This document explains how to configure Apigee hybrid to use images from a private container image repository.
Overview
All Apigee hybrid runtime images are hosted in the
Google Cloud Container Registry (GCR). If for any reason you wish to employ a private image container repository,
you can download the images from GCR, push them to your private repository, and override
the default image locations in your overrides.yaml
file.
Configuration steps
Follow these steps to use a private image container repository for the Apigee hybrid images. To perform these steps and successfully use the images in your private repository, you must be familiar with the Apigee hybrid installation procedure. In a typical scenario, you would plan to configure the private repository as part of a fresh hybrid installation.
- Push the Apigee hybrid images from GCR to your private repository. We recommend that you use the
apigee-push-pull utility to accomplish this step.
If you prefer to do this step manually, you need to have Docker installed and use the
docker pull
command as follows. Be sure to append the correct tag to each image name. For example, the tag forapigee-synchronizer
is1.11.2
, as shown below.- Get an up to date list of all images in your current
project with the
--list
option of theapigee-pull-push.sh
utility in theapigeectl/tools/
directory:apigee-pull-push.sh --list
Your output should look something like:
apigee: gcr.io/apigee-release/hybrid/apigee-mart-server:1.11.2 gcr.io/apigee-release/hybrid/apigee-synchronizer:1.11.2 gcr.io/apigee-release/hybrid/apigee-runtime:1.11.2 gcr.io/apigee-release/hybrid/apigee-hybrid-cassandra-client:1.11.2 gcr.io/apigee-release/hybrid/apigee-hybrid-cassandra:1.11.2 gcr.io/apigee-release/hybrid/apigee-cassandra-backup-utility:1.11.2 gcr.io/apigee-release/hybrid/apigee-udca:1.11.2 gcr.io/apigee-release/hybrid/apigee-connect-agent:1.11.2 gcr.io/apigee-release/hybrid/apigee-watcher:1.11.2 gcr.io/apigee-release/hybrid/apigee-operators:1.11.2 gcr.io/apigee-release/hybrid/apigee-installer:1.11.2 gcr.io/apigee-release/hybrid/apigee-redis:1.11.2 gcr.io/apigee-release/hybrid/apigee-diagnostics-collector:1.11.2 gcr.io/apigee-release/hybrid/apigee-diagnostics-runner:1.11.2 gcr.io/apigee-release/hybrid/apigee-mint-task-scheduler:1.11.2 third party: gcr.io/apigee-release/hybrid/apigee-stackdriver-logging-agent:1.10.5 gcr.io/apigee-release/hybrid/apigee-prom-prometheus:v2.52.0 gcr.io/apigee-release/hybrid/apigee-stackdriver-prometheus-sidecar:0.9.0 gcr.io/apigee-release/hybrid/apigee-kube-rbac-proxy:v0.18.0 gcr.io/apigee-release/hybrid/apigee-envoy:v1.27.0 gcr.io/apigee-release/hybrid/apigee-prometheus-adapter:v0.12.0 gcr.io/apigee-release/hybrid/apigee-asm-ingress:1.18.7-asm.26-distroless gcr.io/apigee-release/hybrid/apigee-asm-istiod:1.18.7-asm.26-distroless gcr.io/apigee-release/hybrid/apigee-fluent-bit:3.0.3
- Get an up to date list of all images in your current
project with the
- Pull the images needed for the
apigee-system
andapigee
namespaces with thedocker pull
command. For example:docker pull gcr.io/apigee-release/hybrid/apigee-installer:1.11.2
The following list shows the images needed for each namespace:
apigee-system
namespaceapigee-installer
apigee-kube-rbac-proxy
apigee-operators
Your
apigee
namespaceapigee-asm-ingress
apigee-asm-istiod
apigee-cassandra-backup-utility
apigee-connect-agent
apigee-diagnostics-collector
apigee-diagnostics-runner
apigee-envoy
apigee-fluent-bit
apigee-hybrid-cassandra-client
apigee-hybrid-cassandra
apigee-mart-server
apigee-prom-prometheus
apigee-prometheus-adapter
apigee-redis
apigee-runtime
apigee-stackdriver-logging-agent
apigee-stackdriver-prometheus-sidecar
apigee-synchronizer
apigee-udca
apigee-watcher
- After you pull and tag the images, push them to your private repository. See docker push.
apigee
and apigee-system
namespaces.
If these namespaces do not exist in your cluster, you must create them before performing this step.
For steps to create the Secret, see Create a Secret by providing credentials on the command line.
For example, to create a secret in the apigee-system
namespace:
kubectl create secret docker-registry SECRET_NAME -n apigee-system \ --docker-server=YOUR_REGISTRY_SERVER \ --docker-username=YOUR_DOCKER_USERNAME \ --docker-email=YOUR_DOCKER_EMAIL \ --docker-password="YOUR_DOCKER_PASSWORD)"
To create a Secret in the apigee
namespace:
kubectl create secret docker-registry SECRET_NAME -n apigee \ --docker-server=YOUR_REGISTRY_SERVER \ --docker-username=YOUR_DOCKER_USERNAME \ --docker-email=YOUR_DOCKER_EMAIL \ --docker-password="YOUR_DOCKER_PASSWORD)"
overrides.yaml
file. Creation of the overrides file
is described in the hybrid installation steps. See Configure the cluster for details.
imagePullSecrets: - name: SECRET_NAME
overrides.yaml
file with image URLs for the images stored in your
private repository. Each component that is stored in the repository has an image:url
element. Use this element to specify the URL of each component image. For example:
mart: serviceAccountPath: /installdir/hybrid-files/service-accounts/hybrid-apigee-non-prod.json image: url: my-docker.pkg.dev/hybrid-1/registry-name/apigee-mart-server
Follow this pattern to update each top-level hybrid component in your overrides.yaml
file with its
private repository image URL. A complete example overrides file is provided with your hybrid installation in
$APIGEECTL_HOME/examples/private-overrides.yaml
directory.
You can now complete a new hybrid installation using the private images, or update your existing installation. See the Apigee hybrid installation steps for more information.
Installing cert-manager from a private repository
To install cert-manager
from your private repository, see
Installing with Helm.
It is important that you install the same version of cert-manager
as specified
in the Apigee hybrid installation instructions to ensure compatibility.