This section lists all of the configuration properties that you can use to customize the runtime plane of your Apigee hybrid deployment.
Filter this page
To filter the properties displayed on this page, select Basic (most common properties) or Advanced (properties that rarely need changing):
DisplayTop-level properties
The following table describes the top-level properties in the overrides.yaml
file. These are properties
that do not belong to another object, and apply at the org or environment level:
Property | Type | Description |
---|---|---|
axHashSalt |
Advanced | Introduced in version: 1.3.0 Default value: Your organization name Optional The name of a Kubernetes secret that
contains a salt used when computing hashes to obfuscate user data before it is sent to
Apigee analytics. If you do not specify a salt value, Apigee uses SHA512 to hash the original value before sending data from the runtime plane to the control plane. |
contractProvider |
Advanced | Introduced in version: 1.0.0
Default value: Defines the API path for all APIs in your installation. Required if your hybrid installation is using Data residency in the following format: contractProvider: https://CONTROL_PLANE_LOCATION-apigee.googleapis.com Where CONTROL_PLANE_LOCATION is the location where control plane data like proxy bundles are stored. For a list see Available Apigee API control plane regions. For example: contractProvider: https://us-apigee.googleapis.com |
gcpProjectID |
Advanced | Deprecated: For v1.2.0 and later, use gcp.projectID instead.
Introduced in version: 1.0.0 Default value: none Required ID of your Google Cloud project. Works with |
gcpRegion |
Advanced | Deprecated: For v1.2.0 and later, use gcp.region instead.
Introduced in version: 1.0.0 Default value: Required The closet Google Cloud region or zone of your Kubernetes cluster. Works with |
hub |
Advanced | Introduced in version: 1.11.0
Default value: None The URL of a private image container repository used to pull images for all apigee components from a private repo.
The image path for each individual component will be the value of
For example, if the value of hub: private-docker-host.example.com as: ## an example of internal component vs 3rd party containers: - name: apigee-udca image: private-docker-host.example.com/apigee-udca:1.12.1 imagePullPolicy: IfNotPresent containers: - name: apigee-ingressgateway image: private-docker-host.example.com/apigee-asm-ingress:1.18.7-asm.4-distroless imagePullPolicy: IfNotPresent The other components will follow a similar pattern. Use See Use a private image repository with Apigee hybrid. You can override image URL for components individualy with the following properties:
|
imagePullSecrets.name |
Advanced | Introduced in version: 1.0.0
Default value: None Kubernetes secret name configured as docker-registry type; used to pull images from private repo. |
instanceID |
Basic | Introduced in version: 1.3.0
Default value: None Required A unique identifier for this installation. A unique string to identify this instance. This can be any combination of letters and numbers up to 63 characters in length. |
k8sClusterName |
Advanced | Deprecated: For v1.2.0 and later, use k8sCluster.name
and k8sCluster.region instead.
Introduced in version: 1.0.0 Default value: None Name of the Kubernetes (K8S) procluster where your hybrid project is running. Works with
|
kmsEncryptionKey |
Advanced | Introduced in version: 1.0.0
Default value: Optional. Use only one of kmsEncryptionKey or kmsEncryptionPath or kmsEncryptionSecret. Local file system path for the Apigee KMS data's encryption key. |
kmsEncryptionPath |
Advanced | Introduced in version: 1.2.0
Default value: None Optional. Use only one of kmsEncryptionKey or kmsEncryptionPath or kmsEncryptionSecret. The path to a file containing a base64-encoded encryption key. See Data encryption. |
kmsEncryptionSecret.key |
Advanced | Introduced in version: 1.2.0
Default value: None Optional. Use only one of kmsEncryptionKey or kmsEncryptionPath or kmsEncryptionSecret. The key of a Kubernetes secret containing a base64-encoded encryption key. See Data encryption. |
kmsEncryptionSecret.name |
Advanced | Introduced in version: 1.2.0
Default value: None Optional. Use only one of kmsEncryptionKey or kmsEncryptionPath or kmsEncryptionSecret. The name of a Kubernetes secret containing a base64-encoded encryption key. See Data encryption. |
kvmEncryptionKey |
Advanced | Introduced in version: 1.0.0
Default value: Optional. Use only one of kvmEncryptionKey or kvmEncryptionPath or kvmEncryptionSecret. Local file system path for the Apigee KVM data's encryption key. |
kvmEncryptionPath |
Advanced | Introduced in version: 1.2.0
Default value: None Optional. Use only one of kvmEncryptionKey or kvmEncryptionPath or kvmEncryptionSecret. The path to a file containing a base64-encoded encryption key. See Data encryption. |
kvmEncryptionSecret.key |
Advanced | Introduced in version: 1.2.0
Default value: None Optional. Use only one of kvmEncryptionKey or kvmEncryptionPath or kvmEncryptionSecret. The key of a Kubernetes secret containing a base64-encoded encryption key. See Data encryption. |
kvmEncryptionSecret.name |
Advanced | Introduced in version: 1.2.0
Default value: None Optional. Use only one of kvmEncryptionKey or kvmEncryptionPath or kvmEncryptionSecret. The name of a Kubernetes secret containing a base64-encoded encryption key. See Data encryption. |
multiOrgCluster |
Advanced | Introduced in version: 1.10.0
Default value: For multi-org clusters, this property enables the organization's metrics to be exported to
the project listed in the |
namespace |
Basic | Introduced in version: 1.0.0
Default value: The namespace of your Kubernetes cluster where the Apigee components will be installed. |
org |
Basic |
Introduced in version: 1.0.0 Default value: None Required The hybrid-enabled organization that was provisioned for you by Apigee during the hybrid installation. An organization is the top-level container in Apigee. It contains all your API proxies and related resources. If the value is empty, you must update it with your org name once you have created it. |
orgScopedUDCA |
Advanced | Introduced in version: 1.8.0
Default value: Enables the Universal Data Collection Agent service (UDCA) at the org level, that extracts analytics, monetization and debug (trace) and sends it to the Unified Analytics Platform (UAP) which resides in the Control Plane. Org-scoped UDCA uses a single Google service account for all Apigee
environments. The service account needs to have the Apigee Analytics
Agent ( Specify the path to the service account key file with the
If you prefer to use a separate UDCA agent for each environment, set
See also: udca. |
revision |
Advanced | Introduced in version: 1.0.0
Default value: Apigee hybrid supports rolling Kubernetes updates, which allow deployment updates to take place with zero downtime by incrementally updating Pod instances with new ones. When updating certain YAML overrides that result in underlying Kubernetes
When the
Changes to properties of the following objects require an update to For more information, see Rolling updates. |
serviceAccountSecretProviderClass |
Advanced | Introduced in version: 1.12.0
Default value: None The name of the organization-specific secret provider class ( |
validateOrg |
Advanced | Introduced in version: 1.8.0
Default value: Enables strict validation of the link between the Apigee Org and Google Cloud project and checks for the existence of environment groups.
See also |
validateServiceAccounts |
Advanced | Introduced in version: 1.0.0
Default value: Enables strict validation of service account permissions. This uses Cloud Resource Manager
API method
See also |
ao
Apigee Operators (AO) creates and updates low level Kubernetes and Istio resources that are required to deploy and maintain a component. For example, the controller carries out the release of message processors.
The following table describes the properties of the apigee-operators ao
object:
Property | Type | Description |
---|---|---|
ao.args.disableIstioConfigInAPIServer |
Advanced | Introduced in version: 1.8.0
Default value: Stops Apigee from supplying configuration to customer-installed ASM.
|
ao.args.disableManagedClusterRoles |
Advanced | Introduced in version: 1.10.0
Default value:
When |
ao.image.pullPolicy |
Advanced | Introduced in version: 1.2.0
Default value: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, see Updating images. |
ao.image.tag |
Advanced | Introduced in version: 1.2.0
Default value: The version label for this service's Docker image. |
ao.image.url |
Advanced | Introduced in version: 1.2.0
Default value: None The location of the Docker image for this service. Use |
ao.resources.limits.cpu |
Advanced | Introduced in version: 1.2.0
Default value: The CPU limit for the resource in a Kubernetes container, in millicores. |
ao.resources.limits.memory |
Advanced | Introduced in version: 1.2.0
Default value: The memory limit for the resource in a Kubernetes container, in mebibytes. |
ao.resources.requests.cpu |
Advanced | Introduced in version: 1.2.0
Default value: The CPU needed for normal operation of the resource in a Kubernetes container, in millicores. |
ao.resources.requests.memory |
Advanced | Introduced in version: 1.2.0
Default value: The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes. |
ao.tolerations.effect |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
ao.tolerations.key |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
ao.tolerations.operator |
Advanced | Introduced in version: 1.10.1
Default value: Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
ao.tolerations.tolerationSeconds |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
ao.tolerations.value |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
apigeeIngressGateway
Configures the Apigee ingress gateway for Apigee Hybrid. Use apigeeIngressGateway
properties to apply common configuration to all instances of the Apigee ingress gateway.
See ingressGateways
to configure individual instances
uniquely.
Apply changes to apigeeIngressGateway
properties with the apigee-org
chart.
The following table describes the properties of the apigeeIngressGateway
object:
Property | Type | Description |
---|---|---|
apigeeIngressGateway.image.pullPolicy |
Advanced | Introduced in version: 1.11.0
Default value: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, see Updating images. |
apigeeIngressGateway.image.tag |
Advanced | Introduced in version: 1.11.0
Default value: The version label for this service's Docker image. |
apigeeIngressGateway.image.url |
Advanced | Introduced in version: 1.11.0
Default value: None The location of the Docker image for this service. Use |
apigeeIngressGateway.nodeSelector.key |
Advanced | Introduced in version: 1.11.0
Default value: None Required Node selector label key used to target dedicated Kubernetes nodes for ingress gateway services. |
apigeeIngressGateway.nodeSelector.value |
Advanced | Introduced in version: 1.11.0
Default value: None Optional node selector label value used to target dedicated Kubernetes nodes for
ingress gateway services and override the See nodeSelector. |
apigeeIngressGateway.replicaCountMax |
Basic | Introduced in version: 1.11.0
Default value: The maximum number of pods that hybrid can automatically add for the ingress gateway available for autoscaling. |
apigeeIngressGateway.replicaCountMin |
Basic | Introduced in version: 1.11.0
Default value: The minimum number of pods for the ingress gateway available for autoscaling. |
apigeeIngressGateway.targetCPUUtilizationPercentage |
Advanced | Introduced in version: 1.10.5, 1.11.2, 1.12.1
Default value: The threshold of CPU usage for scaling the number of pods in the ReplicaSet, as a percentage of total available CPU resources. When CPU usage goes above this value, then hybrid will gradually
increase the number of pods in the ReplicaSet, up to
For more information on scaling in Kubernetes, see Horizontal Pod Autoscaling in the Kubernetes documentation. |
apigeeIngressGateway.tolerations.effect |
Advanced | Introduced in version: 1.11.0
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
apigeeIngressGateway.tolerations.key |
Advanced | Introduced in version: 1.11.0
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
apigeeIngressGateway.tolerations.operator |
Advanced | Introduced in version: 1.11.0
Default value: Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
apigeeIngressGateway.tolerations.tolerationSeconds |
Advanced | Introduced in version: 1.11.0
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
apigeeIngressGateway.tolerations.value |
Advanced | Introduced in version: 1.11.0
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
cassandra
Defines the hybrid service that manages the runtime data repository. This repository stores application configurations, distributed quota counters, API keys, and OAuth tokens for applications running on the gateway.
