Configuration property reference
This section lists all of the configuration propertiesthat you can use to customize the runtime plane of your Apigee hybrid deployment.
Note: For instructions on how to add custom annotations, which are key/value maps used to attach metadata to Apigee hybrid Kubernetes pods, seeCustom annotations.About configuration properties
You can override many configuration properties, if needed, by adding them toHYBRID_ROOT_DIR/overrides.yaml.
For example, to change the replica count minimum and maximum for the MART service, you could add this stanza tooverrides.yaml:
mart:replicaCountMin:3replicaCountMax:6
You can also find these config properties and their default settings inHYBRID_ROOT_INSTALL/1.0.0/values.yaml
For more information, seeManage runtime plane components.
Additionally, if you are configuring a deployment outside Google Cloud see Step 7: Create the overrides for information on setting these properties.
Filter this page
To filter the properties displayed on this page, selectBasic (most common properties) orAdvanced (properties that rarely need changing):
DisplayTop-level properties
The following table describes the top-level properties in theoverrides.yaml file. These are properties that do not belong to another object, and apply at the org or environment level:
| Property | Type | Description |
|---|---|---|
axHashSalt | Advanced | Introduced in version: 1.3.0 Default value: Chart: Optional The name of aKubernetes secret that contains a salt used when computing hashes toobfuscate user data before it is sent to Apigee analytics. If you do not specify a salt value, Apigee uses SHA512 to hash the original value before sending data from the runtime plane to the control plane. |
contractProvider | Advanced | Introduced in version: 1.0.0 Default value: Chart: Defines the API path for all APIs in your installation. Required if your hybrid installation is usingData residency in the following format: contractProvider: https://CONTROL_PLANE_LOCATION-apigee.googleapis.com WhereCONTROL_PLANE_LOCATION is the location where control plane data like proxy bundles are stored. For a list seeAvailable Apigee API control plane regions. For example: contractProvider: https://us-apigee.googleapis.com |
customAutoscaling.enabled | Basic | Introduced in version: 1.14.0 Default value: Chart: Enables Apigee'smetric-based autoscaling when set to Apply changes to |
enhanceProxyLimits | Advanced | Introduced in version: 1.14.0 Default value: Chart: Required
See: Setting false once set totrue.Apply changes to |
gcpProjectID | Advanced | Deprecated: For v1.2.0 and later, usegcp.projectID instead.Introduced in version: 1.0.0 Default value:none Chart: Required ID of your Google Cloud project. Works with |
gcpRegion | Advanced | Deprecated: For v1.2.0 and later, usegcp.region instead.Introduced in version: 1.0.0 Default value: Chart: Required The closet Google Cloud region or zone of your Kubernetes cluster. Works with |
hub | Advanced | Introduced in version: 1.11.0 Default value: None Chart: The URL of a private image container repository used to pull images for all apigee components from a private repo.
The image path for each individual component will be the value of For example, if the value of hub:private-docker-host.example.com as: containers:- name: apigee-udca image: private-docker-host.example.com/apigee-udca:1.16.0 imagePullPolicy: IfNotPresent ## an example of internal component vs 3rd partycontainers: - name: apigee-udca image: private-docker-host.example.com/apigee-udca:1.16.0 imagePullPolicy: IfNotPresent containers: - name: apigee-ingressgateway image: private-docker-host.example.com/apigee-asm-ingress:1.22.6-asm.2-distroless imagePullPolicy: IfNotPresent The other components will follow a similar pattern. Use SeeUse a private image repository with Apigee hybrid. You can override image URL for components individualy with the following properties:
|
imagePullSecrets[].name | Advanced | Introduced in version: 1.0.0 Default value: None Chart: Kubernetes secret name configured as docker-registry type; used to pull images from private repo. |
instanceID | Basic | Introduced in version: 1.3.0 Default value: None Chart: Required A unique identifier for this installation. A unique string to identify this instance. This can be any combination of letters and numbers up to 63 characters in length. You can create multiple organizations in the same cluster, but theinstanceID must be the same for all orgs in the same Kubernetes cluster. For multi-region installations, each region requires its own cluster (individual clusters do not span regions). |
kmsEncryptionKey | Advanced | Introduced in version: 1.0.0 Default value: Chart: Optional. Use only one ofkmsEncryptionKey orkmsEncryptionPath orkmsEncryptionSecret. Local file system path for the ApigeeKMS data's encryption key. |
kmsEncryptionPath | Advanced | Introduced in version: 1.2.0 Default value: None Chart: Optional. Use only one ofkmsEncryptionKey orkmsEncryptionPath orkmsEncryptionSecret. The path to a file containing a base64-encoded encryption key. SeeData encryption. |
kmsEncryptionSecret.key | Advanced | Introduced in version: 1.2.0 Default value: None Chart: Optional. Use only one ofkmsEncryptionKey orkmsEncryptionPath orkmsEncryptionSecret. The key of aKubernetes secret containing a base64-encoded encryption key. SeeData encryption. |
kmsEncryptionSecret.name | Advanced | Introduced in version: 1.2.0 Default value: None Chart: Optional. Use only one ofkmsEncryptionKey orkmsEncryptionPath orkmsEncryptionSecret. The name of aKubernetes secret containing a base64-encoded encryption key. SeeData encryption. |
kvmEncryptionKey | Advanced | Introduced in version: 1.0.0 Default value: Chart: Optional. Use only one ofkvmEncryptionKey orkvmEncryptionPath orkvmEncryptionSecret. Local file system path for the ApigeeKVM data's encryption key. |
kvmEncryptionPath | Advanced | Introduced in version: 1.2.0 Default value: None Chart: Optional. Use only one ofkvmEncryptionKey orkvmEncryptionPath orkvmEncryptionSecret. The path to a file containing a base64-encoded encryption key. SeeData encryption. |
kvmEncryptionSecret.key | Advanced | Introduced in version: 1.2.0 Default value: None Chart: Optional. Use only one ofkvmEncryptionKey orkvmEncryptionPath orkvmEncryptionSecret. The key of aKubernetes secret containing a base64-encoded encryption key. SeeData encryption. |
kvmEncryptionSecret.name | Advanced | Introduced in version: 1.2.0 Default value: None Chart: Optional. Use only one ofkvmEncryptionKey orkvmEncryptionPath orkvmEncryptionSecret. The name of aKubernetes secret containing a base64-encoded encryption key. SeeData encryption. |
multiOrgCluster | Advanced | Introduced in version: 1.10.0 Default value: Chart: For multi-org clusters, this property enables the organization's metrics to be exported to the project listed in the |
namespace | Basic | Introduced in version: 1.0.0 Default value: Chart: The namespace of your Kubernetes cluster where the Apigee components will be installed. |
org | Basic | Introduced in version: 1.0.0 Default value: None Chart: Required The hybrid-enabled organization that was provisioned for you by Apigee during the hybrid installation. An organization is the top-level container in Apigee. It contains all your API proxies and related resources. If the value is empty, you must update it with your org name once you have created it. |
revision | Advanced | Introduced in version: 1.0.0 Default value: Chart: Apigee hybrid supports rolling Kubernetes updates, which allow deployment updates to take place with zero downtime by incrementally updating Pod instances with new ones. When updating certain YAML overrides that result in underlying Kubernetes revision can accept only lowercase alpha characters, numbers, and punctuation. When the Changes to properties of the following objects require an update to For more information, seeRolling updates. |
serviceAccountSecretProviderClass | Advanced | Introduced in version: 1.12.0 Default value: None Chart: The name of the organization-specific secret provider class ( |
ao
Apigee Operators (AO) creates and updates low level Kubernetes and Istio resources that are required to deploy and maintain a component. For example, the controller carries out the release of message processors.
Note:In version 1.2.0, Apigee Operators replaces Apigee Deployment Admissionhook (ADAH) andApigee Deployment Controller (ADC).The following table describes the properties of the apigee-operatorsao object:
| Property | Type | Description |
|---|---|---|
ao.args.disableIstioConfigInAPIServer | Advanced | Introduced in version: 1.8.0 Default value: Chart: Stops Apigee from supplying configuration to customer-installed Cloud Service Mesh.
|
ao.args.disableManagedClusterRoles | Advanced | Introduced in version: 1.10.0 Default value: Chart: When |
ao.image.pullPolicy | Advanced | Introduced in version: 1.2.0 Default value: Chart: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, seeUpdating images. |
ao.image.tag | Advanced | Introduced in version: 1.2.0 Default value: Chart: The version label for this service's Docker image. |
ao.image.url | Advanced | Introduced in version: 1.2.0 Default value: None Chart: The location of the Docker image for this service. Use hub to set a private repository URL for all components instead of configuring them individually. |
ao.resources.limits.cpu | Advanced | Introduced in version: 1.2.0 Default value: Chart: The CPU limit for the resource in a Kubernetes container, in millicores. |
ao.resources.limits.memory | Advanced | Introduced in version: 1.2.0 Default value: Chart: The memory limit for the resource in a Kubernetes container, in mebibytes. |
ao.resources.requests.cpu | Advanced | Introduced in version: 1.2.0 Default value: Chart: The CPU needed for normal operation of the resource in a Kubernetes container, in millicores. |
ao.resources.requests.memory | Advanced | Introduced in version: 1.2.0 Default value: Chart: The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes. |
ao.tolerations.effect | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
ao.tolerations.key | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
ao.tolerations.operator | Advanced | Introduced in version: 1.10.1 Default value: Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
ao.tolerations.tolerationSeconds | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
ao.tolerations.value | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
apigeeIngressGateway
Configures the Apigee ingress gateway for Apigee Hybrid. UseapigeeIngressGateway properties to apply common configuration to all instances of the Apigee ingress gateway.
SeeingressGateways to configure individual instances uniquely.
Apply changes toapigeeIngressGateway properties with theapigee-org chart.
The following table describes the properties of theapigeeIngressGateway object:
| Property | Type | Description |
|---|---|---|
apigeeIngressGateway.image.pullPolicy | Advanced | Introduced in version: 1.11.0 Default value: Chart: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, seeUpdating images. |
apigeeIngressGateway.image.tag | Advanced | Introduced in version: 1.11.0 Default value: Chart: The version label for this service's Docker image. |
apigeeIngressGateway.image.url | Advanced | Introduced in version: 1.11.0 Default value: None Chart: The location of the Docker image for this service. Use hub to set a private repository URL for all components instead of configuring them individually. |
apigeeIngressGateway.nodeSelector.key | Advanced | Introduced in version: 1.11.0 Default value: None Chart: Required Node selector label key used to target dedicated Kubernetes nodes for ingress gateway services. |
apigeeIngressGateway.nodeSelector.value | Advanced | Introduced in version: 1.11.0 Default value: None Chart: Optional node selector label value used to target dedicated Kubernetes nodes for ingress gateway services and override the SeenodeSelector. |
apigeeIngressGateway.replicaCountMax | Basic | Introduced in version: 1.11.0 Default value: Chart: The maximum number of pods that hybrid can automatically add for the ingress gateway available for autoscaling. |
apigeeIngressGateway.replicaCountMin | Basic | Introduced in version: 1.11.0 Default value: Chart: The minimum number of pods for the ingress gateway available for autoscaling. |
apigeeIngressGateway.targetCPUUtilizationPercentage | Advanced | Introduced in version: 1.10.5, 1.11.2, 1.12.1 Default value: Chart: The threshold of CPU usage for scaling the number of pods in the ReplicaSet, as a percentage of total available CPU resources. When CPU usage goes above this value, then hybrid will gradually increase the number of pods in the ReplicaSet, up to For more information on scaling in Kubernetes, seeHorizontal Pod Autoscaling in the Kubernetes documentation. |
apigeeIngressGateway.tolerations.effect | Advanced | Introduced in version: 1.11.0 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
apigeeIngressGateway.tolerations.key | Advanced | Introduced in version: 1.11.0 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
apigeeIngressGateway.tolerations.operator | Advanced | Introduced in version: 1.11.0 Default value: Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
apigeeIngressGateway.tolerations.tolerationSeconds | Advanced | Introduced in version: 1.11.0 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
apigeeIngressGateway.tolerations.value | Advanced | Introduced in version: 1.11.0 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
cassandra
Defines the hybrid service that manages the runtime data repository. This repository storesapplication configurations, distributed quota counters, API keys, and OAuth tokens for applicationsrunning on the gateway.
For more information, seeStorageClass configuration.
