image if it already exists.
• Always: Always pull the image, regardless of whether it exists already.

For more information, seeUpdating images.

Default value:v1.27.0

The version label for this service's Docker image.

Default value: None

The location of the Docker image for this service.

Useapigee-pull-push --list to see the current repository URL for this component.

Default value:IfNotPresent

Determines when kubelet pulls the pod's Docker image. Possible values include:

• IfNotPresent: Do not pull a new image if it already exists.
• Always: Always pull the image, regardless of whether it exists already.

For more information, seeUpdating images.

Default value:1.12.4

The version label for this service's Docker image.

Default value: None

The location of the Docker image for this service.

Useapigee-pull-push --list to see the current repository URL for this component.

Default value:2

Redis is a replicated storage. This property specifies the number of Redis nodes employed as aStatefulSet.

Default value:500m

The CPU needed for normal operation of the resource in a Kubernetes container, in millicores.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

effect specifies the effect that matching a toleration with a taint will have. Values foreffect can be:

• NoExecute
• NoSchedule
• PreferNoSchedule

SeeTaints and Tolerations: Concepts for details.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

key identifies pods to which the toleration can be applied.

SeeTaints and Tolerations: Concepts for details.

Default value:"Equal"

Required to use theTaints and Tolerations feature of Kubernetes.

operator specifies the operation used to trigger theeffect. Values foroperator can be:

• Equal matches the value set invalue.
• Exists ignores the value set invalue.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

tolerationSeconds defines in seconds how long a pod stays bound to a failing or unresponsive node.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

value is the value that triggers theeffect whenoperator is set toEqual.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Optional key/value map used to annotate pods. For more information, seeCustom annotations.

Default value: None

Allows you to supply additional env variables to the runtime component in a key-value pair:

runtime:  envVars:KEY_1:VALUE_1    ... ...KEY_N:VALUE_N

for example:

runtime:  envVars:    RUNTIME_ENV_VAR1: "value of runtime env-var 1"    RUNTIME_ENV_VAR2: "value of runtime env-var 2"

Default value: 60

The window of time for which the policy should hold true when scaling down a percentage of runtime instances.

Default value: 20

The amount of change which is permitted by the policy when scaling down a percentage of runtime instances.

Default value: 60

The window of time for which the policy should hold true when scaling down a number of runtime instances.

Default value: 20

The amount of change which is permitted by the policy when scaling down a number of runtime instances.

Default value: Min

The decision that autoscaler makes between multiple autoscaling policies. Set the value toMin allows the smallest change in scaling down runtime instances. Set the value toMax allows the largest change in scaling down runtime instances.

Default value: 120

The number of seconds for which past recommendations should be considered while scaling down.

Default value: 60

The window of time for which the policy should hold true when scaling up a percentage of runtime instances.

Default value: 20

The window of time for which the policy should hold true when scaling up a percentage of runtime instances.

Default value: 60

The window of time for which the policy should hold true when scaling up a number of runtime instances.

Default value: 4

The amount of change which is permitted by the policy when scaling up a number of runtime instances.

Default value: Max

The decision that autoscaler makes between multiple autoscaling policies. Set the value toMin allows the smallest change in scaling up runtime instances. Set the value toMaxallows the largest change in scaling up runtime instances.

Default value: 30

The number of seconds for which past recommendations should be considered while scaling up runtime instances.

Default value: 400M

The desired average wait time (in ms) of processing queue in runtime instances for proxy requests at the http layer.

Default value: 400M

The desired average wait time (in ms) of processing queue in runtime instances for proxy requests to process policies.

Default value: 75

The desired CPU utilization percentage across all runtime instances.

Default value:IfNotPresent

Determines when kubelet pulls the pod's Docker image. Possible values include:

• IfNotPresent: Do not pull a new image if it already exists.
• Always: Always pull the image, regardless of whether it exists already.

For more information, seeUpdating images.

Default value:1.12.4

The version label for this service's Docker image.