For more information, see StorageClass configuration.
The following table describes the properties of the cassandra
object:
Property | Type | Description |
---|---|---|
cassandra.annotations |
Advanced | Introduced in version: 1.5.0
Default value: None Optional key/value map used to annotate pods. For more information, see Custom annotations. |
cassandra.auth.admin.password |
Basic | Introduced in version: 1.0.0
Default value: Required Password for the Cassandra administrator. The admin user is used for any administrative activities performed on the Cassandra cluster. |
cassandra.auth.ddl.password |
Basic | Introduced in version: 1.0.0
Default value: Required Password for the Cassandra Data Definition Language (DDL) user. Used by MART for any of the data definition tasks like keyspace creation, update, and deletion. |
cassandra.auth.default.password |
Basic | Introduced in version: 1.0.0
Default value: Required The password for the default Cassandra user created when Authentication is enabled. This password must be reset when configuring Cassandra authentication. See Configuring TLS for Cassandra. |
cassandra.auth.dml.password |
Basic | Introduced in version: 1.0.0
Default value: Required Password for the Cassandra Data Manipulation Language (DML) user. The DML user is used by the client communication to read and write data to Cassandra. |
cassandra.auth.image.pullPolicy |
Advanced | Introduced in version: 1.0.0
Default value: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, see Updating images. |
cassandra.auth.image.tag |
Advanced | Introduced in version: 1.0.0
Default value: The version label for this service's Docker image. |
cassandra.auth.image.url |
Advanced | Introduced in version: 1.0.0
Default value: None The location of the Docker image for this service. Use |
cassandra.auth.jmx.password |
Basic | Introduced in version: 1.4.0
Default value: Required Password for the Cassandra JMX operations user. Used to authenticate and communicate with the Cassandra JMX interface. |
cassandra.auth.jmx.username |
Basic | Introduced in version: 1.4.0
Default value: Required Username for the Cassandra JMX operations user. Used to authenticate and communicate with the Cassandra JMX interface. |
cassandra.auth.jolokia.password |
Basic | Introduced in version: 1.4.0
Default value: Required Password for the Cassandra Jolokia JMX operations user. Used to authenticate and communicate with the Cassandra JMX API. |
cassandra.auth.jolokia.username |
Basic | Introduced in version: 1.4.0
Default value: Required Username for the Cassandra Jolokia JMX operations user. Used to authenticate and communicate with the Cassandra JMX API. |
cassandra.auth.secret |
Basic | Introduced in version: 1.3.3
Default value: None The name of the file stored in a Kubernetes secret that contains the Cassandra users and passwords. You can create the secret using following the following instructions: Create the Secret. See also:
|
cassandra.auth.secretProviderClass |
Advanced | Introduced in version: 1.10.3
Default value: None The Cassandra secret storage policy. When set, it must match the SecretProviderClass which references the external secret provider, like Hashicorp Vault. When unset, Apigee hybrid uses either the usernames and passwords stored in:
or the Kubernetes secret stored in: See Storing Cassandra secrets in Hashicorp Vault for instructions to create the policy. |
cassandra.backup.cloudProvider |
Advanced | Introduced in version: 1.0.0
Default value: Required if backup is enabled. Cloud provider for backup storage. You can set the value to either For information on CSI backup and restore for cloud platforms such as Google Cloud, AWS, and Azure, see CSI backup and restore. |
cassandra.backup.dbStorageBucket |
Advanced | Introduced in version: 1.0.0
Default value: None Required if backup is enabled. Cloud storage bucket for the backup data.
The Cloud Storage bucket path should be in the format gs://BUCKET_NAME.
The |
cassandra.backup.enabled |
Advanced | Introduced in version: 1.0.0
Default value: Data backup is not enabled by default. To enable, set to |
cassandra.backup.image.pullPolicy |
Advanced | Introduced in version: 1.0.0
Default value: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, see Updating images. |
cassandra.backup.image.tag |
Advanced | Introduced in version: 1.0.0
Default value: The version label for this service's Docker image. |
cassandra.backup.image.url |
Advanced | Introduced in version: 1.0.0
Default value: None The location of the Docker image for this service. Use |
cassandra.backup.schedule |
Advanced | Introduced in version: 1.0.0
Default value: The schedule for the cron job. |
cassandra.backup.serviceAccountPath |
Advanced | Introduced in version: 1.0.0
Default value: None One of either Path to Google Service Account key file with Storage Object Admin role. |
cassandra.backup.serviceAccountRef |
Advanced | Introduced in version: 1.2.0
Default value: None One of either |
cassandra.clusterName |
Basic | Introduced in version: 1.0.0
Default value: Specifies the name of the Cassandra cluster. |
cassandra.datacenter |
Basic | Introduced in version: 1.0.0
Default value: Specifies the datacenter of the Cassandra node. |
cassandra.dnsPolicy |
Basic | Introduced in version: 1.1.1
Default value: None
When you set |
cassandra.externalSeedHost |
Basic | Introduced in version: 1.0.0
Default value: None Hostname or IP of a Cassandra cluster node. If not set, the Kubernetes local service is used. |
cassandra.heapNewSize |
Basic | Introduced in version: 1.0.0
Default value: The amount of JVM system memory allocated to newer objects, in megabytes. |
cassandra.hostNetwork |
Basic | Introduced in version: 1.1.1
Default value: Enables the Kubernetes
Set Set When |
cassandra.image.pullPolicy |
Advanced | Introduced in version: 1.0.0
Default value: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, see Updating images. |
cassandra.image.tag |
Advanced | Introduced in version: 1.0.0
Default value: The version label for this service's Docker image. |
cassandra.image.url |
Advanced | Introduced in version: 1.0.0
Default value: None The location of the Docker image for this service. Use |
cassandra.maxHeapSize |
Advanced | Introduced in version: 1.0.0
Default value: The upper limit of JVM system memory available for Cassandra operations, in megabytes. |
cassandra.multiRegionSeedHost |
Basic | Introduced in version: 1.0.0
Default value: None IP address of an existing Cassandra cluster used to expand the existing cluster to a new region. See Configure the multi-region seed host. |
cassandra.nodeSelector.key |
Advanced | Introduced in version: 1.0.0
Default value: None Required Node selector label key used to target dedicated Kubernetes nodes for |
cassandra.nodeSelector.value |
Advanced | Introduced in version: 1.0.0
Default value: None Optional node selector label value used to target dedicated Kubernetes nodes for
See nodeSelector. |
cassandra.port |
Advanced | Introduced in version: 1.0.0
Default value: Port number used to connect to cassandra. |
cassandra.rack |
Basic | Introduced in version: 1.0.0
Default value: Specifies the rack of the Cassandra node. |
cassandra.readinessProbe.failureThreshold |
Advanced | Introduced in version: 1.0.0
Default value: The number of times Kubernetes will verify that readiness probes have failed before marking the pod unready. The minimum value is 1. |
cassandra.readinessProbe.initialDelaySeconds |
Advanced | Introduced in version: 1.0.0
Default value: The number of seconds after a container is started before a readiness probe is initiated. |
cassandra.readinessProbe.periodSeconds |
Advanced | Introduced in version: 1.0.0
Default value: Determines how often to perform a readiness probe, in seconds. The minimum value is 1. |
cassandra.readinessProbe.successThreshold |
Advanced | Introduced in version: 1.0.0
Default value: The minimum consecutive successes needed for a readiness probe to be considered successful after a failure. The minimum value is 1. |
cassandra.readinessProbe.timeoutSeconds |
Advanced | Introduced in version: 1.0.0
Default value: The number of seconds after which a liveness probe times out. The minimum value is 1. |
cassandra.replicaCount |
Basic | Introduced in version: 1.0.0
Default value: Cassandra is a replicated database. This property specifies the number of Cassandra nodes employed as a StatefulSet. |
cassandra.resources.requests.cpu |
Advanced | Introduced in version: 1.0.0
Default value: The CPU needed for normal operation of the resource in a Kubernetes container, in millicores. |
cassandra.resources.requests.memory |
Advanced | Introduced in version: 1.0.0
Default value: The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes. |
cassandra.restore.cloudProvider |
Advanced | Introduced in version: 1.0.0
Default value: Required if restore is enabled. Cloud provider for backup storage. For information on CSI backup and restore for cloud platforms such as Google Cloud, AWS, and Azure, see CSI backup and restore. |
cassandra.restore.dbStorageBucket |
Advanced | Introduced in version: 1.0.0
Default value: None Required if restore is enabled. Cloud storage bucket for the backup data to restore. |
cassandra.restore.enabled |
Advanced | Introduced in version: 1.0.0
Default value: |
cassandra.restore.image.pullPolicy |
Advanced | Introduced in version: 1.0.0
Default value: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, see Updating images. |
cassandra.restore.image.tag |
Advanced | Introduced in version: 1.0.0
Default value: The version label for this service's Docker image. |
cassandra.restore.image.url |
Advanced | Introduced in version: 1.0.0
Default value: None The location of the Docker image for this service. Use |
cassandra.restore.serviceAccountPath |
Advanced | Introduced in version: 1.0.0
Default value: None One of either Path to Google Service Account key file with Storage Object Admin role. |
cassandra.restore.serviceAccountRef |
Advanced | Introduced in version: 1.2.0
Default value: None One of either |
cassandra.restore.snapshotTimestamp |
Advanced | Introduced in version: 1.0.0
Default value: None Required if restore is enabled. Timestamp of the backup that should be restored. |
cassandra.restore.user |
Advanced | Introduced in version: 1.0.0
Default value: admin account Cassandra username used for schema backup restoration. If not specified, the admin user will be used. |
cassandra.sslCertPath |
Basic | Introduced in version: 1.2.0
Default value: None
The path on your system to a TLS certificate file. |
cassandra.sslKeyPath |
Basic | Introduced in version: 1.2.0
Default value: None
The path on your system to the TLS private key file. |
cassandra.sslRootCAPath |
Basic | Introduced in version: 1.2.0
Default value: None The certificate chain to the root CA (certificate authority). |
cassandra.storage.capacity |
Basic | Introduced in version: 1.0.0
Default value: Required if Specifies the disk size required, in mebibytes (Mi) or gibibytes (Gi). |
cassandra.storage.storageclass |
Basic | Introduced in version: 1.0.0
Default value: None Specifies the class of on-prem storage being used. |
cassandra.terminationGracePeriodSeconds |
Advanced | Introduced in version: 1.0.0
Default value: The time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully. |
cassandra.tolerations.effect |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
cassandra.tolerations.key |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
cassandra.tolerations.operator |
Advanced | Introduced in version: 1.10.1
Default value: Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
cassandra.tolerations.tolerationSeconds |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
cassandra.tolerations.value |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
certManager
Apigee uses cert-manager for certificate validation.