The following table describes the properties of thecassandra object:
| Property | Type | Description |
|---|---|---|
cassandra.annotations | Advanced | Introduced in version: 1.5.0 Default value: None Chart: Optional key/value map used to annotate pods. For more information, seeCustom annotations. |
cassandra.auth.admin.password | Basic | Introduced in version: 1.0.0 Default value: Chart: Required Password for the Cassandra administrator. The admin user is used for any administrative activities performed on the Cassandra cluster, such as backup and restore. |
cassandra.auth.ddl.password | Basic | Introduced in version: 1.0.0 Default value: Chart: Required Password for the Cassandra Data Definition Language (DDL) user. Used by MART for any of the data definition tasks like keyspace creation, update, and deletion. |
cassandra.auth.default.password | Basic | Introduced in version: 1.0.0 Default value: Chart: Required The password for the default Cassandra user created when Authentication is enabled. This password must be reset when configuring Cassandra authentication. SeeConfiguring TLS for Cassandra. |
cassandra.auth.dml.password | Basic | Introduced in version: 1.0.0 Default value: Chart: Required Password for the Cassandra Data Manipulation Language (DML) user. The DML user is used by the client communication to read and write data to Cassandra. |
cassandra.auth.image.pullPolicy | Advanced | Introduced in version: 1.0.0 Default value: Chart: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, seeUpdating images. |
cassandra.auth.image.tag | Advanced | Introduced in version: 1.0.0 Default value: Chart: The version label for this service's Docker image. |
cassandra.auth.image.url | Advanced | Introduced in version: 1.0.0 Default value: None Chart: The location of the Docker image for this service. Use hub to set a private repository URL for all components instead of configuring them individually. |
cassandra.auth.jmx.password | Basic | Introduced in version: 1.4.0 Default value: Chart: Required Password for the Cassandra JMX operations user. Used to authenticate and communicate with the Cassandra JMX interface. |
cassandra.auth.jmx.username | Basic | Introduced in version: 1.4.0 Default value: Chart: Required Username for the Cassandra JMX operations user. Used to authenticate and communicate with the Cassandra JMX interface. |
cassandra.auth.jolokia.password | Basic | Introduced in version: 1.4.0 Default value: Chart: Required Password for the Cassandra Jolokia JMX operations user. Used to authenticate and communicate with the Cassandra JMX API. |
cassandra.auth.jolokia.username | Basic | Introduced in version: 1.4.0 Default value: Chart: Required Username for the Cassandra Jolokia JMX operations user. Used to authenticate and communicate with the Cassandra JMX API. |
cassandra.auth.secret | Basic | Introduced in version: 1.3.3 Default value: None Chart: The name of the file stored in a Kubernetes secret that contains the Cassandra users and passwords. You can create the secret using following the following instructions:Create the Secret. See also:
|
cassandra.auth.secretProviderClass | Advanced | Introduced in version: 1.10.3 Default value: None Chart: The Cassandra secret storage policy. When set, it must match the SecretProviderClass which references the external secret provider, like Hashicorp Vault. When unset, Apigee hybrid uses either the usernames and passwords stored in:
or the Kubernetes secret stored in: SeeStoring Cassandra secrets in Hashicorp Vault for instructions to create the policy. |
cassandra.backup.cloudProvider | Advanced | Introduced in version: 1.0.0 Default value: Chart: The name of a backup provider. Supported values:
|
cassandra.backup.dbStorageBucket | Advanced | Introduced in version: 1.0.0 Default value: None Chart: Required if backup is enabled and The name of an existing Google Cloud Storage bucket that will be used to store backup archives. See Creating buckets if you need to create one. Note: Starting in Hybrid version 1.13, the bucket name doesn't need to be prefixed withgs://. Support for this prefix has been deprecated and will be removed in future releases. |
cassandra.backup.enabled | Advanced | Introduced in version: 1.0.0 Default value: Chart: Data backup is not enabled by default. To enable, set to |
cassandra.backup.gsa | Advanced | Introduced in version: 1.10.0 Default value: None Chart: Helm only: The email address of the GSA email addresses typically have the format of: GSA_NAME@PROJECT_ID.iam.gserviceaccount.com For example: apigee-cassandra@my-hybrid-project.iam.gserviceaccount.com gcloud iam service-accounts list --project ${PROJECT_ID} --filter "apigee" |
cassandra.backup.image.pullPolicy | Advanced | Introduced in version: 1.0.0 Default value: Chart: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, seeUpdating images. |
cassandra.backup.image.tag | Advanced | Introduced in version: 1.0.0 Default value: Chart: The version label for this service's Docker image. |
cassandra.backup.image.url | Advanced | Introduced in version: 1.0.0 Default value: None Chart: The location of the Docker image for this service. Use hub to set a private repository URL for all components instead of configuring them individually. |
cassandra.backup.keyfile | Advanced | Introduced in version: 1.3.0 Default value: None Chart: Required if backup is enabled and The path on your local file system to the SSH private key file. | cassandra.backup.schedule | Advanced | Introduced in version: 1.0.0 Default value: Chart: The schedule for the backup cron job. |
cassandra.backup.server | Advanced | Introduced in version: 1.3.0 Default value: None Chart: Required if backup is enabled and The IP address of your remote SSH backup server. |
cassandra.backup.serviceAccountPath | Advanced | Introduced in version: 1.0.0 Default value: None Chart: Path to aGoogle Service Account key file that has theStorage Object Admin ( If backup is enabled and |
cassandra.backup.serviceAccountRef | Advanced | Introduced in version: 1.2.0 Default value: None Chart: The name of an existing Kubernetes secret that stores the content of aGoogle Service Account key file that has theStorage Object Admin ( If backup is enabled and |
cassandra.backup.storageDirectory | Advanced | Introduced in version: 1.3.0 Default value: None Chart: Required if backup is enabled and Can either be an absolute or relative path to the The name of the backup directory on your backup SSH server. |
cassandra.clusterName | Basic | Introduced in version: 1.0.0 Default value: Chart: Specifies the name of the Cassandra cluster. Note: For multi-region installs the value ofclusterName needs to match for all regions. |
cassandra.datacenter | Basic | Introduced in version: 1.0.0 Default value: Chart: Specifies the datacenter of the Cassandra node. |
cassandra.dnsPolicy | Basic | Introduced in version: 1.1.1 Default value: None Chart: |
cassandra.externalSeedHost | Basic | Introduced in version: 1.0.0 Default value: None Chart: Hostname or IP of a Cassandra cluster node. If not set, the Kubernetes local service is used. |
cassandra.heapNewSize | Basic | Introduced in version: 1.0.0 Default value: Chart: The amount ofJVM system memory allocated to newer objects, in megabytes. |
cassandra.hostNetwork | Basic | Introduced in version: 1.1.1 Default value: Chart: Enables the Kubernetes Set Set When |
cassandra.image.pullPolicy | Advanced | Introduced in version: 1.0.0 Default value: Chart: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, seeUpdating images. |
cassandra.image.tag | Advanced | Introduced in version: 1.0.0 Default value: Chart: The version label for this service's Docker image. |
cassandra.image.url | Advanced | Introduced in version: 1.0.0 Default value: None Chart: The location of the Docker image for this service. Use hub to set a private repository URL for all components instead of configuring them individually. |
cassandra.maxHeapSize | Advanced | Introduced in version: 1.0.0 Default value: Chart: The upper limit ofJVM system memory available for Cassandra operations, in megabytes. |
cassandra.multiRegionSeedHost | Basic | Introduced in version: 1.0.0 Default value: None Chart: IP address of an existing Cassandra cluster used to expand the existing cluster to a new region. SeeConfigure the multi-region seed host. |
cassandra.nodeSelector.key | Advanced | Introduced in version: 1.0.0 Default value: None Chart: Required Node selector label key used to target dedicated Kubernetes nodes for |
cassandra.nodeSelector.value | Advanced | Introduced in version: 1.0.0 Default value: None Chart: Optional node selector label value used to target dedicated Kubernetes nodes for SeenodeSelector. |
cassandra.port | Advanced | Introduced in version: 1.0.0 Default value: Chart: Port number used to connect to cassandra. |
cassandra.rack | Basic | Introduced in version: 1.0.0 Default value: Chart: Specifies the rack of the Cassandra node. |
cassandra.readinessProbe.failureThreshold | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of times Kubernetes will verify that readiness probes have failed before marking the podunready. The minimum value is 1. |
cassandra.readinessProbe.initialDelaySeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of seconds after a container is started before a readiness probe is initiated. |
cassandra.readinessProbe.periodSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: Determines how often to perform a readiness probe, in seconds. The minimum value is 1. |
cassandra.readinessProbe.successThreshold | Advanced | Introduced in version: 1.0.0 Default value: Chart: The minimum consecutive successes needed for a readiness probe to be considered successful after a failure. The minimum value is 1. |
cassandra.readinessProbe.timeoutSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of seconds after which a liveness probe times out. The minimum value is 1. |
cassandra.replicaCount | Basic | Introduced in version: 1.0.0 Default value: Chart: Cassandra is a replicated database. This property specifies the number of Cassandra nodes employed as aStatefulSet. Note: The default value of1 is only acceptable for demo or test installations. For production installations, the value ofreplicaCount must be a multiple of3. To determine your desiredreplicaCount value, consider the following:
|
cassandra.resources.requests.cpu | Advanced | Introduced in version: 1.0.0 Default value: Chart: The CPU needed for normal operation of the resource in a Kubernetes container, in millicores. |
cassandra.resources.requests.memory | Advanced | Introduced in version: 1.0.0 Default value: Chart: The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes. |
cassandra.restore.cloudProvider | Advanced | Introduced in version: 1.0.0 Default value: Chart: The name of a restore provider. Supported values:
|
cassandra.restore.dbStorageBucket | Advanced | Introduced in version: 1.0.0 Default value: None Chart: Required if restore is enabled and The name of a Google Cloud Storage bucket that stores backup archives to be used for data restoration. Note: Starting in Hybrid version 1.13, the bucket name doesn't need to be prefixed withgs://. Support for this prefix has been deprecated and will be removed in future releases. |
cassandra.restore.enabled | Advanced | Introduced in version: 1.0.0 Default value: Chart: Data restoration is not enabled by default. To enable, set to |
cassandra.restore.gsa | Advanced | Introduced in version: 1.10.0 Default value: None Chart: Helm only: The email address of the GSA email addresses typically have the format of: GSA_NAME@PROJECT_ID.iam.gserviceaccount.com For example: apigee-cassandra@my-hybrid-project.iam.gserviceaccount.com gcloud iam service-accounts list --project ${PROJECT_ID} --filter "apigee" |
cassandra.restore.image.pullPolicy | Advanced | Introduced in version: 1.0.0 Default value: Chart: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, seeUpdating images. |
cassandra.restore.image.tag | Advanced | Introduced in version: 1.0.0 Default value: Chart: The version label for this service's Docker image. |
cassandra.restore.image.url | Advanced | Introduced in version: 1.0.0 Default value: None Chart: The location of the Docker image for this service. Use hub to set a private repository URL for all components instead of configuring them individually. |
cassandra.restore.serviceAccountPath | Advanced | Introduced in version: 1.0.0 Default value: None Chart: Path to aGoogle Service Account key file that has theStorage Object Admin ( If restore is enabled and |
cassandra.restore.serviceAccountRef | Advanced | Introduced in version: 1.2.0 Default value: None Chart: The name of an existing Kubernetes secret that stores the content of aGoogle Service Account key file that has theStorage Object Admin ( If restore is enabled and |
cassandra.restore.snapshotTimestamp | Advanced | Introduced in version: 1.0.0 Default value: None Chart: Required if restore is enabled. Timestamp of the backup that should be restored. |
cassandra.securityContext.seccompProfile.type | Advanced | Introduced in version: 1.16.0 Default value: None Chart: Specifies the Seccomp profile type to apply to the pod's security context. Allowed values are |
cassandra.storage.capacity | Basic | Introduced in version: 1.0.0 Default value: Chart: Required if Specifies the disk size required, in mebibytes (Mi) or gibibytes (Gi). | Note: This #cassandra-storage-capacity property is deprecated starting from v1.12.0.Use
cassandra.storage.storageclass | Basic | Introduced in version: 1.0.0 Default value: None Chart: Specifies the class of on-prem storage being used. |
cassandra.storage.storageSize | Basic | Introduced in version: 1.0.0 Default value: Chart: Required if Specifies the disk size required, in mebibytes (Mi) or gibibytes (Gi). |
cassandra.terminationGracePeriodSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The maximum time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully. The pod will be killed when all running processes have terminated or at the end of the grace period, whichever comes first. If there are no running processes, the pod will be killed immediately. |
cassandra.tolerations.effect | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
cassandra.tolerations.key | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
cassandra.tolerations.operator | Advanced | Introduced in version: 1.10.1 Default value: Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
cassandra.tolerations.tolerationSeconds | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
cassandra.tolerations.value | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
certManager
Apigee usescert-manager for certificate validation.
The following table describes the properties of thecertManager object:
| Property | Type | Description |
|---|---|---|
certManager.securityContext.seccompProfile.type | Advanced | Introduced in version: 1.16.0 Default value: None Chart: Specifies the Seccomp profile type to apply to the pod's security context. Allowed values are |
certManager.namespace | Advanced | Introduced in version: 1.9.0 Default value: Chart: The namespace forcert-manager. |
connectAgent
Apigee Connect allows the Apigee hybrid management plane to connect securely to the MART service in the runtime plane without requiring you to expose the MART endpoint on the internet.