Default value: None

The location of the Docker image for this service.

Useapigee-pull-push --list to see the current repository URL for this component.

Default value:2

The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1.

Default value:60

The number of seconds after a container is started before a liveness probe is initiated.

Default value:5

Determines how often to perform a liveness probe, in seconds. The minimum value is 1.

Default value:1

The number of seconds after which a liveness probe times out. The minimum value is 1.

Default value: None

Optional Node selector label key for targeting Kubernetes nodes forruntime services.

SeenodeSelector property.

Default value: None

Node selector label value for targeting Kubernetes nodes forruntime services.

See Configuring dedicated node pools.

Default value:2

The number of times Kubernetes will verify that readiness probes have failed before marking the podunready. The minimum value is 1.

Default value:60

The number of seconds after a container is started before a readiness probe is initiated.

Default value:5

Determines how often to perform a readiness probe, in seconds. The minimum value is 1.

Default value:1

The minimum consecutive successes needed for a readiness probe to be considered successful after a failure. The minimum value is 1.

Default value:1

The number of seconds after which a liveness probe times out. The minimum value is 1.

Default value:4

Maximum number of replicas available for autoscaling.

Default value:1

Minimum number of replicas available for autoscaling.

Default value:4000m

The CPU limit for the resource in a Kubernetes container, in millicores.

Default value:6Gi

The memory limit for the resource in a Kubernetes container, in mebibytes.

Default value:500m

The CPU needed for normal operation of the resource in a Kubernetes container, in millicores.

Default value:512Mi (see note below)

The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes (Mi) or Gibibytes (Gi).

Default value:ClusterIP

The type of service. You can set this to a service other than ClusterIP; for example,LoadBalancer.

Default value:75

Target CPU utilization for the runtime process on the pod. The value of this field enables the runtime to auto-scale when CPU utilization reaches this value, up toreplicaCountMax.

Default value:180

The time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

effect specifies the effect that matching a toleration with a taint will have. Values foreffect can be:

• NoExecute
• NoSchedule
• PreferNoSchedule

SeeTaints and Tolerations: Concepts for details.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

key identifies pods to which the toleration can be applied.

SeeTaints and Tolerations: Concepts for details.

Default value:"Equal"

Required to use theTaints and Tolerations feature of Kubernetes.

operator specifies the operation used to trigger theeffect. Values foroperator can be:

• Equal matches the value set invalue.
• Exists ignores the value set invalue.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

tolerationSeconds defines in seconds how long a pod stays bound to a failing or unresponsive node.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

value is the value that triggers theeffect whenoperator is set toEqual.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Optional key/value map used to annotate pods. For more information, seeCustom annotations.

Default value:IfNotPresent

Determines when kubelet pulls the pod's Docker image. Possible values include:

• IfNotPresent: Do not pull a new image if it already exists.
• Always: Always pull the image, regardless of whether it exists already.

For more information, seeUpdating images.

Default value:1.12.4

The version label for this service's Docker image.

Default value: None

The location of the Docker image for this service.

Useapigee-pull-push --list to see the current repository URL for this component.

Default value:2

The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1.

Default value:0

The number of seconds after a container is started before a liveness probe is initiated.

Default value:5

Determines how often to perform a liveness probe, in seconds. The minimum value is 1.

Default value:1

The number of seconds after which a liveness probe times out. The minimum value is 1.

Default value: None

Required

Optional node selector label key for targeting Kubernetes nodes forsynchronizer runtime services.

SeenodeSelector.

Default value: None

Optional node selector label value used for targeting Kubernetes nodes forsynchronizer runtime services.

SeenodeSelector.

Default value:60

The length of time that Synchronizer waits between polling operations. Synchronizer polls Apigee control plane services to detect and pull new runtime contracts.

Default value:2

The number of times Kubernetes will verify that readiness probes have failed before marking the podunready. The minimum value is 1.