The following table describes the properties of the certManager
object:
Property | Type | Description |
---|---|---|
certManager.namespace |
Advanced | Introduced in version: 1.9.0
Default value: The namespace for cert-manager. |
connectAgent
Apigee Connect allows the Apigee hybrid management plane to connect securely to the MART service in the runtime plane without requiring you to expose the MART endpoint on the internet.
The following table describes the properties of the connectAgent
object:
Property | Type | Description |
---|---|---|
connectAgent.annotations |
Advanced | Introduced in version: 1.5.0
Default value: None Optional key/value map used to annotate pods. For more information, see Custom annotations. |
connectAgent.gsa |
Advanced | Introduced in version: 1.10.0
Default value: None Helm only: The email address of the Google IAM service account (GSA) for
connectAgent to associate with the corresponding Kubernetes service account when enabling Workload
Identity on GKE clusters using Helm charts. Set this when you have set
GSA email addresses typically have the format of: GSA_NAME@PROJECT_ID.iam.gserviceaccount.com For example: apigee-mart@my-hybrid-project.iam.gserviceaccount.com See Enabling Workload Identity on GKE or Enabling Workload Identity Federation on AKS and EKS. |
connectAgent.logLevel |
Advanced | Introduced in version: 1.2.0
Default value: The level of log reporting. Values can be:
|
connectAgent.image.pullPolicy |
Advanced | Introduced in version: 1.2.0
Default value: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, see Updating images. |
connectAgent.image.tag |
Advanced | Introduced in version: 1.2.0
Default value: The version label for this service's Docker image. |
connectAgent.image.url |
Advanced | Introduced in version: 1.2.0
Default value: None The location of the Docker image for this service. Use |
connectAgent.replicaCountMax |
Basic | Introduced in version: 1.2.0
Default value: Maximum number of replicas available for autoscaling. |
connectAgent.replicaCountMin |
Basic | Introduced in version: 1.2.0
Default value: Minimum number of replicas available for autoscaling. In production, you may want to increase |
connectAgent.resources.limits.cpu |
Advanced | Introduced in version: 1.11.0
Default value: The CPU limit for the resource in a Kubernetes container, in millicores. |
connectAgent.resources.limits.memory |
Advanced | Introduced in version: 1.11.0
Default value: The memory limit for the resource in a Kubernetes container, in mebibytes. |
connectAgent.resources.requests.cpu |
Advanced | Introduced in version: 1.11.0
Default value: The CPU needed for normal operation of the resource in a Kubernetes container, in millicores. |
connectAgent.resources.requests.memory |
Advanced | Introduced in version: 1.2.0
Default value: The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes. |
connectAgent.server |
Advanced | Introduced in version: 1.2.0
Default value: The location of the server and port for this service. |
connectAgent.serviceAccountPath |
Basic | Introduced in version: 1.1.1
Default value: None One of either
Path to Google Service Account key file for the
In most installations, the value of |
connectAgent.serviceAccountRef |
Basic | Introduced in version: 1.2.0
Default value: None One of either
In most installations, the value of |
connectAgent.targetCPUUtilizationPercentage |
Advanced | Introduced in version: 1.2.0
Default value: Target CPU utilization for the Apigee Connect agent on the pod. The
value of this field enables Apigee Connect to auto-scale when CPU utilization
reaches this value, up to |
connectAgent.terminationGracePeriodSeconds |
Advanced | Introduced in version: 1.2.0
Default value: The time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully. |
connectAgent.tolerations.effect |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
connectAgent.tolerations.key |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
connectAgent.tolerations.operator |
Advanced | Introduced in version: 1.10.1
Default value: Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
connectAgent.tolerations.tolerationSeconds |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
connectAgent.tolerations.value |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
defaults
The Default encryption keys for the Apigee hybrid installation.
The following table describes the properties of the defaults
object:
Property | Type | Description |
---|---|---|
defaults.org.kmsEncryptionKey |
Basic | Introduced in version: 1.0.0
Default value: Default encryption key for the org in KMS. |
defaults.org.kvmEncryptionKey |
Basic | Introduced in version: 1.0.0
Default value: Default encryption key for the org in KVM. |
defaults.env.kmsEncryptionKey |
Basic | Introduced in version: 1.0.0
Default value: Default encryption key for the environment (env) in KMS. |
defaults.env.kvmEncryptionKey |
Basic | Introduced in version: 1.0.0
Default value: Default encryption key for the environment (env) in KVM. |
defaults.env.cacheEncryptionKey |
Basic | Introduced in version: 1.0.0
Default value: Default cache encryption key for the environment (env). |
diagnostic
The settings for the Diagnostic collector tool.
See Using the Diagnostic collector
The following table describes the properties of the diagnostic
object:
Property | Type | Description |
---|---|---|
diagnostic.bucket |
Basic | Introduced in version: 1.6.0
Default value: None Required The name of the Google Cloud storage bucket where your diagnostic data will be deposited. |
diagnostic.container |
Basic | Introduced in version: 1.6.0
Default value: None Required This specifies which type of pod you are capturing data from. The values can be one of:
|
diagnostic.loggingDetails.logDuration |
Basic | Introduced in version: 1.6.0
Default value: None Required if the diagnostic collection operation is "LOGGING"
(set with The duration in milliseconds of the log data collected. A typical value is |
diagnostic.loggingDetails.loggerNames[] |
Basic | Introduced in version: 1.6.0
Default value: None Required if the diagnostic collection operation is "LOGGING"
(set with Specifies by name which loggers to collect data from. For Apigee hybrid version 1.6.0,
the only value supported is diagnostic: loggingDetails: loggerNames: - ALL |
diagnostic.loggingDetails.logLevel |
Basic | Introduced in version: 1.6.0
Default value: None Required if the diagnostic collection operation is "LOGGING"
(set with Specifies the granularity of the logging data to collect. In Apigee hybrid 1.6, Only
|
diagnostic.namespace |
Basic | Introduced in version: 1.6.0
Default value: None Required The Kubernetes namespace in which the pods you are collecting data on reside. The namespace
must be the correct one for the container you specify with
|
diagnostic.operation |
Basic | Introduced in version: 1.6.0
Default value: None Required Specifies whether to collect all statistics or just logs. Values are:
|
diagnostic.podNames[] |
Basic | Introduced in version: 1.6.0
Default value: None Required The names of the Kubernetes pods for which you are collecting data. For example: diagnostic: podNames: - apigee-runtime-eng-hybrid-example-3b2ebf3-150-8vfoj-2wcjn - apigee-runtime-eng-hybrid-example-3b2ebf3-150-8vfoj-6xzn2 |
diagnostic.serviceAccountPath |
Basic | Introduced in version: 1.6.0
Default value: None Required The path to a service account key file ( |
diagnostic.tcpDumpDetails.maxMsgs |
Basic | Introduced in version: 1.6.0
Default value: None One of either
Sets the maximum number of |
diagnostic.tcpDumpDetails.timeoutInSeconds |
Basic | Introduced in version: 1.6.0
Default value: None One of either
Sets the amount of time in seconds to wait for |
diagnostic.threadDumpDetails.delayInSeconds |
Basic | Introduced in version: 1.6.0
Default value: None Both
The delay in seconds between collecting each thread dump. |
diagnostic.threadDumpDetails.iterations |
Basic | Introduced in version: 1.6.0
Default value: None Both
The number of jstack thread dump iterations to collect. |
envs
Defines an array of environments to which you can deploy your API proxies. Each environment provides an isolated context or sandbox for running API proxies.
Your hybrid-enabled organization must have at least one environment.
For more information, see About environments.