The following table describes the properties of theconnectAgent object:
| Property | Type | Description |
|---|---|---|
connectAgent.securityContext.seccompProfile.type | Advanced | Introduced in version: 1.16.0 Default value: None Chart: Specifies the Seccomp profile type to apply to the pod's security context. Allowed values are |
connectAgent.annotations | Advanced | Introduced in version: 1.5.0 Default value: None Chart: Optional key/value map used to annotate pods. For more information, seeCustom annotations. |
connectAgent.gsa | Advanced | Introduced in version: 1.10.0 Default value: None Chart: Helm only: The email address of the Google IAM service account (GSA) for connectAgent to associate with the corresponding Kubernetes service account when enabling Workload Identity on GKE clusters using Helm charts. Set this when you have set apigee-mart service account.GSA email addresses typically have the format of: GSA_NAME@PROJECT_ID.iam.gserviceaccount.com For example: apigee-mart@my-hybrid-project.iam.gserviceaccount.com gcloud iam service-accounts list --project ${PROJECT_ID} --filter "apigee"SeeEnabling Workload Identity on GKE orEnabling Workload Identity Federation on AKS and EKS. |
connectAgent.logLevel | Advanced | Introduced in version: 1.2.0 Default value: Chart: The level of log reporting. Values can be:
|
connectAgent.image.pullPolicy | Advanced | Introduced in version: 1.2.0 Default value: Chart: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, seeUpdating images. |
connectAgent.image.tag | Advanced | Introduced in version: 1.2.0 Default value: Chart: The version label for this service's Docker image. |
connectAgent.image.url | Advanced | Introduced in version: 1.2.0 Default value: None Chart: The location of the Docker image for this service. Use hub to set a private repository URL for all components instead of configuring them individually. |
connectAgent.replicaCountMax | Basic | Introduced in version: 1.2.0 Default value: Chart: Maximum number of replicas available for autoscaling. |
connectAgent.replicaCountMin | Basic | Introduced in version: 1.2.0 Default value: Chart: Minimum number of replicas available for autoscaling. In production, you may want to increase |
connectAgent.resources.limits.cpu | Advanced | Introduced in version: 1.11.0 Default value: Chart: The CPU limit for the resource in a Kubernetes container, in millicores. |
connectAgent.resources.limits.memory | Advanced | Introduced in version: 1.11.0 Default value: Chart: The memory limit for the resource in a Kubernetes container, in mebibytes. |
connectAgent.resources.requests.cpu | Advanced | Introduced in version: 1.11.0 Default value: Chart: The CPU needed for normal operation of the resource in a Kubernetes container, in millicores. |
connectAgent.resources.requests.memory | Advanced | Introduced in version: 1.2.0 Default value: Chart: The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes. |
connectAgent.server | Advanced | Introduced in version: 1.2.0 Default value: Chart: The location of the server and port for this service. |
connectAgent.serviceAccountPath | Basic | Introduced in version: 1.1.1 Default value: None Chart: One of either Path to Google Service Account key file for the In most installations, the value of |
connectAgent.serviceAccountRef | Basic | Introduced in version: 1.2.0 Default value: None Chart: One of either A kubernetes secret reference to a Google Service Account key file. SeeStoring service account keys in Kubernetes secrets. In most installations, the value of |
connectAgent.targetCPUUtilizationPercentage | Advanced | Introduced in version: 1.2.0 Default value: Chart: Target CPU utilization for the Apigee Connect agent on the pod. The value of this field enables Apigee Connect to auto-scale when CPU utilization reaches this value, up to |
connectAgent.terminationGracePeriodSeconds | Advanced | Introduced in version: 1.2.0 Default value: Chart: The maximum time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully. The pod will be killed when all running processes have terminated or at the end of the grace period, whichever comes first. If there are no running processes, the pod will be killed immediately. |
connectAgent.tolerations.effect | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
connectAgent.tolerations.key | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
connectAgent.tolerations.operator | Advanced | Introduced in version: 1.10.1 Default value: Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
connectAgent.tolerations.tolerationSeconds | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
connectAgent.tolerations.value | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
defaults
The Default encryption keys for the Apigee hybrid installation.
Note: You need to update these for your installation.The following table describes the properties of thedefaults object:
| Property | Type | Description |
|---|---|---|
defaults.org.kmsEncryptionKey | Basic | Introduced in version: 1.0.0 Default value: Chart: Default encryption key for the org in KMS. |
defaults.org.kvmEncryptionKey | Basic | Introduced in version: 1.0.0 Default value: Chart: Default encryption key for the org in KVM. |
defaults.env.kmsEncryptionKey | Basic | Introduced in version: 1.0.0 Default value: Chart: Default encryption key for the environment (env) in KMS. |
defaults.env.kvmEncryptionKey | Basic | Introduced in version: 1.0.0 Default value: Chart: Default encryption key for the environment (env) in KVM. |
defaults.env.cacheEncryptionKey | Basic | Introduced in version: 1.0.0 Default value: Chart: Default cache encryption key for the environment (env). |
envs
Defines an array of environments to which you can deploy your API proxies. Each environmentprovides an isolated context orsandbox for running API proxies.
Your hybrid-enabled organization must have at least one environment.
For more information, seeAbout environments.
The following table describes the properties of theenvs object:
| Property | Type | Description |
|---|---|---|
envs[].cacheEncryptionKey | Basic | Introduced in version: 1.0.0 Default value: None Chart: One of either A base64-encoded encryption key. SeeData encryption. |
envs[].cacheEncryptionPath | Basic | Introduced in version: 1.2.0 Default value: None Chart: One of either The path to a file containing a base64-encoded encryption key. SeeData encryption. |
envs[].cacheEncryptionSecret.key | Basic | Introduced in version: 1.2.0 Default value: None Chart: One of either The key of aKubernetes secret containing a base64-encoded encryption key. SeeData encryption. |
envs[].cacheEncryptionSecret.name | Basic | Introduced in version: 1.2.0 Default value: None Chart: One of either The name of aKubernetes secret containing a base64-encoded encryption key. SeeData encryption. |
envs[].components.runtime.replicaCountMax | Basic | Introduced in version: 1.9.3 Default value: 4 Chart: Maximum number of replicas for autoscaling. Overrides |
envs[].components.runtime.replicaCountMin | Basic | Introduced in version: 1.9.3 Default value: 1 Chart: Minimum number of replicas for autoscaling. Overrides |
envs[].components.runtime.resources.limits.memory | Advanced | Introduced in version: 1.15.0 Default value: None Chart: The memory limit for the resource in a Kubernetes container, in mebibytes (Mi) or gibibytes (Gi). Important: Setting this property for this environment causes Apigee not to use the values of: If you set this property, you must also set
SeeConfigure large message payload support in Apigee hybrid for more details. |
envs[].components.runtime.resources.requests.memory | Advanced | Introduced in version: 1.15.0 Default value: None Chart: The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes ( If you set this property, you must also set
SeeConfigure large message payload support in Apigee hybrid for more details. |
envs[].components.synchronizer.replicaCountMax | Basic | Introduced in version: 1.9.3 Default value: 4 Chart: Maximum number of replicas for autoscaling. Overrides |
envs[].components.synchronizer.replicaCountMin | Basic | Introduced in version: 1.9.3 Default value: 1 Chart: Minimum number of replicas for autoscaling. Overrides |
envs[].gsa.runtime | Advanced | Introduced in version: 1.10.0 Default value: None Chart: Helm only: The email address of the runtime Google IAM service account to associate with the corresponding Kubernetes service account when enabling Workload Identity on GKE clusters using Helm charts. Tip: You can find the email address of your service accounts with the following command:gcloud iam service-accounts list --project ${PROJECT_ID} --filter "apigee"SeeEnabling Workload Identity on GKE orEnabling Workload Identity Federation on AKS and EKS. |
envs[].gsa.synchronizer | Advanced | Introduced in version: 1.10.0 Default value: None Chart: Helm only: The email address of the synchronizer Google IAM service account to associate with the corresponding Kubernetes service account when enabling Workload Identity on GKE clusters using Helm charts. Tip: You can find the email address of your service accounts with the following command:gcloud iam service-accounts list --project ${PROJECT_ID} --filter "apigee"SeeEnabling Workload Identity on GKE orEnabling Workload Identity Federation on AKS and EKS. |
envs[].httpProxy.host | Basic | Introduced in version: 1.2.0 Default value: None Chart: Specifies the host name or IP address where the HTTP proxy is running. List envs: - name: test httpProxy: scheme: HTTP host: 10.12.0.47 port: 3128 ... |
envs[].httpProxy.port | Basic | Introduced in version: 1.2.0 Default value: None Chart: Specifies the port on which the HTTP proxy is running. If this property is omitted, by default it uses port |
envs[].httpProxy.scheme | Basic | Introduced in version: 1.2.0 Default value: Chart: Specifies the type of the HTTP proxy as HTTP or HTTPS. By default, it uses |
envs[].httpProxy.username | Basic | Introduced in version: 1.2.0 Default value: None Chart: If the HTTP proxy requires basic authentication, then use this property to provide a username. |
envs[].httpProxy.password | Basic | Introduced in version: 1.2.0 Default value: None Chart: If the HTTP proxy requires basic authentication, then use this property to provide a password. |
envs[].managementCallsSkipProxy | Advanced | Introduced in version: 1.15.1 Default value: Chart: If set to |
envs[].name | Basic | Introduced in version: 1.0.0 Default value: None Chart: Required Apigee environment name to be synchronized. |
envs[].pollInterval | Advanced | Introduced in version: 1.0.0 Default value: None Chart: Interval used for polling organization and environment synchronization changes, in seconds. |
envs[].port | Advanced | Introduced in version: 1.0.0 Default value: None Chart: TCP port number for HTTPS traffic. |
envs[].securityContext.seccompProfile.type | Advanced | Introduced in version: 1.16.0 Default value: None Chart: Specifies the Seccomp profile type to apply to the pod's security context. Allowed values are |
envs[].serviceAccountPaths.runtime | Basic | Introduced in version: 1.4.0 Default value: None Chart: Path to file on local system to a Google Service Account key with theCloud Trace Agent role, usually the |
envs[].serviceAccountPaths.synchronizer | Basic | Introduced in version: 1.0 Default value: None Chart: Path to file on local system to a Google Service Account key with theApigee Synchronizer Manager role. |
envs[].serviceAccountSecretProviderClass | Advanced | Introduced in version: 1.12.0 Default value: None Chart: The name of the environment-specific secret provider class ( |
envs[].serviceAccountSecretRefs.runtime | Basic | Introduced in version: 1.4.0 Default value: None Chart: The name of aKubernetes secret. You mustcreate the secret using a Google Service Account key with theCloud Trace Agent role as its input. |
envs[].serviceAccountSecretRefs.synchronizer | Basic | Introduced in version: 1.2.0 Default value: None Chart: The name of aKubernetes secret. You mustcreate the secret using a Google Service Account key with theApigee Synchronizer Manager role as its input. |
gcp
Identifies the Google Cloud project ID (required for all hybrid installations), the Workload Identity and federated workload identity configurations, and the region where theapigee-logger and theapigee-metrics push their data.
The following table describes the properties of thegcp object:
| Property | Type | Description |
|---|---|---|
gcp.federatedWorkloadIdentity.audience | Basic | Introduced in version: 1.12.0 Default value: None Chart: The allowed audience of the Workload Identity Provider on non-GKE platforms. |
gcp.federatedWorkloadIdentity.credentialSourceFile | Basic | Introduced in version: 1.12.0 Default value: None Chart: The filename and path to the credential source file used by Workload Identity Federation to obtain the credentials for the service accounts. This is the value you provide for |
gcp.federatedWorkloadIdentity.enabled | Basic | Introduced in version: 1.12.0 Default value: Chart: Enables Workload Identity Federation on non-GKE platforms. Must not be set |
gcp.federatedWorkloadIdentity.tokenExpiration | Basic | Introduced in version: 1.12.0 Default value: Chart: The lifetime of the token in seconds. |
gcp.projectID | Basic | Introduced in version: 1.2.0 Default value: None Chart: Required Identifies the Google Cloud project where |
gcp.region | Basic | Introduced in version: 1.2.0 Default value: Chart: Required Identifies the Google Cloudregion where the |
gcp.workloadIdentity.enabled | Basic | Introduced in version: 1.10.0 Default value: Chart: Enables using Workload Identity Federation for GKE. This allows workloads in your GKE clusters to impersonate Identity and Access Management (IAM) service accounts to access Google Cloud services. Must not be set When When |
gcp.workloadIdentity.gsa | Advanced | Introduced in version: 1.10.0 Default value: None Chart: The email address of the Google IAM service account (GSA) for all components to associate with the corresponding Kubernetes service account when enabling Workload Identity on GKE clusters using Helm charts. Set this when you have set
GSA email addresses typically have the format of: GSA_NAME@PROJECT_ID.iam.gserviceaccount.com For example: apigee-non-prod@my-hybrid-project.iam.gserviceaccount.com gcloud iam service-accounts list --project ${PROJECT_ID} --filter "apigee" |
guardrails
Identifies the Google service account (GSA) and key file used by the Apigee Guardrails service. The Apigee Guardrails service allows the guardrails pod in the apigee-operator chart to check if required APIs are enabled in the project for successful installation of Apigee hybrid, as described inDiagnosing issues with guardrails andInstalling and upgrading hybrid runtime.
The following table describes the properties of theguardrails object:
| Property | Type | Description |
|---|---|---|
guardrails.image.pullPolicy | Advanced | Introduced in version: 1.16.0 Default value: Chart: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, seeUpdating images. |
guardrails.image.tag | Advanced | Introduced in version: 1.16.0 Default value: Chart: The version label for this service's Docker image. |
guardrails.image.url | Advanced | Introduced in version: 1.16.0 Default value: None Chart: The location of the Docker image for this service. Use hub to set a private repository URL for all components instead of configuring them individually. |
guardrails.gsa | Advanced | Introduced in version: 1.16.0 Default value: None Chart: The email address of the GSA email addresses typically have the format of: GSA_NAME@PROJECT_ID.iam.gserviceaccount.com For example: apigee-guardrails@my-hybrid-project.iam.gserviceaccount.com gcloud iam service-accounts list --project ${PROJECT_ID} --filter "apigee"SeeEnabling Workload Identity on GKE orEnabling Workload Identity Federation on AKS and EKS. |
guardrails.serviceAccountPath | Basic | Introduced in version: 1.16.0 Default value: None Chart: Unless using Workload Identity, one of either serviceAccountPath or serviceAccountRef is required. Path to the Google service account key file with theService Usage Viewer role. |
guardrails.serviceAccountRef | Advanced | Introduced in version: 1.16.0 Default value: None Chart: Unless using Workload Identity, one of either serviceAccountPath or serviceAccountRef is required. A kubernetes secret reference to a Google service account key file. SeeStoring service account keys in Kubernetes secrets. |
guardrails.tolerations.effect | Advanced | Introduced in version: 1.16.0 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
guardrails.tolerations.key | Advanced | Introduced in version: 1.16.0 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
guardrails.tolerations.operator | Advanced | Introduced in version: 1.16.0 Default value: Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
guardrails.tolerations.tolerationSeconds | Advanced | Introduced in version: 1.16.0 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
guardrails.tolerations.value | Advanced | Introduced in version: 1.16.0 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
httpProxy
httpProxy provides configuration parameters for an HTTP forward proxy server. When configured inoverrides.yaml, all internet communication for the Apigee Connect, Logger, MART, Metrics, Synchronizer, and UDCA components pass through the proxy server.