Default value:0

The number of seconds after a container is started before a readiness probe is initiated.

Default value:5

Determines how often to perform a readiness probe, in seconds. The minimum value is 1.

Default value:1

The minimum consecutive successes needed for a readiness probe to be considered successful after a failure. The minimum value is 1.

Default value:1

The number of seconds after which a liveness probe times out. The minimum value is 1.

Deprecated: Starting in Hybrid version 1.2, manage the Synchronizer replica count with:synchronizer.replicaCountMax andsynchronizer.replicaCountMin

Default value:4

Maximum number of replicas for autoscaling.

Default value:1

Minimum number of replicas for autoscaling.

Default value:2000m

The CPU limit for the resource in a Kubernetes container, in millicores.

Default value:5Gi

The memory limit for the resource in a Kubernetes container, in mebibytes.

Default value:100m

The CPU needed for normal operation of the resource in a Kubernetes container, in millicores.

Default value:1Gi

The memory needed for normal operation of the resource in a Kubernetes container, in gigabytes.

Default value: None

One of eitherserviceAccountPath orserviceAccountRef is required.

Path to Google Service Account key file withApigee Synchronizer Manager role.

Default value: None

One of eitherserviceAccountPath orserviceAccountRef is required.

Default value: None

The name of aKubernetes secret. You must create the secret using a Google Service Account key with theApigee Synchronizer Manager role as its input.

Default value:75

Target CPU utilization for the Synchronizer process on the pod. The value of this field enables Synchronizer to auto-scale when CPU utilization reaches this value, up toreplicaCountMax.

Default value:30

The time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

effect specifies the effect that matching a toleration with a taint will have. Values foreffect can be:

• NoExecute
• NoSchedule
• PreferNoSchedule

SeeTaints and Tolerations: Concepts for details.

Default value: None

Required to use theTaints and Tolerations feature of Kubernetes.

key identifies pods to which the toleration can be applied.

SeeTaints and Tolerations: Concepts for details.

Default value:"Equal"

Required to use theTaints and Tolerations feature of Kubernetes.

operator specifies the operation used to trigger theeffect. Values foroperator can be:

• Equal matches the value set invalue.
• Exists ignores the value set invalue.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

tolerationSeconds defines in seconds how long a pod stays bound to a failing or unresponsive node.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Used by theTaints and Tolerations feature of Kubernetes.

value is the value that triggers theeffect whenoperator is set toEqual.

SeeTaints and Tolerations: Concepts for details.

Default value: None

Optional key/value map used to annotate pods. For more information, seeCustom annotations.

Default value:IfNotPresent

Determines when kubelet pulls the pod's Docker image. Possible values include:

• IfNotPresent: Do not pull a new image if it already exists.
• Always: Always pull the image, regardless of whether it exists already.

For more information, seeUpdating images.

Default value:1.9.12-2

The version label for this service's Docker image.

Default value:gcr.io/apigee-release/hybrid/apigee-stackdriver-logging-agent

The location of the Docker image for this service.

Default value:1000m

The memory limit for the resource in a Kubernetes container, in mebibytes.

Default value:500Mi

The memory limit for the resource in a Kubernetes container, in mebibytes.

Default value:500m

The CPU needed for normal operation of the resource in a Kubernetes container, in millicores.

Default value:250Mi

The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes.

Default value: None

Helm only: The email address of theapigee-udca Google IAM service account (GSA) to associate with the corresponding Kubernetes service account when enabling Workload Identity on GKE clusters using Helm charts. Set this when you have setgcp.workloadIdentity.enabled totrue.

GSA email addresses typically have the format of:

GSA_NAME@PROJECT_ID.iam.gserviceaccount.com

For example:

apigee-udca@my-hybrid-project.iam.gserviceaccount.com

gcloud iam service-accounts list --project ${PROJECT_ID} --filter "apigee"

SeeEnabling Workload Identity on GKE orEnabling Workload Identity Federation on AKS and EKS.