The following table describes the properties of the envs
object:
Property | Type | Description |
---|---|---|
envs[].cacheEncryptionKey |
Basic | Introduced in version: 1.0.0
Default value: None One of either A base64-encoded encryption key. See Data encryption. |
envs[].cacheEncryptionPath |
Basic | Introduced in version: 1.2.0
Default value: None One of either The path to a file containing a base64-encoded encryption key. See Data encryption. |
envs[].cacheEncryptionSecret.key |
Basic | Introduced in version: 1.2.0
Default value: None One of either The key of a Kubernetes secret containing a base64-encoded encryption key. See Data encryption. |
envs[].cacheEncryptionSecret.name |
Basic | Introduced in version: 1.2.0
Default value: None One of either The name of a Kubernetes secret containing a base64-encoded encryption key. See Data encryption. |
envs[].components.runtime.replicaCountMax |
Basic | Introduced in version: 1.9.3
Default value: 4 Maximum number of replicas for autoscaling. Overrides
|
envs[].components.runtime.replicaCountMin |
Basic | Introduced in version: 1.9.3
Default value: 1 Minimum number of replicas for autoscaling. Overrides
|
envs[].components.synchronizer.replicaCountMax |
Basic | Introduced in version: 1.9.3
Default value: 4 Maximum number of replicas for autoscaling. Overrides
|
envs[].components.synchronizer.replicaCountMin |
Basic | Introduced in version: 1.9.3
Default value: 1 Minimum number of replicas for autoscaling. Overrides
|
envs[].components.udca.replicaCountMax |
Basic | Introduced in version: 1.9.3
Default value: 4 Maximum number of replicas for autoscaling. Overrides
|
envs[].components.udca.replicaCountMin |
Basic | Introduced in version: 1.9.3
Default value: 1 Minimum number of replicas for autoscaling. Overrides
|
envs.gsa.runtime |
Advanced | Introduced in version: 1.10.0
Default value: None Helm only: The email address of the runtime Google IAM service account to associate with the corresponding Kubernetes service account when enabling Workload Identity on GKE clusters using Helm charts. See Enabling Workload Identity on GKE or Enabling Workload Identity Federation on AKS and EKS. |
envs.gsa.synchronizer |
Advanced | Introduced in version: 1.10.0
Default value: None Helm only: The email address of the synchronizer Google IAM service account to associate with the corresponding Kubernetes service account when enabling Workload Identity on GKE clusters using Helm charts. See Enabling Workload Identity on GKE or Enabling Workload Identity Federation on AKS and EKS. |
envs.gsa.udca |
Advanced | Introduced in version: 1.10.0
Default value: None Helm only: The email address of the udca Google IAM service account for env-scoped udca to associate with the corresponding Kubernetes service account when enabling Workload Identity on GKE clusters using Helm charts. See Enabling Workload Identity on GKE or Enabling Workload Identity Federation on AKS and EKS. |
envs[].hostAliases[] |
Basic | Introduced in version: 1.2.0
Default value: None Deprecated: Starting in Hybrid version 1.4 the runtime plane receives this information from the management plane. See About environments and environment groups. |
envs[].httpProxy.host |
Basic | Introduced in version: 1.2.0
Default value: None Specifies the host name or IP address where the HTTP proxy is running. List envs: - name: test httpProxy: scheme: HTTP host: 10.12.0.47 port: 3128 ... See also: Configure forward proxying for API proxies. |
envs[].httpProxy.port |
Basic | Introduced in version: 1.2.0
Default value: None Specifies the port on which the HTTP proxy is running. If this property is omitted, by
default it uses port |
envs[].httpProxy.scheme |
Basic | Introduced in version: 1.2.0
Default value: None Specifies the type of the HTTP proxy as HTTP or HTTPS. By default, it uses "HTTP". |
envs[].httpProxy.username |
Basic | Introduced in version: 1.2.0
Default value: None If the HTTP proxy requires basic authentication, then use this property to provide a username. |
envs[].httpProxy.password |
Basic | Introduced in version: 1.2.0
Default value: None If the HTTP proxy requires basic authentication, then use this property to provide a password. |
envs[].name |
Basic | Introduced in version: 1.0.0
Default value: None Required Apigee environment name to be synchronized. |
envs[].pollInterval |
Advanced | Introduced in version: 1.0.0
Default value: None Interval used for polling organization and environment synchronization changes, in seconds. |
envs[].port |
Advanced | Introduced in version: 1.0.0
Default value: None TCP port number for HTTPS traffic. |
envs[].serviceAccountPaths.runtime |
Basic | Introduced in version: 1.4.0
Default value: None Path to file on local system to a Google Service Account key with
the Cloud Trace Agent role, usually the
|
envs[].serviceAccountPaths.synchronizer |
Basic | Introduced in version: 1.0
Default value: None Path to file on local system to a Google Service Account key with the Apigee Synchronizer Manager role. |
envs[].serviceAccountPaths.udca |
Basic | Introduced in version: 1.0
Default value: None Path to file on local system to a Google Service Account key with the Apigee Analytic Agent role. Only set this property if |
envs[].serviceAccountSecretProviderClass |
Advanced | Introduced in version: 1.12.0
Default value: None The name of the environment-specific secret provider class ( |
envs[].serviceAccountSecretRefs.runtime |
Basic | Introduced in version: 1.4.0
Default value: None The name of a Kubernetes secret. You must create the secret using a Google Service Account key with the Cloud Trace Agent role as its input. |
envs[].serviceAccountSecretRefs.synchronizer |
Basic | Introduced in version: 1.2.0
Default value: None The name of a Kubernetes secret. You must create the secret using a Google Service Account key with the Apigee Synchronizer Manager role as its input. |
envs[].serviceAccountSecretRefs.udca |
Basic | Introduced in version: 1.2.0
Default value: None The name of a Kubernetes secret. You must create the secret using a Google Service Account key with the Apigee Analytic Agent role as its input. Only set this property if |
envs[].sslCertPath |
Basic | Introduced in version: 1.2.0
Default value: None Either
The path on your system to a TLS certificate file. |
envs[].sslKeyPath |
Basic | Introduced in version: 1.2.0
Default value: None Either
The path on your system to the TLS private key file. |
envs[].sslSecret |
Basic | Introduced in version: 1.2.0
Default value: None Either
The name of a file stored in a Kubernetes secret that contains the TLS certificate and private key. You must create the secret using the TLS certificate and key data as its input. See also:
|
gcp
Identifies the Google Cloud project ID and region where the apigee-logger
and the apigee-metrics
push their data.
The following table describes the properties of the gcp
object:
Property | Type | Description |
---|---|---|
gcp.federatedWorkloadIdentity.audience |
Basic | Introduced in version: 1.12.0
Default value: None The allowed audience of the Workload Identity Provider on non-GKE platforms. |
gcp.federatedWorkloadIdentity.credentialSourceFile |
Basic | Introduced in version: 1.12.0
Default value: None The filename and path to the credential source file used by Workload Identity Federation to obtain the credentials for the service accounts. This is the value you provide for |
gcp.federatedWorkloadIdentity.enabled |
Basic | Introduced in version: 1.12.0
Default value: Enables Workload Identity Federation on non-GKE platforms. Must not be set |
gcp.projectID |
Basic | Introduced in version: 1.2.0
Default value: None Required Identifies the Google Cloud project where |
gcp.projectIDRuntime |
Basic | Introduced in version: 1.2.0
Default value: None Identifies the runtime Kubernetes cluster project. The |
gcp.region |
Basic | Introduced in version: 1.2.0
Default value: Required Identifies the Google Cloud region
where the |
gcp.workloadIdentity.enabled |
Basic | Introduced in version: 1.10.0
Default value: Helm only: Enables using Workload Identity on GKE. Workload Identity allows workloads in your GKE clusters to impersonate Identity and Access Management (IAM) service accounts to access Google Cloud services. Must not be set When When |
gcp.workloadIdentity.gsa |
Advanced | Introduced in version: 1.10.0
Default value: None Helm only: The email address of the Google IAM service account (GSA) for all
components to associate with the corresponding Kubernetes service account when enabling
Workload Identity on GKE clusters using Helm charts. Set this when you have set
GSA email addresses typically have the format of: GSA_NAME@PROJECT_ID.iam.gserviceaccount.com For example: apigee-non-prod@my-hybrid-project.iam.gserviceaccount.com |
gcp.workloadIdentityEnabled |
Basic | Introduced in version: 1.4.0
Default value:
When When
|
httpProxy
httpProxy
provides configuration parameters for an HTTP forward proxy server. When
configured in overrides.yaml
, all internet communication for the Logger, MART, Metrics, Synchronizer, and UDCA
components pass through the proxy server.
See also: logger, mart, metrics, synchronizer, and udca.
The following table describes the properties of the httpProxy
object:
Property | Type | Description |
---|---|---|
httpProxy.host |
Basic | Introduced in version: 1.1.1
Default value: None The hostname of the HTTP Proxy. |
httpProxy.port |
Basic | Introduced in version: 1.1.1
Default value: None The port of the HTTP Proxy. |
httpProxy.scheme |
Basic | Introduced in version: 1.1.1
Default value: The scheme used by the proxy. Values can be |
httpProxy.username |
Basic | Introduced in version: 1.1.1
Default value: None If the HTTP proxy requires basic authentication, then use this property to provide a username. |
httpProxy.password |
Basic | Introduced in version: 1.1.1
Default value: None If the HTTP proxy requires basic authentication, then use this property to provide a password. |
ingressGateways
Configures each individual instance of the Apigee ingress gateway. Use these properties when you want
to manage individual instances separately by
ingressGateways[].name
.
See apigeeIngressGateway
to apply common
configuration across all instances of the Apigee ingress gateway.
Apply changes to ingressGateways
properties with the apigee-org
chart.
The following table describes the properties of the ingressGateways
object:
Property | Type | Description |
---|---|---|
ingressGateways[].name |
Basic | Introduced in version: 1.8.0
Default value: None Required The name of ingress gateway. Other services will use this name to address traffic to the gateway. The name must meet the following requirements:
For more information, see DNS Subdomain Names in the Kubernetes documentation. |
ingressGateways[].resources.limits.cpu |
Advanced | Introduced in version: 1.8.0
Default value: The CPU limit for the resource, in millicores. |
ingressGateways[].resources.limits.memory |
Advanced | Introduced in version: 1.8.0
Default value: The memory limit for the resource, in mebibytes. |
ingressGateways[].resources.requests.cpu |
Advanced | Introduced in version: 1.8.0
Default value: The CPU needed for normal operation of the resource, in millicores. |
ingressGateways[].resources.requests.memory |
Advanced | Introduced in version: 1.8.0
Default value: The memory needed for normal operation of the resource, in mebibytes. |
ingressGateways[].replicaCountMax |
Basic | Introduced in version: 1.8.0
Default value: The maximum number of pods that hybrid can automatically add for the ingress gateway available for autoscaling. |
ingressGateways[].replicaCountMin |
Basic | Introduced in version: 1.8.0
Default value: The minimum number of pods for the ingress gateway available for autoscaling. |
ingressGateways[].svcAnnotations |
Basic | Introduced in version: 1.8.0
Default value: None Optional key/value map used to annotate the ingress gateway on platforms that support annotation. For example: ingressGateways: svcAnnotations: networking.gke.io/load-balancer-type: "Internal" |
ingressGateways[].svcLoadBalancerIP |
Basic | Introduced in version: 1.8.0
Default value: None On platforms that support specifying the load balancer IP address, the load balancer will be created with this IP address. On platforms that do not allow you to specify the load balancer IP address, this property is ignored. |
ingressGateways[].svcType |
Basic | Introduced in version: 1.8.1
Default value: LoadBalancer Used to change the type of the default k8s service for ingress deployment.