See also:connectAgent,logger,mart,metrics, andsynchronizer.
The following table describes the properties of thehttpProxy object:
| Property | Type | Description |
|---|---|---|
httpProxy.host | Basic | Introduced in version: 1.1.1 Default value: None Chart: The hostname of the HTTP Proxy. |
httpProxy.password | Basic | Introduced in version: 1.1.1 Default value: None Chart: If the HTTP proxy requires basic authentication, then use this property to provide a password. |
httpProxy.port | Basic | Introduced in version: 1.1.1 Default value: None Chart: The port of the HTTP Proxy. |
httpProxy.scheme | Basic | Introduced in version: 1.1.1 Default value: Chart: The scheme used by the proxy. Values can be |
httpProxy.useForRuntimeManagement | Advanced | Introduced in version: 1.15.1 Default value: None Chart: If |
httpProxy.username | Basic | Introduced in version: 1.1.1 Default value: None Chart: If the HTTP proxy requires basic authentication, then use this property to provide a username. |
ingressGateways
Configures each individual instance of the Apigee ingress gateway. Use these properties when you want to manage individual instances separately byingressGateways[].name.
SeeapigeeIngressGateway to apply common configuration across all instances of the Apigee ingress gateway.
Apply changes toingressGateways properties with theapigee-org chart.
The following table describes the properties of theingressGateways object:
| Property | Type | Description |
|---|---|---|
ingressGateways[].securityContext.seccompProfile.type | Advanced | Introduced in version: 1.16.0 Default value: None Chart: Specifies the Seccomp profile type to apply to the pod's security context. Allowed values are |
ingressGateways[].name | Basic | Introduced in version: 1.8.0 Default value: None Chart: Required The name of ingress gateway. Other services will use this name to address traffic to the gateway. The name must meet the following requirements:
For more information, seeDNS Subdomain Names in the Kubernetes documentation. |
ingressGateways[].resources.limits.cpu | Advanced | Introduced in version: 1.8.0 Default value: Chart: The CPU limit for the resource, in millicores. |
ingressGateways[].resources.limits.memory | Advanced | Introduced in version: 1.8.0 Default value: Chart: The memory limit for the resource, in mebibytes. |
ingressGateways[].resources.requests.cpu | Advanced | Introduced in version: 1.8.0 Default value: Chart: The CPU needed for normal operation of the resource, in millicores. |
ingressGateways[].resources.requests.memory | Advanced | Introduced in version: 1.8.0 Default value: Chart: The memory needed for normal operation of the resource, in mebibytes. |
ingressGateways[].replicaCountMax | Basic | Introduced in version: 1.8.0 Default value: Chart: The maximum number of pods that hybrid can automatically add for the ingress gateway available for autoscaling. |
ingressGateways[].replicaCountMin | Basic | Introduced in version: 1.8.0 Default value: Chart: The minimum number of pods for the ingress gateway available for autoscaling. |
ingressGateways[].svcAnnotations | Basic | Introduced in version: 1.8.0 Default value: None Chart: Optional key/value map used to annotate the ingress gateway on platforms that support annotation. For example: ingressGateways: svcAnnotations: networking.gke.io/load-balancer-type: "Internal" |
ingressGateways[].svcLoadBalancerIP | Basic | Introduced in version: 1.8.0 Default value: None Chart: On platforms that support specifying the load balancer IP address, the load balancer will be created with this IP address. On platforms that do not allow you to specify the load balancer IP address, this property is ignored. |
ingressGateways[].svcType | Basic | Introduced in version: 1.8.1 Default value: LoadBalancer Chart: Used to change the type of the default k8s service for ingress deployment. Set the value to
|
ingressGateways[].targetCPUUtilizationPercentage | Advanced | Introduced in version: 1.10.5, 1.11.2, 1.12.1 Default value: Chart: The threshold of CPU usage for scaling the number of pods in the ReplicaSet, as a percentage of total available CPU resources. When CPU usage goes above this value, then hybrid will gradually increase the number of pods in the ReplicaSet, up to For more information on scaling in Kubernetes, seeHorizontal Pod Autoscaling in the Kubernetes documentation. |
ingressGateways[].tolerations.effect | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
ingressGateways[].tolerations.key | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
ingressGateways[].tolerations.operator | Advanced | Introduced in version: 1.10.1 Default value: Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
ingressGateways[].tolerations.tolerationSeconds | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
ingressGateways[].tolerations.value | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
istiod
Configures the Apigee ingress.
The following table describes the properties of theistiod object:
| Property | Type | Description |
|---|---|---|
istiod.accessLogFile | Advanced | Introduced in version: 1.8.0 Default value: Chart: The file address for the ingress access log, for example Leaving this value undefined disables access logging. |
istiod.accessLogFormat | Advanced | Introduced in version: 1.8.0 Chart: The format for the ingress access log. Leaving this value undefined results in using the proxy's default access log format. Default access log format: '{"start_time":"%START_TIME%","remote_address":"%DOWNSTREAM_DIRECT_REMOTE_ADDRESS%","user_agent":"%REQ(USER-AGENT)%","host":"%REQ(:AUTHORITY)%","request":"%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%","request_time":"%DURATION%","status":"%RESPONSE_CODE%","status_details":"%RESPONSE_CODE_DETAILS%","bytes_received":"%BYTES_RECEIVED%","bytes_sent":"%BYTES_SENT%","upstream_address":"%UPSTREAM_HOST%","upstream_response_flags":"%RESPONSE_FLAGS%","upstream_response_time":"%RESPONSE_DURATION%","upstream_service_time":"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%","upstream_cluster":"%UPSTREAM_CLUSTER%","x_forwarded_for":"%REQ(X-FORWARDED-FOR)%","request_method":"%REQ(:METHOD)%","request_path":"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%","request_protocol":"%PROTOCOL%","tls_protocol":"%DOWNSTREAM_TLS_VERSION%","request_id":"%REQ(X-REQUEST-ID)%","sni_host":"%REQUESTED_SERVER_NAME%","apigee_dynamic_data":"%DYNAMIC_METADATA(envoy.lua)%"}'The following is a copy of the default access log format with line breaks added for readability. '{"start_time":"%START_TIME%", "remote_address":"%DOWNSTREAM_DIRECT_REMOTE_ADDRESS%", "user_agent":"%REQ(USER-AGENT)%", "host":"%REQ(:AUTHORITY)%", "request":"%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%", "request_time":"%DURATION%", "status":"%RESPONSE_CODE%", "status_details":"%RESPONSE_CODE_DETAILS%", "bytes_received":"%BYTES_RECEIVED%", "bytes_sent":"%BYTES_SENT%", "upstream_address":"%UPSTREAM_HOST%", "upstream_response_flags":"%RESPONSE_FLAGS%", "upstream_response_time":"%RESPONSE_DURATION%", "upstream_service_time":"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%", "upstream_cluster":"%UPSTREAM_CLUSTER%", "x_forwarded_for":"%REQ(X-FORWARDED-FOR)%", "request_method":"%REQ(:METHOD)%", "request_path":"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%", "request_protocol":"%PROTOCOL%", "tls_protocol":"%DOWNSTREAM_TLS_VERSION%", "request_id":"%REQ(X-REQUEST-ID)%", "sni_host":"%REQUESTED_SERVER_NAME%", "apigee_dynamic_data":"%DYNAMIC_METADATA(envoy.lua)%"}' |
istiod.forwardClientCertDetails | Advanced | Introduced in version: 1.9.2 Default value: Chart: Determines how the Envoy proxy (for the Apigee ingress gateway) handles the Possible values are:
For more information on these values, see the Envoy documentation forEnum extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ForwardClientCertDetails. If you change this setting after installing Hybrid, apply it with |
istiod.healthCheckUserAgents | Advanced | Introduced in version: 1.12.0 Default values: - "GoogleStackdriverMonitoring-UptimeChecks(https://cloud.google.com/monitoring)"- "Edge Health Probe" Chart: Enables non-Google Cloud loadbalancers to check the ingress gateway's health check endpoints ( apigeectl.To override the default user agents specified, use the following syntax, inserting the custom user agents: istiod: healthCheckUserAgents: - "CUSTOM_USER_AGENT_1" - "CUSTOM_USER_AGENT_2" To remove the user agent requirement, use the following: istiod: healthCheckUserAgents: [] kubectl rollout restart deployment -n apigee apigee-ingressgateway-manager to restart the pods andkubectl rollout status deployment -n apigee apigee-ingressgateway-manager to check the status of the rollout. |
istiod.image.pullPolicy | Advanced | Introduced in version: 1.8.0 Default value: Chart: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, seeUpdating images. |
istiod.image.tag | Advanced | Introduced in version: 1.8.0 Default value: Chart: The version label for this service's Docker image. |
istiod.image.url | Advanced | Introduced in version: 1.8.0 Default value: None Chart: The location of the Docker image for this service. Use hub to set a private repository URL for all components instead of configuring them individually. |
istiod.tolerations.effect | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
istiod.tolerations.key | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
istiod.tolerations.operator | Advanced | Introduced in version: 1.10.1 Default value: Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
istiod.tolerations.tolerationSeconds | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
istiod.tolerations.value | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
k8sCluster
Identifies Kubernetes cluster where the hybrid runtime is installed.
The following table describes the properties of thek8sCluster object:
| Property | Type | Description |
|---|---|---|
k8sCluster.name | Basic | Introduced in version: 1.2.0 Default value: None Chart: The name of the Kubernetes cluster where the hybrid runtime is installed. |
k8sCluster.region | Basic | Introduced in version: 1.2.0 Default value: None Chart: Identifies the Google Cloudregion in which your Kubernetes cluster was created. |
kubeRBACProxy
Identifies where Apigee should look for Kubernetes role-based access controls.
The following table describes the properties of thekubeRBACProxy object:
| Property | Type | Description |
|---|---|---|
kubeRBACProxy.image.pullPolicy | Advanced | Introduced in version: 1.2.0 Default value: Chart: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, seeUpdating images. |
kubeRBACProxy.image.tag | Advanced | Introduced in version:1.2.0Default value: Chart: The version label for this service's Docker image. |
kubeRBACProxy.image.url | Advanced | Introduced in version: 1.2.0 Default value: None Chart: The location of the Docker image for this service. Use hub to set a private repository URL for all components instead of configuring them individually. |
kubeRBACProxy.resources.limits.cpu | Advanced | Introduced in version: 1.11.0 Default value: Chart: The CPU limit for the resource in a Kubernetes container, in millicores. |
kubeRBACProxy.resources.limits.memory | Advanced | Introduced in version: 1.11.0 Default value: Chart: The memory limit for the resource in a Kubernetes container, in mebibytes. |
kubeRBACProxy.resources.requests.cpu | Advanced | Introduced in version: 1.11.0 Default value: Chart: The CPU needed for normal operation of the resource in a Kubernetes container, in millicores. |
kubeRBACProxy.resources.requests.memory | Advanced | Introduced in version: 1.11.0 Default value: Chart: The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes. |
logger
Defines the service that manages operational logs. All of the Apigee hybrid servicesthat run in your Kubernetes cluster output this information.
For more information, seeLogging overview.