Set the value to
|
ingressGateways[].targetCPUUtilizationPercentage |
Advanced | Introduced in version: 1.10.5, 1.11.2, 1.12.1
Default value: The threshold of CPU usage for scaling the number of pods in the ReplicaSet, as a percentage of total available CPU resources. When CPU usage goes above this value, then hybrid will gradually
increase the number of pods in the ReplicaSet, up to
For more information on scaling in Kubernetes, see Horizontal Pod Autoscaling in the Kubernetes documentation. |
ingressGateways[].tolerations.effect |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
ingressGateways[].tolerations.key |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
ingressGateways[].tolerations.operator |
Advanced | Introduced in version: 1.10.1
Default value: Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
ingressGateways[].tolerations.tolerationSeconds |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
ingressGateways[].tolerations.value |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
istiod
Configures the Apigee ingress.
The following table describes the properties of the istiod
object:
Property | Type | Description |
---|---|---|
istiod.accessLogFile |
Advanced | Introduced in version: 1.8.0
Default value: The file address for the ingress access log, for example Leaving this value undefined disables access logging. |
istiod.accessLogFormat |
Advanced | Introduced in version: 1.8.0
The format for the ingress access log. Leaving this value undefined results in using the proxy's default access log format. Default access log format: '{"start_time":"%START_TIME%","remote_address":"%DOWNSTREAM_DIRECT_REMOTE_ADDRESS%","user_agent":"%REQ(USER-AGENT)%","host":"%REQ(:AUTHORITY)%","request":"%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%","request_time":"%DURATION%","status":"%RESPONSE_CODE%","status_details":"%RESPONSE_CODE_DETAILS%","bytes_received":"%BYTES_RECEIVED%","bytes_sent":"%BYTES_SENT%","upstream_address":"%UPSTREAM_HOST%","upstream_response_flags":"%RESPONSE_FLAGS%","upstream_response_time":"%RESPONSE_DURATION%","upstream_service_time":"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%","upstream_cluster":"%UPSTREAM_CLUSTER%","x_forwarded_for":"%REQ(X-FORWARDED-FOR)%","request_method":"%REQ(:METHOD)%","request_path":"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%","request_protocol":"%PROTOCOL%","tls_protocol":"%DOWNSTREAM_TLS_VERSION%","request_id":"%REQ(X-REQUEST-ID)%","sni_host":"%REQUESTED_SERVER_NAME%","apigee_dynamic_data":"%DYNAMIC_METADATA(envoy.lua)%"}' The following is a copy of the default access log format with line breaks added for readability. '{"start_time":"%START_TIME%", "remote_address":"%DOWNSTREAM_DIRECT_REMOTE_ADDRESS%", "user_agent":"%REQ(USER-AGENT)%", "host":"%REQ(:AUTHORITY)%", "request":"%REQ(:METHOD)% %REQ(X-ENVOY-ORIGINAL-PATH?:PATH)% %PROTOCOL%", "request_time":"%DURATION%", "status":"%RESPONSE_CODE%", "status_details":"%RESPONSE_CODE_DETAILS%", "bytes_received":"%BYTES_RECEIVED%", "bytes_sent":"%BYTES_SENT%", "upstream_address":"%UPSTREAM_HOST%", "upstream_response_flags":"%RESPONSE_FLAGS%", "upstream_response_time":"%RESPONSE_DURATION%", "upstream_service_time":"%RESP(X-ENVOY-UPSTREAM-SERVICE-TIME)%", "upstream_cluster":"%UPSTREAM_CLUSTER%", "x_forwarded_for":"%REQ(X-FORWARDED-FOR)%", "request_method":"%REQ(:METHOD)%", "request_path":"%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%", "request_protocol":"%PROTOCOL%", "tls_protocol":"%DOWNSTREAM_TLS_VERSION%", "request_id":"%REQ(X-REQUEST-ID)%", "sni_host":"%REQUESTED_SERVER_NAME%", "apigee_dynamic_data":"%DYNAMIC_METADATA(envoy.lua)%"}' |
istiod.forwardClientCertDetails |
Advanced | Introduced in version: 1.9.2
Default value: Determines how the Envoy proxy (for the Apigee ingress gateway) handles the
Possible values are:
For more information on these values, see the Envoy documentation for Enum extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.ForwardClientCertDetails. If you change this setting after installing Hybrid, apply it with |
istiod.image.pullPolicy |
Advanced | Introduced in version: 1.8.0
Default value: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, see Updating images. |
istiod.image.tag |
Advanced | Introduced in version: 1.8.0
Default value: The version label for this service's Docker image. |
istiod.image.url |
Advanced | Introduced in version: 1.8.0
Default value: None The location of the Docker image for this service. Use |
istiod.tolerations.effect |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
istiod.tolerations.key |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
istiod.tolerations.operator |
Advanced | Introduced in version: 1.10.1
Default value: Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
istiod.tolerations.tolerationSeconds |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
istiod.tolerations.value |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
k8sCluster
Identifies Kubernetes cluster where the hybrid runtime is installed.
The following table describes the properties of the k8sCluster
object:
Property | Type | Description |
---|---|---|
k8sCluster.name |
Basic | Introduced in version: 1.2.0
Default value: None The name of the Kubernetes cluster where the hybrid runtime is installed. |
k8sCluster.region |
Basic | Introduced in version: 1.2.0
Default value: None Identifies the Google Cloud region in which your Kubernetes cluster was created. |
kubeRBACProxy
Identifies where Apigee should look for Kubernetes role-based access controls.
The following table describes the properties of the kubeRBACProxy
object:
Property | Type | Description |
---|---|---|
kubeRBACProxy.image.pullPolicy |
Advanced | Introduced in version: 1.2.0
Default value: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, see Updating images. |
kubeRBACProxy.image.tag |
Advanced | Introduced in version: 1.2.0
Default value: The version label for this service's Docker image. |
kubeRBACProxy.image.url |
Advanced | Introduced in version: 1.2.0
Default value: None The location of the Docker image for this service. Use |
kubeRBACProxy.resources.limits.cpu |
Advanced | Introduced in version: 1.11.0
Default value: The CPU limit for the resource in a Kubernetes container, in millicores. |
kubeRBACProxy.resources.limits.memory |
Advanced | Introduced in version: 1.11.0
Default value: The memory limit for the resource in a Kubernetes container, in mebibytes. |
kubeRBACProxy.resources.requests.cpu |
Advanced | Introduced in version: 1.11.0
Default value: The CPU needed for normal operation of the resource in a Kubernetes container, in millicores. |
kubeRBACProxy.resources.requests.memory |
Advanced | Introduced in version: 1.11.0
Default value: The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes. |
logger
Defines the service that manages operational logs. All of the Apigee hybrid services that run in your Kubernetes cluster output this information.
For more information, see Logging overview.
The following table describes the properties of the logger
object:
Property | Type | Description |
---|---|---|
logger.annotations |
Advanced | Introduced in version: 1.5.0
Default value: None Optional key/value map used to annotate pods. For more information, see Custom annotations. |
logger.bufferChunkSize |
Advanced | Introduced in version: 1.12.0
Default value: 256k The initial buffer size to read log files. |
logger.bufferMaxSize |
Advanced | Introduced in version: 1.12.0
Default value: 104857600 The limit of the buffer size per monitored file. Files exceeding this limit are removed from the monitored file list. |
logger.bufferMemoryLimit |
Advanced | Introduced in version: 1.12.0
Default value: 150MB The limit of memory that logger can consumed. If reach, the logger will momentarily pause reading more data until the existing data is flushed in memory. |
logger.enabled |
Basic | Introduced in version: 1.0.0
Default value: Enables or disables logging on the cluster. For non-GKE set to |
logger.envVars |
Basic | Introduced in version: 1.8.5
Default value: None Allows you to include the logger: ... envVars: NO_PROXY: '<comma-separated-values>' for example: envVars: NO_PROXY: 'kubernetes.default.svc,oauth2.googleapis.com,logging.googleapis.com' Use See NO_PROXY in the Fluent Bit documentation. |
logger.flushInterval |
Advanced | Introduced in version: 1.12.0
Default value: 1 The interval to wait before invoking the next buffer flushed, in seconds. |
logger.gsa |
Advanced | Introduced in version: 1.10.0
Default value: None Helm only: The email address of the GSA email addresses typically have the format of: GSA_NAME@PROJECT_ID.iam.gserviceaccount.com For example: apigee-logger@my-hybrid-project.iam.gserviceaccount.com See Enabling Workload Identity on GKE or Enabling Workload Identity Federation on AKS and EKS. |
logger.image.pullPolicy |
Advanced | Introduced in version: 1.0.0
Default value: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, see Updating images. |
logger.image.tag |
Advanced | Introduced in version: 1.0.0
Default value: The version label for this service's Docker image. |
logger.image.url |
Advanced | Introduced in version: 1.0.0
Default value: None The location of the Docker image for this service. Use |
logger.livenessProbe.failureThreshold |
Advanced | Introduced in version: 1.0.0
Default value: The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1. |
logger.livenessProbe.initialDelaySeconds |
Advanced | Introduced in version: 1.0.0
Default value: The number of seconds after a container is started before a liveness probe is initiated. |
logger.livenessProbe.periodSeconds |
Advanced | Introduced in version: 1.0.0
Default value: Determines how often to perform a liveness probe, in seconds. The minimum value is 1. |
logger.livenessProbe.successThreshold |
Advanced | Introduced in version: 1.0.0
Default value: The minimum consecutive successes needed for a liveness probe to be considered successful after a failure. The minimum value is 1. |
logger.livenessProbe.timeoutSeconds |
Advanced | Introduced in version: 1.0.0
Default value: The number of seconds after which a liveness probe times out. The minimum value is 1. |
logger.nodeSelector.key |
Basic | Introduced in version: 1.0.0
Default value: Required Node selector label key used to target dedicated Kubernetes nodes for |
logger.nodeSelector.value |
Basic | Introduced in version: 1.0.0
Default value: Required Node selector label value used to target dedicated Kubernetes nodes for |
logger.resources.limits.cpu |
Advanced | Introduced in version: 1.0.0
Default value: The CPU limit for the resource in a Kubernetes container, in millicores. |
logger.resources.limits.memory |
Advanced | Introduced in version: 1.0.0
Default value: The memory limit for the resource in a Kubernetes container, in mebibytes. |
logger.resources.requests.cpu |
Advanced | Introduced in version: 1.0.0
Default value: The CPU needed for normal operation of the resource in a Kubernetes container, in millicores. |
logger.resources.requests.memory |
Advanced | Introduced in version: 1.0.0
Default value: The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes. |
logger.serviceAccountPath |
Basic | Introduced in version: 1.0.0
Default value: None One of either Path to Google Service Account key file with Logs Writer role. |
logger.serviceAccountRef |
Basic | Introduced in version: 1.2.0
Default value: None One of either |
logger.storageMaxChunks |
Advanced | Introduced in version: 1.12.0
Default value: 128 The maximum number of chunks that can be up in memory. Chunks exceeding the limit will be saved in the file system. |
logger.terminationGracePeriodSeconds |
Advanced | Introduced in version: 1.0.0
Default value: The time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully. |
logger.tolerations.effect |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
logger.tolerations.key |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
logger.tolerations.operator |
Advanced | Introduced in version: 1.10.1
Default value: Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
logger.tolerations.tolerationSeconds |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
logger.tolerations.value |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
mart
Defines the MART (Management API for RunTime data) service, which acts as an API provider for public Apigee APIs so that you can access and manage runtime data entities such as KMS (API Keys and OAuth tokens), KVM, Quota, and API products.