The following table describes the properties of thelogger object:
| Property | Type | Description |
|---|---|---|
logger.securityContext.seccompProfile.type | Advanced | Introduced in version: 1.16.0 Default value: None Chart: Specifies the Seccomp profile type to apply to the pod's security context. Allowed values are |
logger.annotations | Advanced | Introduced in version: 1.5.0 Default value: None Chart: Optional key/value map used to annotate pods. For more information, seeCustom annotations. |
logger.bufferChunkSize | Advanced | Introduced in version: 1.12.0 Default value: 256k Chart: The initial buffer size to read log files. |
logger.bufferMaxSize | Advanced | Introduced in version: 1.12.0 Default value: 104857600 Chart: The limit of the buffer size per monitored file. Files exceeding this limit are removed from the monitored file list. |
logger.bufferMemoryLimit | Advanced | Introduced in version: 1.12.0 Default value: 150MB Chart: The limit of memory that logger can consumed. If reach, the logger will momentarily pause reading more data until the existing data is flushed in memory. |
logger.enabled | Basic | Introduced in version: 1.0.0 Default value: Chart: Enables or disables logging on the cluster. For non-GKE set to |
logger.envVars | Basic | Introduced in version: 1.8.5 Default value: None Chart: Allows you to include the logger: ... envVars: NO_PROXY: '<comma-separated-values>' for example: envVars: NO_PROXY: 'kubernetes.default.svc,oauth2.googleapis.com,logging.googleapis.com' Use SeeNO_PROXY in the Fluent Bit documentation. |
logger.flushInterval | Advanced | Introduced in version: 1.12.0 Default value: 1 Chart: The interval to wait before invoking the next buffer flushed, in seconds. |
logger.gsa | Advanced | Introduced in version: 1.10.0 Default value: None Chart: Helm only: The email address of the GSA email addresses typically have the format of: GSA_NAME@PROJECT_ID.iam.gserviceaccount.com For example: apigee-logger@my-hybrid-project.iam.gserviceaccount.com gcloud iam service-accounts list --project ${PROJECT_ID} --filter "apigee"SeeEnabling Workload Identity on GKE orEnabling Workload Identity Federation on AKS and EKS. |
logger.image.pullPolicy | Advanced | Introduced in version: 1.0.0 Default value: Chart: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, seeUpdating images. |
logger.image.tag | Advanced | Introduced in version: 1.0.0 Default value: Chart: The version label for this service's Docker image. |
logger.image.url | Advanced | Introduced in version: 1.0.0 Default value: None Chart: The location of the Docker image for this service. Use hub to set a private repository URL for all components instead of configuring them individually. |
logger.livenessProbe.failureThreshold | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1. |
logger.livenessProbe.initialDelaySeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of seconds after a container is started before a liveness probe is initiated. |
logger.livenessProbe.periodSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: Determines how often to perform a liveness probe, in seconds. The minimum value is 1. |
logger.livenessProbe.successThreshold | Advanced | Introduced in version: 1.0.0 Default value: Chart: The minimum consecutive successes needed for a liveness probe to be considered successful after a failure. The minimum value is 1. |
logger.livenessProbe.timeoutSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of seconds after which a liveness probe times out. The minimum value is 1. |
logger.nodeSelector.key | Basic | Introduced in version: 1.0.0 Default value: Chart: Required Node selector label key used to target dedicated Kubernetes nodes for |
logger.nodeSelector.value | Basic | Introduced in version: 1.0.0 Default value: Chart: Required Node selector label value used to target dedicated Kubernetes nodes for |
logger.resources.limits.cpu | Advanced | Introduced in version: 1.0.0 Default value: Chart: The CPU limit for the resource in a Kubernetes container, in millicores. |
logger.resources.limits.memory | Advanced | Introduced in version: 1.0.0 Default value: Chart: The memory limit for the resource in a Kubernetes container, in mebibytes. |
logger.resources.requests.cpu | Advanced | Introduced in version: 1.0.0 Default value: Chart: The CPU needed for normal operation of the resource in a Kubernetes container, in millicores. |
logger.resources.requests.memory | Advanced | Introduced in version: 1.0.0 Default value: Chart: The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes. |
logger.serviceAccountPath | Basic | Introduced in version: 1.0.0 Default value: None Chart: One of either Path to Google Service Account key file withLogs Writer role. |
logger.serviceAccountRef | Basic | Introduced in version: 1.2.0 Default value: None Chart: One of either A kubernetes secret reference to a Google Service Account key file. SeeStoring service account keys in Kubernetes secrets. |
logger.storageMaxChunks | Advanced | Introduced in version: 1.12.0 Default value: 128 Chart: The maximum number of chunks that can be up in memory. Chunks exceeding the limit will be saved in the file system. |
logger.terminationGracePeriodSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The maximum time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully. The pod will be killed when all running processes have terminated or at the end of the grace period, whichever comes first. If there are no running processes, the pod will be killed immediately. |
logger.tolerations.effect | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
logger.tolerations.key | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
logger.tolerations.operator | Advanced | Introduced in version: 1.10.1 Default value: Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
logger.tolerations.tolerationSeconds | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
logger.tolerations.value | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
mart
Defines the MART (Management API for RunTime data) service, which acts as an API provider forpublic Apigee APIs so that you can access and manage runtime data entities such as KMS (API Keys andOAuth tokens), KVM, Quota, and API products.
The following table describes the properties of themart object:
| Property | Type | Description |
|---|---|---|
mart.securityContext.seccompProfile.type | Advanced | Introduced in version: 1.16.0 Default value: None Chart: Specifies the Seccomp profile type to apply to the pod's security context. Allowed values are |
mart.annotations | Advanced | Introduced in version: 1.5.0 Default value: None Chart: Optional key/value map used to annotate pods. For more information, seeCustom annotations. |
mart.gsa | Advanced | Introduced in version: 1.10.0 Default value: None Chart: Helm only: The email address of the GSA email addresses typically have the format of: GSA_NAME@PROJECT_ID.iam.gserviceaccount.com For example: apigee-mart@my-hybrid-project.iam.gserviceaccount.com gcloud iam service-accounts list --project ${PROJECT_ID} --filter "apigee"SeeEnabling Workload Identity on GKE orEnabling Workload Identity Federation on AKS and EKS. |
mart.hostAlias | Basic | Introduced in version: 1.0.0 Default value: None Chart: The host alias pointing to theMART object. You can set this property to |
mart.image.pullPolicy | Advanced | Introduced in version: 1.0.0 Default value: Chart: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, seeUpdating images. |
mart.image.tag | Advanced | Introduced in version: 1.0.0 Default value: Chart: The version label for this service's Docker image. |
mart.image.url | Advanced | Introduced in version: 1.0.0 Default value: None Chart: The location of the Docker image for this service. Use hub to set a private repository URL for all components instead of configuring them individually. |
mart.initCheckCF.resources.requests.cpu | Advanced | Introduced in version: 1.0.0 Default value: Chart: The amount of CPU resources allocated to the initialization check of the Cloud Foundry process. |
mart.livenessProbe.failureThreshold | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1. |
mart.livenessProbe.initialDelaySeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of seconds after a container is started before a liveness probe is initiated. |
mart.livenessProbe.periodSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: Determines how often to perform a liveness probe, in seconds. The minimum value is 1. |
mart.livenessProbe.timeoutSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of seconds after which a liveness probe times out. The minimum value is 1. |
mart.metricsURL | Basic | Introduced in version: 1.0.0 Default value: Chart: |
mart.nodeSelector.key | Basic | Introduced in version: 1.0.0 Default value: None Chart: Optional node selector label key for targeting Kubernetes nodes for |
mart.nodeSelector.value | Basic | Introduced in version: 1.0.0 Default value: None Chart: Optional node selector label value for targeting Kubernetes nodes for |
mart.readinessProbe.failureThreshold | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of times Kubernetes will verify that readiness probes have failed before marking the podunready. The minimum value is 1. |
mart.readinessProbe.initialDelaySeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of seconds after a container is started before a readiness probe is initiated. |
mart.readinessProbe.periodSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: Determines how often to perform a readiness probe, in seconds. The minimum value is 1. |
mart.readinessProbe.successThreshold | Advanced | Introduced in version: 1.0.0 Default value: Chart: The minimum consecutive successes needed for a readiness probe to be considered successful after a failure. The minimum value is 1. |
mart.readinessProbe.timeoutSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of seconds after which a liveness probe times out. The minimum value is 1. |
mart.replicaCountMax | Basic | Introduced in version: 1.0.0 Default value: Chart: Maximum number of replicas available for autoscaling. |
mart.replicaCountMin | Basic | Introduced in version: 1.0.0 Default value: Chart: Minimum number of replicas available for autoscaling. |
mart.resources.limits.cpu | Advanced | Introduced in version: 1.11.0 Default value: Chart: The CPU limit for the resource in a Kubernetes container, in millicores. |
mart.resources.limits.memory | Advanced | Introduced in version: 1.11.0 Default value: Chart: The memory limit for the resource in a Kubernetes container, in mebibytes. |
mart.resources.requests.cpu | Advanced | Introduced in version: 1.0.0 Default value: Chart: The CPU needed for normal operation of the resource in a Kubernetes container, in millicores. |
mart.resources.requests.memory | Advanced | Introduced in version: 1.0.0 Default value: Chart: The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes. |
mart.serviceAccountPath | Basic | Introduced in version: 1.1.1 Default value: None Chart: One of either Path to Google Service Account key file withno role. |
mart.serviceAccountRef | Basic | Introduced in version: 1.2.0 Default value: None Chart: One of either A kubernetes secret reference to a Google Service Account key file. SeeStoring service account keys in Kubernetes secrets. |
mart.sslCertPath | Basic | Introduced in version: 1.0.0 Default value: None Chart: Either Local file system path for loading and encoding the SSL cert to a Secret. |
mart.sslKeyPath | Basic | Introduced in version: 1.0.0 Default value: None Chart: Either Local file system path for loading and encoding the SSL key to a Secret. |
mart.sslSecret | Basic | Introduced in version: 1.2.0 Default value: None Chart: Either The name of a file stored in a Kubernetes secret that contains the TLS certificate and private key. You must create the secret using the TLS certificate and key data as its input. See also:
|
mart.targetCPUUtilizationPercentage | Advanced | Introduced in version: 1.0.0 Default value: Chart: Target CPU utilization for the MART process on the pod. The value of this field enables MART to auto-scale when CPU utilization reaches this value, up to |
mart.terminationGracePeriodSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The maximum time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully. The pod will be killed when all running processes have terminated or at the end of the grace period, whichever comes first. If there are no running processes, the pod will be killed immediately. |
mart.tolerations.effect | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
mart.tolerations.key | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
mart.tolerations.operator | Advanced | Introduced in version: 1.10.1 Default value: Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
mart.tolerations.tolerationSeconds | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
mart.tolerations.value | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
metrics
Defines the service that collects operations metrics. You can use metrics data to monitor thehealth of Hybrid services, to set up alerts, and so on.
For more information, seeMetrics collection overview.
The following table describes the properties of themetrics object:
| Property | Type | Description |
|---|---|---|
metrics.securityContext.seccompProfile.type | Advanced | Introduced in version: 1.16.0 Default value: None Chart: Specifies the Seccomp profile type to apply to the pod's security context. Allowed values are |
metrics.adapter.image.pullPolicy | Advanced | Introduced in version: 1.8.1 Default value: Chart: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, seeUpdating images. |
metrics.adapter.image.tag | Advanced | Introduced in version: 1.8.1 Default value: Chart: The version label for this service's Docker image. |
metrics.adapter.image.url | Advanced | Introduced in version: 1.8.1 Default value: None Chart: The location of the Docker image for this service. Use hub to set a private repository URL for all components instead of configuring them individually. |
metrics.adapter.resources.limits.cpu | Advanced | Introduced in version: 1.14.1 Default value: Chart: The CPU limit for the adapter resource in a Kubernetes container, in millicores. |
metrics.adapter.resources.limits.memory | Advanced | Introduced in version: 1.14.1 Default value: Chart: The memory limit for the adapter resource in a Kubernetes container, in gibibytes. |
metrics.adapter.resources.requests.cpu | Advanced | Introduced in version: 1.14.1 Default value: Chart: The CPU needed for normal operation of the adapter in a Kubernetes container, in millicores. |
metrics.adapter.resources.requests.memory | Advanced | Introduced in version: 1.14.1 Default value: Chart: The memory needed for normal operation of the adapter in a Kubernetes container, in mebibytes. |
metrics.aggregator.resources.requests.cpu | Advanced | Introduced in version: 1.4.0 Default value: Chart: The CPU needed for normal operation of the aggregator in a Kubernetes container, in millicores. |
metrics.aggregator.resources.requests.memory | Advanced | Introduced in version: 1.4.0 Default value: Chart: The memory needed for normal operation of the aggregator in a Kubernetes container, in mebibytes. |
metrics.aggregator.resources.limits.cpu | Advanced | Introduced in version: 1.4.0 Default value: Chart: The CPU limit for the aggregator resource in a Kubernetes container, in millicores. |
metrics.aggregator.resources.limits.memory | Advanced | Introduced in version: 1.4.0 Default value: Chart: The memory limit for the aggregator resource in a Kubernetes container, in gibibytes. |
metrics.annotations | Advanced | Introduced in version: 1.5.0 Default value: None Chart: Optional key/value map used to annotate pods. For more information, seeCustom annotations. |
metrics.app.resources.requests.cpu | Advanced | Introduced in version: 1.4.0 Default value: Chart: The CPU needed for normal operation of the app in a Kubernetes container, in millicores. |
metrics.app.resources.requests.memory | Advanced | Introduced in version: 1.4.0 Default value: Chart: The memory needed for normal operation of the app in a Kubernetes container, in mebibytes. |
metrics.app.resources.limits.cpu | Advanced | Introduced in version: 1.4.0 Default value: Chart: The CPU limit for the app resource in a Kubernetes container, in millicores. |
metrics.app.resources.limits.memory | Advanced | Introduced in version: 1.4.0 Default value: Chart: The memory limit for the app resource in a Kubernetes container, in gibibytes. |