The following table describes the properties of the mart
object:
Property | Type | Description |
---|---|---|
mart.annotations |
Advanced | Introduced in version: 1.5.0
Default value: None Optional key/value map used to annotate pods. For more information, see Custom annotations. |
mart.gsa |
Advanced | Introduced in version: 1.10.0
Default value: None Helm only: The email address of the GSA email addresses typically have the format of: GSA_NAME@PROJECT_ID.iam.gserviceaccount.com For example: apigee-mart@my-hybrid-project.iam.gserviceaccount.com See Enabling Workload Identity on GKE or Enabling Workload Identity Federation on AKS and EKS. |
mart.hostAlias |
Basic | Introduced in version: 1.0.0
Default value: None The host alias pointing to the MART object. You can set this property to |
mart.image.pullPolicy |
Advanced | Introduced in version: 1.0.0
Default value: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, see Updating images. |
mart.image.tag |
Advanced | Introduced in version: 1.0.0
Default value: The version label for this service's Docker image. |
mart.image.url |
Advanced | Introduced in version: 1.0.0
Default value: None The location of the Docker image for this service. Use |
mart.initCheckCF.resources.requests.cpu |
Advanced | Introduced in version: 1.0.0
Default value: The amount of CPU resources allocated to the initialization check of the Cloud Foundry process. |
mart.livenessProbe.failureThreshold |
Advanced | Introduced in version: 1.0.0
Default value: The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1. |
mart.livenessProbe.initialDelaySeconds |
Advanced | Introduced in version: 1.0.0
Default value: The number of seconds after a container is started before a liveness probe is initiated. |
mart.livenessProbe.periodSeconds |
Advanced | Introduced in version: 1.0.0
Default value: Determines how often to perform a liveness probe, in seconds. The minimum value is 1. |
mart.livenessProbe.timeoutSeconds |
Advanced | Introduced in version: 1.0.0
Default value: The number of seconds after which a liveness probe times out. The minimum value is 1. |
mart.metricsURL |
Basic | Introduced in version: 1.0.0
Default value: |
mart.nodeSelector.key |
Basic | Introduced in version: 1.0.0
Default value: None Optional node selector label key for targeting Kubernetes nodes for |
mart.nodeSelector.value |
Basic | Introduced in version: 1.0.0
Default value: None Optional node selector label value for targeting Kubernetes nodes for |
mart.readinessProbe.failureThreshold |
Advanced | Introduced in version: 1.0.0
Default value: The number of times Kubernetes will verify that readiness probes have failed before marking the pod unready. The minimum value is 1. |
mart.readinessProbe.initialDelaySeconds |
Advanced | Introduced in version: 1.0.0
Default value: The number of seconds after a container is started before a readiness probe is initiated. |
mart.readinessProbe.periodSeconds |
Advanced | Introduced in version: 1.0.0
Default value: Determines how often to perform a readiness probe, in seconds. The minimum value is 1. |
mart.readinessProbe.successThreshold |
Advanced | Introduced in version: 1.0.0
Default value: The minimum consecutive successes needed for a readiness probe to be considered successful after a failure. The minimum value is 1. |
mart.readinessProbe.timeoutSeconds |
Advanced | Introduced in version: 1.0.0
Default value: The number of seconds after which a liveness probe times out. The minimum value is 1. |
mart.replicaCountMax |
Basic | Introduced in version: 1.0.0
Default value: Maximum number of replicas available for autoscaling. |
mart.replicaCountMin |
Basic | Introduced in version: 1.0.0
Default value: Minimum number of replicas available for autoscaling. |
mart.resources.limits.cpu |
Advanced | Introduced in version: 1.11.0
Default value: The CPU limit for the resource in a Kubernetes container, in millicores. |
mart.resources.limits.memory |
Advanced | Introduced in version: 1.11.0
Default value: The memory limit for the resource in a Kubernetes container, in mebibytes. |
mart.resources.requests.cpu |
Advanced | Introduced in version: 1.0.0
Default value: The CPU needed for normal operation of the resource in a Kubernetes container, in millicores. |
mart.resources.requests.memory |
Advanced | Introduced in version: 1.0.0
Default value: The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes. |
mart.serviceAccountPath |
Basic | Introduced in version: 1.1.1
Default value: None One of either Path to Google Service Account key file with no role. |
mart.serviceAccountRef |
Basic | Introduced in version: 1.2.0
Default value: None One of either |
mart.sslCertPath |
Basic | Introduced in version: 1.0.0
Default value: None Either Local file system path for loading and encoding the SSL cert to a Secret. |
mart.sslKeyPath |
Basic | Introduced in version: 1.0.0
Default value: None Either Local file system path for loading and encoding the SSL key to a Secret. |
mart.sslSecret |
Basic | Introduced in version: 1.2.0
Default value: None Either The name of a file stored in a Kubernetes secret that contains the TLS certificate and private key. You must create the secret using the TLS certificate and key data as its input. See also:
|
mart.targetCPUUtilizationPercentage |
Advanced | Introduced in version: 1.0.0
Default value: Target CPU utilization for the MART process on the pod. The
value of this field enables MART to auto-scale when CPU utilization
reaches this value, up to |
mart.terminationGracePeriodSeconds |
Advanced | Introduced in version: 1.0.0
Default value: The time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully. |
mart.tolerations.effect |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
mart.tolerations.key |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
mart.tolerations.operator |
Advanced | Introduced in version: 1.10.1
Default value: Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
mart.tolerations.tolerationSeconds |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
mart.tolerations.value |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
metrics
Defines the service that collects operations metrics. You can use metrics data to monitor the health of Hybrid services, to set up alerts, and so on.
For more information, see Metrics collection overview.
The following table describes the properties of the metrics
object:
Property | Type | Description |
---|---|---|
metrics.adapter.image.pullPolicy |
Advanced | Introduced in version: 1.8.1
Default value: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, see Updating images. |
metrics.adapter.image.tag |
Advanced | Introduced in version: 1.8.1
Default value: The version label for this service's Docker image. |
metrics.adapter.image.url |
Advanced | Introduced in version: 1.8.1
Default value: None The location of the Docker image for this service. Use |
metrics.aggregator.resources.requests.cpu |
Advanced | Introduced in version: 1.4.0
Default value: The CPU needed for normal operation of the aggregator in a Kubernetes container, in millicores. |
metrics.aggregator.resources.requests.memory |
Advanced | Introduced in version: 1.4.0
Default value: The memory needed for normal operation of the aggregator in a Kubernetes container, in mebibytes. |
metrics.aggregator.resources.limits.cpu |
Advanced | Introduced in version: 1.4.0
Default value: The CPU limit for the aggregator resource in a Kubernetes container, in millicores. |
metrics.aggregator.resources.limits.memory |
Advanced | Introduced in version: 1.4.0
Default value: The memory limit for the aggregator resource in a Kubernetes container, in gibibytes. |
metrics.annotations |
Advanced | Introduced in version: 1.5.0
Default value: None Optional key/value map used to annotate pods. For more information, see Custom annotations. |
metrics.app.resources.requests.cpu |
Advanced | Introduced in version: 1.4.0
Default value: The CPU needed for normal operation of the app in a Kubernetes container, in millicores. |
metrics.app.resources.requests.memory |
Advanced | Introduced in version: 1.4.0
Default value: The memory needed for normal operation of the app in a Kubernetes container, in mebibytes. |
metrics.app.resources.limits.cpu |
Advanced | Introduced in version: 1.4.0
Default value: The CPU limit for the app resource in a Kubernetes container, in millicores. |
metrics.app.resources.limits.memory |
Advanced | Introduced in version: 1.4.0
Default value: The memory limit for the app resource in a Kubernetes container, in gibibytes. |
metrics.appStackdriverExporter.resources.requests.cpu |
Advanced | Introduced in version: 1.7.0
Default value: The CPU needed for normal operation of the stackdriverExporter in a Kubernetes container, in millicores. |
metrics.appStackdriverExporter.resources.requests.memory |
Advanced | Introduced in version: 1.7.0
Default value: The memory needed for normal operation of the stackdriverExporter in a Kubernetes container, in mebibytes. |
metrics.appStackdriverExporter.resources.limits.cpu |
Advanced | Introduced in version: 1.7.0
Default value: The CPU limit for the stackdriverExporter resource in a Kubernetes container, in millicores. |
metrics.appStackdriverExporter.resources.limits.memory |
Advanced | Introduced in version: 1.7.0
Default value: The memory limit for the stackdriverExporter resource in a Kubernetes container, in gibibytes. |
metrics.collector.imagePullPolicy |
Advanced | Introduced in version: 1.12.0
Default value: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, see Use a private image repository with Apigee hybrid . |
metrics.collector.image.tag |
Basic | Introduced in version: 1.12.0
Default value: The version label for this service's Docker image. |
metrics.collector.image.url |
Basic | Introduced in version: 1.12.0
Default value: None The location of the Docker image for this service. Use |
metrics.collector.resources.requests.cpu |
Advanced | Introduced in version: 1.12.0
Default value: The CPU needed for normal operation of the app in a Kubernetes container, in millicores. |
metrics.collector.resources.requests.memory |
Advanced | Introduced in version: 1.12.0
Default value: The memory needed for normal operation of the app in a Kubernetes container, in mebibytes. |
metrics.collector.resources.limits.cpu |
Advanced | Introduced in version: 1.12.0
Default value: The CPU limit for the app resource in a Kubernetes container, in millicores. |
metrics.collector.resources.limits.memory |
Advanced | Introduced in version: 1.12.0
Default value: The memory limit for the app resource in a Kubernetes container, in gibibytes. |
metrics.collector.livenessProbe.failureThreshold |
Advanced | Introduced in version: 1.12.0
Default value: The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1. |
metrics.collector.livenessProbe.initialDelaySeconds |
Advanced | Introduced in version: 1.12.0
Default value: The number of seconds after a container is started before a liveness probe is initiated. |
metrics.collector.livenessProbe.periodSeconds |
Advanced | Introduced in version: 1.12.0
Default value: Determines how often to perform a liveness probe, in seconds. The minimum value is 1. |
metrics.collector.livenessProbe.successThreshold |
Advanced | Introduced in version: 1.12.0
Default value: The minimum consecutive successes needed for a liveness probe to be considered successful after a failure. The minimum value is 1. |
metrics.collector.livenessProbe.timeoutSeconds |
Advanced | Introduced in version: 1.12.0
Default value: The number of seconds after which a liveness probe times out. The minimum value is 1. |
metrics.collector.readinessProbe.failureThreshold |
Advanced | Introduced in version: 1.12.0
Default value: The number of times Kubernetes will verify that readiness probes have failed before marking the pod unready. The minimum value is 1. |
metrics.collector.readinessProbe.initialDelaySeconds |
Advanced | Introduced in version: 1.12.0
Default value: The number of seconds after a container is started before a readiness probe is initiated. |
metrics.collector.readinessProbe.periodSeconds |
Advanced | Introduced in version: 1.12.0
Default value: Determines how often to perform a readiness probe, in seconds. The minimum value is 1. |
metrics.collector.readinessProbe.successThreshold |
Advanced | Introduced in version: 1.12.0
Default value: The minimum consecutive successes needed for a readiness probe to be considered successful after a failure. The minimum value is 1. |
metrics.collector.readinessProbe.timeoutSeconds |
Advanced | Introduced in version: 1.12.0
Default value: The number of seconds after which a liveness probe times out. The minimum value is 1. |
metrics.disablePrometheusPipeline |
Basic | Introduced in version: 1.12.0
Default value: Metrics for |
metrics.enabled |
Basic | Introduced in version: 1.0.0
Default value: Enables Apigee metrics. Set to |
metrics.gsa |
Advanced | Introduced in version: 1.10.0
Default value: None Helm only: The email address of the GSA email addresses typically have the format of: GSA_NAME@PROJECT_ID.iam.gserviceaccount.com For example: apigee-metrics@my-hybrid-project.iam.gserviceaccount.com See Enabling Workload Identity on GKE or Enabling Workload Identity Federation on AKS and EKS. |
metrics.nodeSelector.key |
Basic | Introduced in version: 1.0.0
Default value: None Required Node selector label key used to target dedicated Kubernetes nodes for |
metrics.nodeSelector.value |
Basic | Introduced in version: 1.0.0
Default value: None Required Node selector label value used to target dedicated Kubernetes nodes for |
metrics.prometheus.containerPort |
Advanced | Introduced in version: 1.0.0
Default value: The port to connect to the Prometheus metrics service. |
metrics.prometheus.image.pullPolicy |
Advanced | Introduced in version: 1.0.0
Default value: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, see Updating images. |
metrics.prometheus.image.tag |
Advanced | Introduced in version: 1.0.0
Default value: The version label for this service's Docker image. |
metrics.prometheus.image.url |
Advanced | Introduced in version: 1.0.0
Default value: None The location of the Docker image for this service. Use |
metrics.prometheus.livenessProbe.failureThreshold |
Advanced | Introduced in version: 1.0.0
Default value: The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1. |
metrics.prometheus.livenessProbe.periodSeconds |
Advanced | Introduced in version: 1.0.0
Default value: Determines how often to perform a liveness probe, in seconds. The minimum value is 1. |
metrics.prometheus.livenessProbe.timeoutSeconds |
Advanced | Introduced in version: 1.0.0
Default value: The number of seconds after which a liveness probe times out. The minimum value is 1. |
metrics.prometheus.readinessProbe.failureThreshold |
Advanced | Introduced in version: 1.0.0
Default value: The number of times Kubernetes will verify that readiness probes have failed before marking the pod unready. The minimum value is 1. |
metrics.prometheus.readinessProbe.periodSeconds |
Advanced | Introduced in version: 1.0.0
Default value: Determines how often to perform a readiness probe, in seconds. The minimum value is 1. |
metrics.prometheus.readinessProbe.timeoutSeconds |
Advanced | Introduced in version: 1.0.0
Default value: The number of seconds after which a liveness probe times out. The minimum value is 1. |
metrics.prometheus.sslCertPath |
Basic | Introduced in version: 1.0.0
Default value: None Required Path to the SSL cert for the Prometheus metrics collection process. Prometheus is a tool Apigee can use for collecting and processing metrics. See:
|
metrics.prometheus.sslKeyPath |
Basic | Introduced in version: 1.0.0
Default value: None Required Path to the SSL Key for the Prometheus metrics collection process. Prometheus is a tool Apigee can use for collecting and processing metrics. See:
|
metrics.proxy.resources.requests.cpu |
Advanced | Introduced in version: 1.4.0
Default value: The CPU needed for normal operation of the proxy in a Kubernetes container, in millicores. |
metrics.proxy.resources.requests.memory |
Advanced | Introduced in version: 1.4.0
Default value: The memory needed for normal operation of the proxy in a Kubernetes container, in mebibytes. |
metrics.proxy.resources.limits.cpu |
Advanced | Introduced in version: 1.4.0
Default value: The CPU limit for the proxy resource in a Kubernetes container, in millicores. |
metrics.proxy.resources.limits.memory |
Advanced | Introduced in version: 1.4.0
Default value: The memory limit for the proxy resource in a Kubernetes container, in gibibytes. |
metrics.proxyStackdriverExporter.resources.requests.cpu |
Advanced | Introduced in version: 1.7.0
Default value: The CPU needed for normal operation of the stackdriverExporter in a Kubernetes container, in millicores. |
metrics.proxyStackdriverExporter.resources.requests.memory |
Advanced | Introduced in version: 1.7.0
Default value: The memory needed for normal operation of the stackdriverExporter in a Kubernetes container, in mebibytes. |
metrics.proxyStackdriverExporter.resources.limits.cpu |
Advanced | Introduced in version: 1.7.0
Default value: The CPU limit for the stackdriverExporter resource in a Kubernetes container, in millicores. |
metrics.proxyStackdriverExporter.resources.limits.memory |
Advanced | Introduced in version: 1.7.0
Default value: The memory limit for the stackdriverExporter resource in a Kubernetes container, in gibibytes. |
metrics.proxyURL |
Basic | Introduced in version: 1.0.0
Default value: None URL for the metrics process sidecar proxy in the Kubernetes cluster. |
metrics.sdSidecar.containerPort |
Advanced | Introduced in version: 1.0.0
Default value: The port for connecting to the Cloud Monitoring metrics service. |
metrics.sdSidecar.image.pullPolicy |
Advanced | Introduced in version: 1.0.0
Default value: Determines when Kubelet pulls this service's Docker image. Possible values include:
|
metrics.sdSidecar.image.tag |
Advanced | Introduced in version: 1.0.0
Default value: The version label for this service's Docker image. |
metrics.sdSidecar.image.url |
Advanced | Introduced in version: 1.0.0
Default value: None The location of the Docker image for this service. Use |
metrics.serviceAccountPath |
Basic | Introduced in version: 1.0.0
Default value: None One of either Path to Google Service Account key file with Monitoring Metric Writer role. |
metrics.serviceAccountRef |
Basic | Introduced in version: 1.2.0
Default value: None One of either |
metrics.stackdriverExporter.resources.requests.cpu |
Advanced | Introduced in version: 1.4.0
Deprecated: Starting in Hybrid version 1.8, |
metrics.stackdriverExporter.resources.requests.memory |
Advanced | Introduced in version: 1.4.0
Deprecated: Starting in Hybrid version 1.8, |
metrics.stackdriverExporter.resources.limits.cpu |
Advanced | Introduced in version: 1.4.0
Deprecated: Starting in Hybrid version 1.8, |
metrics.stackdriverExporter.resources.limits.memory |
Advanced | Introduced in version: 1.4.0
Deprecated: Starting in Hybrid version 1.8, |
metrics.terminationGracePeriodSeconds |
Advanced | Introduced in version: 1.0.0
Default value: The time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully. |
metrics.tolerations.effect |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
metrics.tolerations.key |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
metrics.tolerations.operator |
Advanced | Introduced in version: 1.10.1
Default value: Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
metrics.tolerations.tolerationSeconds |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
metrics.tolerations.value |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
mintTaskScheduler
mintTaskScheduler
is the cron job to schedule monetization tasks, like recurring fee calculation on a periodic basis.
The following table describes the properties of the mintTaskScheduler
object:
Property | Type | Description |
---|---|---|
mintTaskScheduler.image.pullPolicy |
Advanced | Introduced in version: 1.7.0
Default value: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, see Updating images. |
mintTaskScheduler.image.tag |
Advanced | Introduced in version: 1.7.0
Default value: The version label for this service's Docker image. |
mintTaskScheduler.image.url |
Advanced | Introduced in version: 1.7.0
Default value: None The location of the Docker image for this service. Use |
mintTaskScheduler.resources.limits.cpu |
Advanced | Introduced in version: 1.1.0
Default value: The CPU limit for the resource in a Kubernetes container, in millicores. |
mintTaskScheduler.resources.limits.memory |
Advanced | Introduced in version: 1.1.0
Default value: The memory limit for the resource in a Kubernetes container, in mebibytes. |
mintTaskScheduler.resources.requests.cpu |
Advanced | Introduced in version: 1.7.0
Default value: The CPU needed for normal operation of the resource in a Kubernetes container, in millicores. |
mintTaskScheduler.resources.requests.memory |
Advanced | Introduced in version: 1.7.0
Default value: The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes. |
mintTaskScheduler.tolerations.effect |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
mintTaskScheduler.tolerations.key |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
mintTaskScheduler.tolerations.operator |
Advanced | Introduced in version: 1.10.1
Default value: Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
mintTaskScheduler.tolerations.tolerationSeconds |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
mintTaskScheduler.tolerations.value |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
nodeSelector
The nodeSelector
object defines the node for your Apigee instance. Behind the scenes
Apigee hybrid takes care to map the label key/value for
apigeeRuntime
and apigeeData
to the individual Istio and MART components when you install or upgrade the
apigee-org
and apigee-ingress-manager
charts.