metrics.appStackdriverExporter.resources.limits.cpu | Advanced | Introduced in version: 1.7.0 Default value: Chart: The CPU limit for the stackdriverExporter resource in a Kubernetes container, in millicores. |
metrics.appStackdriverExporter.resources.limits.memory | Advanced | Introduced in version: 1.7.0 Default value: Chart: The memory limit for the stackdriverExporter resource in a Kubernetes container, in gibibytes. |
metrics.appStackdriverExporter.resources.requests.cpu | Advanced | Introduced in version: 1.7.0 Default value: Chart: The CPU needed for normal operation of the stackdriverExporter in a Kubernetes container, in millicores. |
metrics.appStackdriverExporter.resources.requests.memory | Advanced | Introduced in version: 1.7.0 Default value: Chart: The memory needed for normal operation of the stackdriverExporter in a Kubernetes container, in mebibytes. |
metrics.collector.envVars | Basic | Introduced in version: 1.13 Default value: None Chart: Allows you to pass in and override environment variables in OpenTelemetry. For example, you can define The metrics:... envVars: HTTP_PROXY: '<host-name>' for example: envVars: HTTP_PROXY: 'http://1.1.1.1:80' The metrics:... envVars: HTTPS_PROXY: '<host-name>' for example: envVars: HTTPS_PROXY: 'https://1.1.1.1:80' The metrics:...envVars: NO_PROXY: '<comma-separated-values>' for example: envVars: NO_PROXY: 'https://1.1.1.1:80, https://1.1.1.1:81' Use SeeProxy support in the OpenTelemetry documentation. |
metrics.collector.imagePullPolicy | Advanced | Introduced in version: 1.12.0 Default value: Chart: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, seeUse a private image repository with Apigee hybrid. |
metrics.collector.image.tag | Basic | Introduced in version: 1.12.0 Default value: Chart: The version label for this service's Docker image. |
metrics.collector.image.url | Basic | Introduced in version: 1.12.0 Default value: None Chart: The location of the Docker image for this service. Use hub to set a private repository URL for all components instead of configuring them individually. |
metrics.collector.resources.requests.cpu | Advanced | Introduced in version: 1.12.0 Default value: Chart: The CPU needed for normal operation of the app in a Kubernetes container, in millicores. |
metrics.collector.resources.requests.memory | Advanced | Introduced in version: 1.12.0 Default value: Chart: The memory needed for normal operation of the app in a Kubernetes container, in mebibytes. |
metrics.collector.resources.limits.cpu | Advanced | Introduced in version: 1.12.0 Default value: Chart: The CPU limit for the app resource in a Kubernetes container, in millicores. |
metrics.collector.resources.limits.memory | Advanced | Introduced in version: 1.12.0 Default value: Chart: The memory limit for the app resource in a Kubernetes container, in gibibytes. |
metrics.collector.livenessProbe.failureThreshold | Advanced | Introduced in version: 1.12.0 Default value: Chart: The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1. |
metrics.collector.livenessProbe.initialDelaySeconds | Advanced | Introduced in version: 1.12.0 Default value: Chart: The number of seconds after a container is started before a liveness probe is initiated. |
metrics.collector.livenessProbe.periodSeconds | Advanced | Introduced in version: 1.12.0 Default value: Chart: Determines how often to perform a liveness probe, in seconds. The minimum value is 1. |
metrics.collector.livenessProbe.successThreshold | Advanced | Introduced in version: 1.12.0 Default value: Chart: The minimum consecutive successes needed for a liveness probe to be considered successful after a failure. The minimum value is 1. |
metrics.collector.livenessProbe.timeoutSeconds | Advanced | Introduced in version: 1.12.0 Default value: Chart: The number of seconds after which a liveness probe times out. The minimum value is 1. |
metrics.collector.readinessProbe.failureThreshold | Advanced | Introduced in version: 1.12.0 Default value: Chart: The number of times Kubernetes will verify that readiness probes have failed before marking the pod unready. The minimum value is 1. |
metrics.collector.readinessProbe.initialDelaySeconds | Advanced | Introduced in version: 1.12.0 Default value: Chart: The number of seconds after a container is started before a readiness probe is initiated. |
metrics.collector.readinessProbe.periodSeconds | Advanced | Introduced in version: 1.12.0 Default value: Chart: Determines how often to perform a readiness probe, in seconds. The minimum value is 1. |
metrics.collector.readinessProbe.successThreshold | Advanced | Introduced in version: 1.12.0 Default value: Chart: The minimum consecutive successes needed for a readiness probe to be considered successful after a failure. The minimum value is 1. |
metrics.collector.readinessProbe.timeoutSeconds | Advanced | Introduced in version: 1.12.0 Default value: Chart: The number of seconds after which a liveness probe times out. The minimum value is 1. |
metrics.disablePrometheusPipeline | Basic | Introduced in version: 1.12.0 Default value: Chart: Metrics for |
metrics.enabled | Basic | Introduced in version: 1.0.0 Default value: Chart: Enables Apigee metrics. Set to |
metrics.gsa | Advanced | Introduced in version: 1.10.0 Default value: None Chart: Helm only: The email address of the GSA email addresses typically have the format of: GSA_NAME@PROJECT_ID.iam.gserviceaccount.com For example: apigee-metrics@my-hybrid-project.iam.gserviceaccount.com gcloud iam service-accounts list --project ${PROJECT_ID} --filter "apigee"SeeEnabling Workload Identity on GKE orEnabling Workload Identity Federation on AKS and EKS. |
metrics.nodeSelector.key | Basic | Introduced in version: 1.0.0 Default value: None Chart: Required Node selector label key used to target dedicated Kubernetes nodes for |
metrics.nodeSelector.value | Basic | Introduced in version: 1.0.0 Default value: None Chart: Required Node selector label value used to target dedicated Kubernetes nodes for |
metrics.prometheus.containerPort | Advanced | Introduced in version: 1.0.0 Default value: Chart: The port to connect to the Prometheus metrics service. |
metrics.prometheus.image.pullPolicy | Advanced | Introduced in version: 1.0.0 Default value: Chart: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, seeUpdating images. |
metrics.prometheus.image.tag | Advanced | Introduced in version: 1.0.0 Default value: Chart: The version label for this service's Docker image. |
metrics.prometheus.image.url | Advanced | Introduced in version: 1.0.0 Default value: None Chart: The location of the Docker image for this service. Use hub to set a private repository URL for all components instead of configuring them individually. |
metrics.prometheus.livenessProbe.failureThreshold | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1. |
metrics.prometheus.livenessProbe.periodSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: Determines how often to perform a liveness probe, in seconds. The minimum value is 1. |
metrics.prometheus.livenessProbe.timeoutSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of seconds after which a liveness probe times out. The minimum value is 1. |
metrics.prometheus.readinessProbe.failureThreshold | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of times Kubernetes will verify that readiness probes have failed before marking the podunready. The minimum value is 1. |
metrics.prometheus.readinessProbe.periodSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: Determines how often to perform a readiness probe, in seconds. The minimum value is 1. |
metrics.prometheus.readinessProbe.timeoutSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of seconds after which a liveness probe times out. The minimum value is 1. |
metrics.prometheus.resources.limits.cpu | Advanced | Introduced in version: 1.14.1 Default value: Chart: The CPU limit for the prometheus resource in a Kubernetes container, in millicores. |
metrics.prometheus.resources.limits.memory | Advanced | Introduced in version: 1.14.1 Default value: Chart: The memory limit for the prometheus resource in a Kubernetes container, in gibibytes. |
metrics.prometheus.resources.requests.cpu | Advanced | Introduced in version: 1.14.1 Default value: Chart: The CPU needed for normal operation of the prometheus in a Kubernetes container, in millicores. |
metrics.prometheus.resources.requests.memory | Advanced | Introduced in version: 1.14.1 Default value: Chart: The memory needed for normal operation of the prometheus in a Kubernetes container, in mebibytes. |
metrics.prometheus.sslCertPath | Basic | Introduced in version: 1.0.0 Default value: None Chart: Required Path to the SSL cert for the Prometheus metrics collection process. Prometheus is a tool Apigee can use for collecting and processing metrics. See:
|
metrics.prometheus.sslKeyPath | Basic | Introduced in version: 1.0.0 Default value: None Chart: Required Path to the SSL Key for the Prometheus metrics collection process. Prometheus is a tool Apigee can use for collecting and processing metrics. See:
|
metrics.proxy.resources.requests.cpu | Advanced | Introduced in version: 1.4.0 Default value: Chart: The CPU needed for normal operation of the proxy in a Kubernetes container, in millicores. |
metrics.proxy.resources.requests.memory | Advanced | Introduced in version: 1.4.0 Default value: Chart: The memory needed for normal operation of the proxy in a Kubernetes container, in mebibytes. |
metrics.proxy.resources.limits.cpu | Advanced | Introduced in version: 1.4.0 Default value: Chart: The CPU limit for the proxy resource in a Kubernetes container, in millicores. |
metrics.proxy.resources.limits.memory | Advanced | Introduced in version: 1.4.0 Default value: Chart: The memory limit for the proxy resource in a Kubernetes container, in gibibytes. |
metrics.proxyStackdriverExporter.resources.requests.cpu | Advanced | Introduced in version: 1.7.0 Default value: Chart: The CPU needed for normal operation of the stackdriverExporter in a Kubernetes container, in millicores. |
metrics.proxyStackdriverExporter.resources.requests.memory | Advanced | Introduced in version: 1.7.0 Default value: Chart: The memory needed for normal operation of the stackdriverExporter in a Kubernetes container, in mebibytes. |
metrics.proxyStackdriverExporter.resources.limits.cpu | Advanced | Introduced in version: 1.7.0 Default value: Chart: The CPU limit for the stackdriverExporter resource in a Kubernetes container, in millicores. |
metrics.proxyStackdriverExporter.resources.limits.memory | Advanced | Introduced in version: 1.7.0 Default value: Chart: The memory limit for the stackdriverExporter resource in a Kubernetes container, in gibibytes. |
metrics.proxyURL | Basic | Introduced in version: 1.0.0 Default value: None Chart: URL for the metrics process sidecar proxy in the Kubernetes cluster. |
metrics.sdSidecar.containerPort | Advanced | Introduced in version: 1.0.0 Default value: Chart: The port for connecting to the Cloud Monitoring metrics service. |
metrics.sdSidecar.image.pullPolicy | Advanced | Introduced in version: 1.0.0 Default value: Chart: Determines when Kubelet pulls this service's Docker image. Possible values include:
|
metrics.sdSidecar.image.tag | Advanced | Introduced in version: 1.0.0 Default value: Chart: The version label for this service's Docker image. |
metrics.sdSidecar.image.url | Advanced | Introduced in version: 1.0.0 Default value: None Chart: The location of the Docker image for this service. Use hub to set a private repository URL for all components instead of configuring them individually. |
metrics.serviceAccountPath | Basic | Introduced in version: 1.0.0 Default value: None Chart: One of either Path to Google Service Account key file withMonitoring Metric Writer role. |
metrics.serviceAccountRef | Basic | Introduced in version: 1.2.0 Default value: None Chart: One of either A kubernetes secret reference to a Google Service Account key file. SeeStoring service account keys in Kubernetes secrets. |
metrics.stackdriverExporter.resources.requests.cpu | Advanced | Introduced in version: 1.4.0 Chart: Deprecated: Starting in Hybrid version 1.8, |
metrics.stackdriverExporter.resources.requests.memory | Advanced | Introduced in version: 1.4.0 Chart: Deprecated: Starting in Hybrid version 1.8, |
metrics.stackdriverExporter.resources.limits.cpu | Advanced | Introduced in version: 1.4.0 Chart: Deprecated: Starting in Hybrid version 1.8, |
metrics.stackdriverExporter.resources.limits.memory | Advanced | Introduced in version: 1.4.0 Chart: Deprecated: Starting in Hybrid version 1.8, |
metrics.terminationGracePeriodSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The maximum time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully. The pod will be killed when all running processes have terminated or at the end of the grace period, whichever comes first. If there are no running processes, the pod will be killed immediately. |
metrics.tolerations.effect | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
metrics.tolerations.key | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
metrics.tolerations.operator | Advanced | Introduced in version: 1.10.1 Default value: Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
metrics.tolerations.tolerationSeconds | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
metrics.tolerations.value | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
mintTaskScheduler
mintTaskScheduler is the cron job to schedule monetization tasks, like recurring fee calculation on a periodic basis.
The following table describes the properties of themintTaskScheduler object:
| Property | Type | Description |
|---|---|---|
mintTaskScheduler.securityContext.seccompProfile.type | Advanced | Introduced in version: 1.16.0 Default value: None Chart: Specifies the Seccomp profile type to apply to the pod's security context. Allowed values are |
mintTaskScheduler.gsa | Advanced | Introduced in version: 1.15.1 Default value: None Chart: The email address of the GSA email addresses typically have the format of: GSA_NAME@PROJECT_ID.iam.gserviceaccount.com For example: apigee-mint-task-scheduler@my-hybrid-project.iam.gserviceaccount.com gcloud iam service-accounts list --project ${PROJECT_ID} --filter "apigee"SeeEnabling Workload Identity on GKE orEnabling Workload Identity Federation on AKS and EKS. |
mintTaskScheduler.image.pullPolicy | Advanced | Introduced in version: 1.7.0 Default value: Chart: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, seeUpdating images. |
mintTaskScheduler.image.tag | Advanced | Introduced in version: 1.7.0 Default value: Chart: The version label for this service's Docker image. |
mintTaskScheduler.image.url | Advanced | Introduced in version: 1.7.0 Default value: None Chart: The location of the Docker image for this service. Use hub to set a private repository URL for all components instead of configuring them individually. |
mintTaskScheduler.resources.limits.cpu | Advanced | Introduced in version: 1.1.0 Default value: Chart: The CPU limit for the resource in a Kubernetes container, in millicores. |
mintTaskScheduler.resources.limits.memory | Advanced | Introduced in version: 1.1.0 Default value: Chart: The memory limit for the resource in a Kubernetes container, in mebibytes. |
mintTaskScheduler.resources.requests.cpu | Advanced | Introduced in version: 1.7.0 Default value: Chart: The CPU needed for normal operation of the resource in a Kubernetes container, in millicores. |
mintTaskScheduler.resources.requests.memory | Advanced | Introduced in version: 1.7.0 Default value: Chart: The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes. |
mintTaskScheduler.serviceAccountPath | Basic | Introduced in version: 1.15.1 Default value: None Chart: One of either Path to Google Service Account key file. |
mintTaskScheduler.serviceAccountRef | Basic | Introduced in version: 1.15.1 Default value: None Chart: One of either A kubernetes secret reference to a Google Service Account key file. SeeStoring service account keys in Kubernetes secrets. |
mintTaskScheduler.tolerations.effect | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
mintTaskScheduler.tolerations.key | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
mintTaskScheduler.tolerations.operator | Advanced | Introduced in version: 1.10.1 Default value: Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
mintTaskScheduler.tolerations.tolerationSeconds | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
mintTaskScheduler.tolerations.value | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
newDataPipeline
newDataPipeline determines if Apigee hybrid uses thePub/Sub data pipeline for the runtime components to write data directly to the control plane.
The following table describes the properties of thenewDataPipeline object:
| Property | Type | Description |
|---|---|---|
newDataPipeline.debugSession | Advanced | Introduced in version: 1.13.1 Default value: Chart: Determines if the Pub/Sub data pipeline is enabled. Caution: Do not change this property for installations running Apigee hybrid 1.14.1 or later. |
newDataPipeline.analytics | Advanced | Introduced in version: 1.13.1 Default value: Chart: Determines if analytics use the Pub/Sub data pipeline. Caution: Do not change this property for installations running Apigee hybrid 1.14.1 or later. |
nodeSelector
ThenodeSelector object defines the node for your Apigee instance. Behind the scenes Apigee hybrid takes care to map the label key/value forapigeeRuntime andapigeeData to the individual Istio and MART components when you install or upgrade theapigee-org andapigee-ingress-manager charts. You can override this for individual objects in themart:nodeSelector property.
The following table describes the properties of thenodeSelector object:
| Property | Type | Description |
|---|---|---|
nodeSelector.apigeeData.key | Advanced | Introduced in version: 1.0.0 Default value: Chart: ApigeeData is the node for the Cassandra database. Node selector label key for targeting Kubernetes nodes for working with Apigee services data. |
nodeSelector.apigeeData.value | Advanced | Introduced in version: 1.0.0 Default value: Chart: apigee-data is the node for the Cassandra database. Node selector label value for targeting Kubernetes nodes for working with Apigee services data. |
nodeSelector.apigeeRuntime.key | Advanced | Introduced in version: 1.0.0 Default value: Chart: Apigee Runtime is the node for the runtime environment for the project. Node selector label key for targeting Kubernetes nodes for Apigee runtime services. |
nodeSelector.apigeeRuntime.value | Advanced | Introduced in version: 1.0.0 Default value: Chart:
|
nodeSelector.requiredForScheduling | Advanced | Introduced in version: 1.0.0 Default value: true Chart: The For production, |
redis
The following table describes the properties of theredis object:
| Property | Type | Description |
|---|---|---|
redis.securityContext.seccompProfile.type | Advanced | Introduced in version: 1.16.0 Default value: None Chart: Specifies the Seccomp profile type to apply to the pod's security context. Allowed values are |
redis.auth.password | Basic | Introduced in version: 1.6.0 Default value: Chart: Required Password for the Redis administrator. The admin user is used for any administrative activities performed on the Redis cluster. |
redis.auth.secret | Basic | Introduced in version: 1.9.1 Default value: None Chart: The name of the file stored in a Kubernetes secret that contains the password for the Redis administrator. The secret file should contain the key: data:redis.auth.password:encoded_value See also:
|
redis.envoy.image.pullPolicy | Advanced | Introduced in version: 1.6.0 Default value: Chart: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, seeUpdating images. |
redis.envoy.image.tag | Advanced | Introduced in version: 1.6.0 Default value: Chart: The version label for this service's Docker image. |
redis.envoy.image.url | Advanced | Introduced in version: 1.6.0 Default value: None Chart: The location of the Docker image for this service. Use hub to set a private repository URL for all components instead of configuring them individually. |
redis.image.pullPolicy | Advanced | Introduced in version: 1.6.0 Default value: Chart: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, seeUpdating images. |
redis.image.tag | Advanced | Introduced in version: 1.6.0 Default value: Chart: The version label for this service's Docker image. |
redis.image.url | Advanced | Introduced in version: 1.6.0 Default value: None Chart: The location of the Docker image for this service. Use hub to set a private repository URL for all components instead of configuring them individually. |
redis.replicaCount | Basic | Introduced in version: 1.6.0 Default value: Chart: Redis is a replicated storage. This property specifies the number of Redis nodes employed as aStatefulSet. |
redis.resources.requests.cpu | Advanced | Introduced in version: 1.6.0 Default value: Chart: The CPU needed for normal operation of the resource in a Kubernetes container, in millicores. Apigee recommends a value from500m to1000m. With 0.5 cores, a Redis node can typically handle 10K QPS. With 1.0 core, it can typically handle 20K QPS. CPU request resources above 1000m are not helpful in most cases. |
redis.tolerations.effect | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
redis.tolerations.key | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
redis.tolerations.operator | Advanced | Introduced in version: 1.10.1 Default value: Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
redis.tolerations.tolerationSeconds | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
redis.tolerations.value | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
runtime
The following table describes the properties of theruntime object:
| Property | Type | Description |
|---|---|---|
runtime.securityContext.seccompProfile.type | Advanced | Introduced in version: 1.16.0 Default value: None Chart: Specifies the Seccomp profile type to apply to the pod's security context. Allowed values are |
runtime.annotations | Advanced | Introduced in version: 1.5.0 Default value: None Chart: Optional key/value map used to annotate pods. For more information, seeCustom annotations. |
runtime.envVars | Basic | Introduced in version: 1.13.1 Default value: None Chart: Allows you to supply additional env variables to the runtime component in a key-value pair: runtime: envVars:KEY_1:VALUE_N ... ...KEY_N:VALUE_N for example: runtime: envVars: RUNTIME_ENV_VAR1: "value of runtime env-var 1" RUNTIME_ENV_VAR2: "value of runtime env-var 2" |
runtime.image.pullPolicy | Advanced | Introduced in version: 1.0.0 Default value: Chart: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, seeUpdating images. |
runtime.hpaBehavior.scaleDown.percent.periodSeconds | Advanced | Introduced in version: 1.7.0 Default value: 60 Chart: The window of time for which the policy should hold true when scaling down a percentage of runtime instances. |
runtime.hpaBehavior.scaleDown.percent.value | Advanced | Introduced in version: 1.7.0 Default value: 20 Chart: The amount of change which is permitted by the policy when scaling down a percentage of runtime instances. |
runtime.hpaBehavior.scaleDown.pods.periodSeconds | Advanced | Introduced in version: 1.7.0 Default value: 60 Chart: The window of time for which the policy should hold true when scaling down a number of runtime instances. |
runtime.hpaBehavior.scaleDown.pods.value | Advanced | Introduced in version: 1.7.0 Default value: 20 Chart: The amount of change which is permitted by the policy when scaling down a number of runtime instances. |
runtime.hpaBehavior.scaleDown.selectPolicy | Advanced | Introduced in version: 1.7.0 Default value: Min Chart: The decision that autoscaler makes between multiple autoscaling policies. Set the value toMin allows the smallest change in scaling down runtime instances. Set the value toMax allows the largest change in scaling down runtime instances. |
runtime.hpaBehavior.scaleDown.stabilizationWindowSeconds | Advanced | Introduced in version: 1.7.0 Default value: 120 Chart: The number of seconds for which past recommendations should be considered while scaling down. |
runtime.hpaBehavior.scaleUp.percent.periodSeconds | Advanced | Introduced in version: 1.7.0 Default value: 60 Chart: The window of time for which the policy should hold true when scaling up a percentage of runtime instances. |
runtime.hpaBehavior.scaleUp.percent.value | Advanced | Introduced in version: 1.7.0 Default value: 20 Chart: The window of time for which the policy should hold true when scaling up a percentage of runtime instances. |
runtime.hpaBehavior.scaleUp.pods.periodSeconds | Advanced | Introduced in version: 1.7.0 Default value: 60 Chart: The window of time for which the policy should hold true when scaling up a number of runtime instances. |
runtime.hpaBehavior.scaleUp.pods.value | Advanced | Introduced in version: 1.7.0 Default value: 4 Chart: The amount of change which is permitted by the policy when scaling up a number of runtime instances. |
runtime.hpaBehavior.scaleUp.selectPolicy | Advanced | Introduced in version: 1.7.0 Default value: Max Chart: The decision that autoscaler makes between multiple autoscaling policies. Set the value toMin allows the smallest change in scaling up runtime instances. Set the value toMaxallows the largest change in scaling up runtime instances. |
runtime.hpaBehavior.scaleUp.stabilizationWindowSeconds | Advanced | Introduced in version: 1.7.0 Default value: 30 Chart: The number of seconds for which past recommendations should be considered while scaling up runtime instances. |
runtime.hpaMetrics.serverMainTaskWaitTime | Advanced | Introduced in version: 1.7.0 Default value: 400M Chart: The desired average wait time (in ms) of processing queue in runtime instances for proxy requests at the http layer. |
runtime.hpaMetrics.serverNioTaskWaitTime | Advanced | Introduced in version: 1.7.0 Default value: 400M Chart: The desired average wait time (in ms) of processing queue in runtime instances for proxy requests to process policies. |
runtime.hpaMetrics.targetCPUUtilizationPercentage | Advanced | Introduced in version: 1.7.0 Default value: 75 Chart: The desired CPU utilization percentage across all runtime instances. |
runtime.image.tag | Advanced | Introduced in version: 1.0.0 Default value: Chart: The version label for this service's Docker image. |
runtime.image.url | Advanced | Introduced in version: 1.0.0 Default value: None Chart: The location of the Docker image for this service. Use hub to set a private repository URL for all components instead of configuring them individually. |
runtime.livenessProbe.failureThreshold | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1. |
runtime.livenessProbe.initialDelaySeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of seconds after a container is started before a liveness probe is initiated. |
runtime.livenessProbe.periodSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: Determines how often to perform a liveness probe, in seconds. The minimum value is 1. |
runtime.livenessProbe.timeoutSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of seconds after which a liveness probe times out. The minimum value is 1. |
runtime.nodeSelector.key | Basic | Introduced in version: 1.0.0 Default value: None Chart: Optional Node selector label key for targeting Kubernetes nodes for |
runtime.nodeSelector.value | Basic | Introduced in version: 1.0.0 Default value: None Chart: Node selector label value for targeting Kubernetes nodes for |
runtime.readinessProbe.failureThreshold | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of times Kubernetes will verify that readiness probes have failed before marking the podunready. The minimum value is 1. |
runtime.readinessProbe.initialDelaySeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of seconds after a container is started before a readiness probe is initiated. |
runtime.readinessProbe.periodSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: Determines how often to perform a readiness probe, in seconds. The minimum value is 1. |
runtime.readinessProbe.successThreshold | Advanced | Introduced in version: 1.0.0 Default value: Chart: The minimum consecutive successes needed for a readiness probe to be considered successful after a failure. The minimum value is 1. |
runtime.readinessProbe.timeoutSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of seconds after which a liveness probe times out. The minimum value is 1. |
runtime.replicaCountMax | Basic | Introduced in version: 1.0.0 Default value: Chart: Maximum number of replicas available for autoscaling. If usingEnhanced per-environment proxy limits, this will be applied to all replicasets for the environment. Each replicaset will still autoscale independently. |
runtime.replicaCountMin | Basic | Introduced in version: 1.0.0 Default value: Chart: Minimum number of replicas available for autoscaling. If usingEnhanced per-environment proxy limits, this will be applied to all replicasets for the environment. Each replicaset will still autoscale independently.. |
runtime.resources.limits.cpu | Advanced | Introduced in version: 1.11.0 Default value: Chart: The CPU limit for the resource in a Kubernetes container, in millicores. |
runtime.resources.limits.memory | Advanced | Introduced in version: 1.11.0 Default value: Chart: The memory limit for the resource in a Kubernetes container, in mebibytes (Mi) or gibibytes (Gi). Note: If you are using message payloads larger than 10MB, you must make the following configuration changes:
SeeConfigure large message payload support in Apigee hybrid for more details. |
runtime.resources.requests.cpu | Advanced | Introduced in version: 1.0.0 Default value: Chart: The CPU needed for normal operation of the resource in a Kubernetes container, in millicores. Note:To achieve smooth autoscaling of the message processors to accommodate traffic increases, we recommend that you do not exceed two cores (2000 millicores) if you decide to override the default.Apigee runtime components are bounded by I/O, and adding more CPU capacity does not always help with traffic increases. When there are high CPU requests, message processors may not autoscale and liveliness probes may fail with high traffic. |
runtime.resources.requests.memory | Advanced | Introduced in version: 1.0.0 Default value: Chart: The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes ( runtime.resources.requests.memory to at least1Gi in youroverrides.yaml. The default of512Mi is enough for initial operation and configuration, but should be raised for production.To achieve smooth autoscaling of the message processors to accommodate traffic increases, we recommend that you do not exceed 2.5Gi (2560Mi) if you decide to override the default. Note: If you are using message payloads larger than 10MB, you must make the following configuration changes:
SeeConfigure large message payload support in Apigee hybrid for more details. |
runtime.service.type | Advanced | Introduced in version: 1.0.0 Default value: Chart: The type of service. You can set this to a service other than ClusterIP; for example, |
runtime.targetCPUUtilizationPercentage | Advanced | Introduced in version: 1.0.0 Default value: Chart: Target CPU utilization for the runtime process on the pod. The value of this field enables the runtime to auto-scale when CPU utilization reaches this value, up to |
runtime.terminationGracePeriodSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The maximum time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully. The pod will be killed when all running processes have terminated or at the end of the grace period, whichever comes first. If there are no running processes, the pod will be killed immediately. Note: This value is set by the Apigee controller and cannot be overridden. |
runtime.tolerations.effect | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
runtime.tolerations.key | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
runtime.tolerations.operator | Advanced | Introduced in version: 1.10.1 Default value: Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
runtime.tolerations.tolerationSeconds | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
runtime.tolerations.value | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
securityContext
Defines security settings for pods that can be applied at the global, environment, or component level.
| Property | Type | Description |
|---|---|---|
securityContext.seccompProfile.type | Advanced | Introduced in version: 1.16.0 Default value: None Chart: Specifies the Seccomp profile type to apply to the pod's security context. Allowed values are |
synchronizer
Ensures that the Message Processors are kept up to date with the latest deployed API proxy bundles. To do this, the Synchronizer polls the management plane; when a new contract is detected, the Synchronizer sends it to the runtime plane. By default, Synchronizer stores environment configuration data in Cassandra.
For more information, seeConfigure the Synchronizer.
The following table describes the properties of thesynchronizer object:
| Property | Type | Description |
|---|---|---|
synchronizer.securityContext.seccompProfile.type | Advanced | Introduced in version: 1.16.0 Default value: None Chart: Specifies the Seccomp profile type to apply to the pod's security context. Allowed values are |
synchronizer.annotations | Advanced | Introduced in version: 1.5.0 Default value: None Chart: Optional key/value map used to annotate pods. For more information, seeCustom annotations. |
synchronizer.image.pullPolicy | Advanced | Introduced in version: 1.0.0 Default value: Chart: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, seeUpdating images. |
synchronizer.image.tag | Advanced | Introduced in version: 1.0.0 Default value: Chart: The version label for this service's Docker image. |
synchronizer.image.url | Advanced | Introduced in version: 1.0.0 Default value: None Chart: The location of the Docker image for this service. Use hub to set a private repository URL for all components instead of configuring them individually. |
synchronizer.livenessProbe.failureThreshold | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1. |
synchronizer.livenessProbe.initialDelaySeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of seconds after a container is started before a liveness probe is initiated. |
synchronizer.livenessProbe.periodSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: Determines how often to perform a liveness probe, in seconds. The minimum value is 1. |
synchronizer.livenessProbe.timeoutSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of seconds after which a liveness probe times out. The minimum value is 1. |
synchronizer.nodeSelector.key | Basic | Introduced in version: 1.0.0 Default value: None Chart: Required Optional node selector label key for targeting Kubernetes nodes for SeenodeSelector. |
synchronizer.nodeSelector.value | Basic | Introduced in version: 1.0.0 Default value: None Chart: Optional node selector label value used for targeting Kubernetes nodes for SeenodeSelector. |
synchronizer.pollInterval | Advanced | Introduced in version: 1.0.0 Default value: Chart: The length of time that Synchronizer waits between polling operations. Synchronizer polls Apigee control plane services to detect and pull new runtime contracts. |
synchronizer.readinessProbe.failureThreshold | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of times Kubernetes will verify that readiness probes have failed before marking the podunready. The minimum value is 1. |
synchronizer.readinessProbe.initialDelaySeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of seconds after a container is started before a readiness probe is initiated. |
synchronizer.readinessProbe.periodSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: Determines how often to perform a readiness probe, in seconds. The minimum value is 1. |
synchronizer.readinessProbe.successThreshold | Advanced | Introduced in version: 1.0.0 Default value: Chart: The minimum consecutive successes needed for a readiness probe to be considered successful after a failure. The minimum value is 1. |
synchronizer.readinessProbe.timeoutSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The number of seconds after which a liveness probe times out. The minimum value is 1. |
synchronizer.replicaCount | Basic | Introduced in version: 1.0.0 Chart: Deprecated: Starting in Hybrid version 1.2, manage the Synchronizer replica count with: |
synchronizer.replicaCountMax | Basic | Introduced in version: 1.2.0 Default value: Chart: Maximum number of replicas for autoscaling. |
synchronizer.replicaCountMin | Basic | Introduced in version: 1.2.0 Default value: Chart: Minimum number of replicas for autoscaling. |
synchronizer.resources.limits.cpu | Advanced | Introduced in version: 1.11.0 Default value: Chart: The CPU limit for the resource in a Kubernetes container, in millicores. |
synchronizer.resources.limits.memory | Advanced | Introduced in version: 1.11.0 Default value: Chart: The memory limit for the resource in a Kubernetes container, in mebibytes. |
synchronizer.resources.requests.cpu | Advanced | Introduced in version: 1.0.0 Default value: Chart: The CPU needed for normal operation of the resource in a Kubernetes container, in millicores. |
synchronizer.resources.requests.memory | Advanced | Introduced in version: 1.0.0 Default value: Chart: The memory needed for normal operation of the resource in a Kubernetes container, in gigabytes. |
synchronizer.serviceAccountPath | Basic | Introduced in version: 1.0.0 Default value: None Chart: One of either Path to Google Service Account key file withApigee Synchronizer Manager role. |
synchronizer.serviceAccountRef | Basic | Introduced in version: 1.2.0 Default value: None Chart: One of either A kubernetes secret reference to a Google Service Account key file. SeeStoring service account keys in Kubernetes secrets. |
synchronizer.serviceAccountSecret | Basic | Introduced in version: 1.1.0 Default value: None Chart: The name of aKubernetes secret. You must create the secret using a Google Service Account key with theApigee Synchronizer Manager role as its input. |
synchronizer.targetCPUUtilizationPercentage | Advanced | Introduced in version: 1.0.0 Default value: Chart: Target CPU utilization for the Synchronizer process on the pod. The value of this field enables Synchronizer to auto-scale when CPU utilization reaches this value, up to |
synchronizer.terminationGracePeriodSeconds | Advanced | Introduced in version: 1.0.0 Default value: Chart: The maximum time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully. The pod will be killed when all running processes have terminated or at the end of the grace period, whichever comes first. If there are no running processes, the pod will be killed immediately. |
synchronizer.tolerations.effect | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
synchronizer.tolerations.key | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
synchronizer.tolerations.operator | Advanced | Introduced in version: 1.10.1 Default value: Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
synchronizer.tolerations.tolerationSeconds | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
synchronizer.tolerations.value | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
virtualhosts
Thevirtualhosts property is a required configuration property. Virtual hosts allow Apigee hybrid to handle API requests to a specified environment group..
For more information, seeConfigure virtual hosts.
The following table describes the properties of thevirtualhosts object:
| Property | Type | Description | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
virtualhosts[].additionalGateways | Basic | Introduced in version: 1.2.0 Default value: None Chart: A list of Istio Gateways to route traffic to. | ||||||||||||
virtualhosts[].cipherSuites[] | Advanced | Introduced in version: 1.9.2 Default value: None Chart: This property configures the TLS ciphers used in the ingress gateway. Note: This property overrides the list of cipher suites enabled and does not append to it.Values for Below is a list of supported ciphers in OpenSSL format. You can find more information about the supported ciphers in the documentation for theBoring FIPS build of Envoy. A blank value defaults to the cipher suites supported by the Boring FIPS build of Envoy. TLS v1.3:
TLS v1.2:
TLS v1.1:
To enable more ciphersuites, add them to the virtualhosts:- name: ENV_GROUP_NAME minTLSProtocolVersion: "1.2" cipherSuites: - "AES128-GCM-SHA256" - "AES128-SHA" - "AES256-GCM-SHA384" - "AES256-SHA" - "ECDHE-ECDSA-AES128-GCM-SHA256" - "ECDHE-ECDSA-AES128-SHA" - "ECDHE-ECDSA-AES256-GCM-SHA384" - "ECDHE-ECDSA-AES256-SHA" - "ECDHE-ECDSA-CHACHA20-POLY1305" - "ECDHE-RSA-AES128-GCM-SHA256" - "ECDHE-RSA-AES128-SHA" - "ECDHE-RSA-AES256-GCM-SHA384" - "ECDHE-RSA-AES256-SHA" - "ECDHE-RSA-CHACHA20-POLY1305"... If you want to enable older versions of TLS in your Apigee ingress gateway deployment, use the For example, to enable TLS v.1.1: virtualhosts:- name: ENV_GROUP_NAME minTLSProtocolVersion: "1.1" cipherSuites: - "ECDHE-ECDSA-AES128-GCM-SHA256" - "ECDHE-RSA-AES128-GCM-SHA256" - "ECDHE-ECDSA-AES256-GCM-SHA384" - "ECDHE-RSA-AES256-GCM-SHA384" - "ECDHE-ECDSA-CHACHA20-POLY1305" - "ECDHE-RSA-CHACHA20-POLY1305" - "ECDHE-ECDSA-AES128-SHA" - "ECDHE-RSA-AES128-SHA" - "ECDHE-ECDSA-AES256-SHA" - "ECDHE-RSA-AES256-SHA"... virtualhosts.cipherSuites property uses the OpenSSL cipher suite format. For a list of ciphers with their names in both OpenSSL and IANA format, seeTranslating OpenSSL cipher suite names to IANA in the SSL.org documentation. | ||||||||||||
virtualhosts[].name | Basic | Introduced in version: 1.2.0 Default value: None Chart: Required The name of the virtual host. | ||||||||||||
virtualhosts[].maxTLSProtocolVersion | Basic | Introduced in version: 1.3.0 Default value: None Chart: The maximum version of the TLS protocol Envoy can select. Envoy automatically uses the optimal TLS protocol version between The value must be a string representing the TLS version number. For example: virtualhosts:- name: default maxTLSProtocolVersion: "1.3" Where the string represents the TLS version number in the form See also | ||||||||||||
virtualhosts[].minTLSProtocolVersion | Basic | Introduced in version: 1.3.0 Default value: None Chart: The minimum version of the TLS protocol Envoy can select. Envoy automatically uses the optimal TLS protocol version between The value must be a string representing the TLS version number. For example: virtualhosts:- name: default minTLSProtocolVersion: "1.2" Where the string represents the TLS version number in the form See also | ||||||||||||
virtualhosts[].selector | Basic | Introduced in version: 1.2.0 Default value: Chart: Required A key-value selector-value pair for pointing to different ingress selectors.
If no selector label is supplied, the configuration is supplied to Apigee ingress gateway. | ||||||||||||
virtualhosts[].sslCertPath | Basic | Introduced in version: 1.2.0 Default value: None Chart: Either The path on your system to a TLS certificate file. Note: For each configured environment, the Common Name (CN) in the cert must match the domain in thehostAliases[] property. For example, if the CN is*.example.com, thehostAliases[] could befoo.example.com orbar.example.com. | ||||||||||||
virtualhosts[].sslKeyPath | Basic | Introduced in version: 1.2.0 Default value: None Chart: Either The path on your system to the TLS private key file. | ||||||||||||
virtualhosts[].sslSecret | Basic | Introduced in version: 1.2.0 Default value: None Chart: Either The name if the file stored in a Kubernetes secret that contains the Cassandra users and passwords. You can create the secret using following the following instructions:Create the Secret. See also:
|
watcher
Thewatcher property is a required configuration property. The watcher is a process that watches for configuration changes and triggers their application to the runtime plane.
The following table describes the properties of thewatcher object:
| Property | Type | Description |
|---|---|---|
watcher.securityContext.seccompProfile.type | Advanced | Introduced in version: 1.16.0 Default value: None Chart: Specifies the Seccomp profile type to apply to the pod's security context. Allowed values are |
watcher.annotations | Advanced | Introduced in version: 1.5.0 Default value: None Chart: Optional key/value map used to annotate pods. For more information, seeCustom annotations. |
watcher.args.enableIssueScanning | Advanced | Introduced in version: 1.10.0 Default value: Chart: Enables or disables Automated issue surfacing. When Set to |
watcher.args.enableLeaderElect | Advanced | Introduced in version: 1.13.0 Default value: Chart: When |
watcher.args.issueScanInterval | Advanced | Introduced in version: 1.10.0 Default value: Chart: The interval in seconds for how often Watcher scans the runtime plane for automated issue surfacing. For more information, seeAutomated issue surfacing. |
watcher.gsa | Advanced | Introduced in version: 1.10.0 Default value: None Chart: Helm only: The email address of the GSA email addresses typically have the format of: GSA_NAME@PROJECT_ID.iam.gserviceaccount.com For example: apigee-watcher@my-hybrid-project.iam.gserviceaccount.com gcloud iam service-accounts list --project ${PROJECT_ID} --filter "apigee"SeeEnabling Workload Identity on GKE orEnabling Workload Identity Federation on AKS and EKS. |
watcher.image.pullPolicy | Advanced | Introduced in version: 1.4.0 Default value: Chart: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, seeUpdating images. |
watcher.image.tag | Advanced | Introduced in version: 1.4.0 Default value: Chart: The version label for this service's Docker image. |
watcher.image.url | Advanced | Introduced in version: 1.4.0 Default value: None Chart: The location of the Docker image for this service. Use hub to set a private repository URL for all components instead of configuring them individually. |
watcher.replicaCountMax | Basic | Introduced in version: 1.3.0 Default value: Chart: The maximum number of watcher replicas. This should be kept at Apigee hybrid uses one watcher pod per installation. Leader election automatically selects one watcher pod. Additional watcher pod replicas will be forced into an unstable state. Seewatcher.args.enableLeaderElect. Warning: Do not exceed a value of 1 forwatcher.replicaCountMax. |
watcher.replicaCountMin | Basic | Introduced in version: 1.3.0 Default value: Chart: The minimum number of watcher replicas. |
watcher.resources.limits.cpu | Advanced | Introduced in version: 1.11.0 Default value: Chart: The CPU limit for the resource in a Kubernetes container, in millicores. |
watcher.resources.limits.memory | Advanced | Introduced in version: 1.11.0 Default value: Chart: The memory limit for the resource in a Kubernetes container, in mebibytes. |
watcher.serviceAccountPath | Basic | Introduced in version: 1.3.0 Default value: None Chart: Required. Path to Google Service Account key file withApigee Runtime Agent role. |
watcher.serviceAccountRef | Advanced | Introduced in version: 1.3.0 Default value: None Chart: One of either serviceAccountPath or serviceAccountRef is required. A kubernetes secret reference to a Google Service Account key file. SeeStoring service account keys in Kubernetes secrets. |
watcher.tolerations.effect | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
watcher.tolerations.key | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
watcher.tolerations.operator | Advanced | Introduced in version: 1.10.1 Default value: Chart: Required to use theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
watcher.tolerations.tolerationSeconds | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
watcher.tolerations.value | Advanced | Introduced in version: 1.10.1 Default value: None Chart: Used by theTaints and Tolerations feature of Kubernetes.
SeeTaints and Tolerations: Concepts for details. |
Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2026-02-19 UTC.