You can override this for individual objects in the mart:nodeSelector property.
The following table describes the properties of the nodeSelector
object:
Property | Type | Description |
---|---|---|
nodeSelector.apigeeData.key |
Advanced | Introduced in version: 1.0.0
Default value: ApigeeData is the node for the Cassandra database. Node selector label key for targeting Kubernetes nodes for working with Apigee services data. |
nodeSelector.apigeeData.value |
Advanced | Introduced in version: 1.0.0
Default value: apigee-data is the node for the Cassandra database. Node selector label value for targeting Kubernetes nodes for working with Apigee services data. |
nodeSelector.apigeeRuntime.key |
Advanced | Introduced in version: 1.0.0
Default value: Apigee Runtime is the node for the runtime environment for the project. Node selector label key for targeting Kubernetes nodes for Apigee runtime services. |
nodeSelector.apigeeRuntime.value |
Advanced | Introduced in version: 1.0.0
Default value:
|
nodeSelector.requiredForScheduling |
Advanced | Introduced in version: 1.0.0
Default value: false The
For production, |
redis
The following table describes the properties of the redis
object:
Property | Type | Description |
---|---|---|
redis.auth.password |
Basic | Introduced in version: 1.6.0
Default value: Required Password for the Redis administrator. The admin user is used for any administrative activities performed on the Redis cluster. |
redis.auth.secret |
Basic | Introduced in version: 1.9.1
Default value: None The name of the file stored in a Kubernetes secret that contains the password for the Redis administrator. The secret file should contain the key: data: redis.auth.password: encoded_value See also:
|
redis.envoy.image.pullPolicy |
Advanced | Introduced in version: 1.6.0
Default value: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, see Updating images. |
redis.envoy.image.tag |
Advanced | Introduced in version: 1.6.0
Default value: The version label for this service's Docker image. |
redis.envoy.image.url |
Advanced | Introduced in version: 1.6.0
Default value: None The location of the Docker image for this service. Use |
redis.image.pullPolicy |
Advanced | Introduced in version: 1.6.0
Default value: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, see Updating images. |
redis.image.tag |
Advanced | Introduced in version: 1.6.0
Default value: The version label for this service's Docker image. |
redis.image.url |
Advanced | Introduced in version: 1.6.0
Default value: None The location of the Docker image for this service. Use |
redis.replicaCount |
Basic | Introduced in version: 1.6.0
Default value: Redis is a replicated storage. This property specifies the number of Redis nodes employed as a StatefulSet. |
redis.resources.requests.cpu |
Advanced | Introduced in version: 1.6.0
Default value: The CPU needed for normal operation of the resource in a Kubernetes container, in millicores. |
redis.tolerations.effect |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
redis.tolerations.key |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
redis.tolerations.operator |
Advanced | Introduced in version: 1.10.1
Default value: Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
redis.tolerations.tolerationSeconds |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
redis.tolerations.value |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
runtime
The following table describes the properties of the runtime
object:
Property | Type | Description |
---|---|---|
runtime.annotations |
Advanced | Introduced in version: 1.5.0
Default value: None Optional key/value map used to annotate pods. For more information, see Custom annotations. |
runtime.image.pullPolicy |
Advanced | Introduced in version: 1.0.0
Default value: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, see Updating images. |
runtime.image.tag |
Advanced | Introduced in version: 1.0.0
Default value: The version label for this service's Docker image. |
runtime.image.url |
Advanced | Introduced in version: 1.0.0
Default value: None The location of the Docker image for this service. Use |
runtime.livenessProbe.failureThreshold |
Advanced | Introduced in version: 1.0.0
Default value: The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1. |
runtime.livenessProbe.initialDelaySeconds |
Advanced | Introduced in version: 1.0.0
Default value: The number of seconds after a container is started before a liveness probe is initiated. |
runtime.livenessProbe.periodSeconds |
Advanced | Introduced in version: 1.0.0
Default value: Determines how often to perform a liveness probe, in seconds. The minimum value is 1. |
runtime.livenessProbe.timeoutSeconds |
Advanced | Introduced in version: 1.0.0
Default value: The number of seconds after which a liveness probe times out. The minimum value is 1. |
runtime.nodeSelector.key |
Basic | Introduced in version: 1.0.0
Default value: None Optional Node selector label key for targeting Kubernetes nodes for |
runtime.nodeSelector.value |
Basic | Introduced in version: 1.0.0
Default value: None Node selector label value for targeting Kubernetes nodes for |
runtime.readinessProbe.failureThreshold |
Advanced | Introduced in version: 1.0.0
Default value: The number of times Kubernetes will verify that readiness probes have failed before marking the pod unready. The minimum value is 1. |
runtime.readinessProbe.initialDelaySeconds |
Advanced | Introduced in version: 1.0.0
Default value: The number of seconds after a container is started before a readiness probe is initiated. |
runtime.readinessProbe.periodSeconds |
Advanced | Introduced in version: 1.0.0
Default value: Determines how often to perform a readiness probe, in seconds. The minimum value is 1. |
runtime.readinessProbe.successThreshold |
Advanced | Introduced in version: 1.0.0
Default value: The minimum consecutive successes needed for a readiness probe to be considered successful after a failure. The minimum value is 1. |
runtime.readinessProbe.timeoutSeconds |
Advanced | Introduced in version: 1.0.0
Default value: The number of seconds after which a liveness probe times out. The minimum value is 1. |
runtime.replicaCountMax |
Basic | Introduced in version: 1.0.0
Default value: Maximum number of replicas available for autoscaling. |
runtime.replicaCountMin |
Basic | Introduced in version: 1.0.0
Default value: Minimum number of replicas available for autoscaling. |
runtime.resources.limits.cpu |
Advanced | Introduced in version: 1.11.0
Default value: The CPU limit for the resource in a Kubernetes container, in millicores. |
runtime.resources.limits.memory |
Advanced | Introduced in version: 1.11.0
Default value: The memory limit for the resource in a Kubernetes container, in mebibytes. |
runtime.resources.requests.cpu |
Advanced | Introduced in version: 1.0.0
Default value: The CPU needed for normal operation of the resource in a Kubernetes container, in millicores. |
runtime.resources.requests.memory |
Advanced | Introduced in version: 1.0.0
Default value: The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes
( |
runtime.service.type |
Advanced | Introduced in version: 1.0.0
Default value: The type of service. You can set this to a service other than ClusterIP; for example,
|
runtime.targetCPUUtilizationPercentage |
Advanced | Introduced in version: 1.0.0
Default value: Target CPU utilization for the runtime process on the pod. The
value of this field enables the runtime to auto-scale when CPU utilization
reaches this value, up to |
runtime.terminationGracePeriodSeconds |
Advanced | Introduced in version: 1.0.0
Default value: The time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully. |
runtime.tolerations.effect |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
runtime.tolerations.key |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
runtime.tolerations.operator |
Advanced | Introduced in version: 1.10.1
Default value: Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
runtime.tolerations.tolerationSeconds |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
runtime.tolerations.value |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
synchronizer
Ensures that the Message Processors are kept up to date with the latest deployed API proxy bundles. To do this, the Synchronizer polls the management plane; when a new contract is detected, the Synchronizer sends it to the runtime plane. By default, Synchronizer stores environment configuration data in Cassandra.
For more information, see Configure the Synchronizer.
The following table describes the properties of the synchronizer
object:
Property | Type | Description |
---|---|---|
synchronizer.annotations |
Advanced | Introduced in version: 1.5.0
Default value: None Optional key/value map used to annotate pods. For more information, see Custom annotations. |
synchronizer.image.pullPolicy |
Advanced | Introduced in version: 1.0.0
Default value: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, see Updating images. |
synchronizer.image.tag |
Advanced | Introduced in version: 1.0.0
Default value: The version label for this service's Docker image. |
synchronizer.image.url |
Advanced | Introduced in version: 1.0.0
Default value: None The location of the Docker image for this service. Use |
synchronizer.livenessProbe.failureThreshold |
Advanced | Introduced in version: 1.0.0
Default value: The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1. |
synchronizer.livenessProbe.initialDelaySeconds |
Advanced | Introduced in version: 1.0.0
Default value: The number of seconds after a container is started before a liveness probe is initiated. |
synchronizer.livenessProbe.periodSeconds |
Advanced | Introduced in version: 1.0.0
Default value: Determines how often to perform a liveness probe, in seconds. The minimum value is 1. |
synchronizer.livenessProbe.timeoutSeconds |
Advanced | Introduced in version: 1.0.0
Default value: The number of seconds after which a liveness probe times out. The minimum value is 1. |
synchronizer.nodeSelector.key |
Basic | Introduced in version: 1.0.0
Default value: None Required Optional node selector label key for targeting Kubernetes nodes for See nodeSelector. |
synchronizer.nodeSelector.value |
Basic | Introduced in version: 1.0.0
Default value: None Optional node selector label value used for targeting Kubernetes nodes for See nodeSelector. |
synchronizer.pollInterval |
Advanced | Introduced in version: 1.0.0
Default value: The length of time that Synchronizer waits between polling operations. Synchronizer polls Apigee control plane services to detect and pull new runtime contracts. |
synchronizer.readinessProbe.failureThreshold |
Advanced | Introduced in version: 1.0.0
Default value: The number of times Kubernetes will verify that readiness probes have failed before marking the pod unready. The minimum value is 1. |
synchronizer.readinessProbe.initialDelaySeconds |
Advanced | Introduced in version: 1.0.0
Default value: The number of seconds after a container is started before a readiness probe is initiated. |
synchronizer.readinessProbe.periodSeconds |
Advanced | Introduced in version: 1.0.0
Default value: Determines how often to perform a readiness probe, in seconds. The minimum value is 1. |
synchronizer.readinessProbe.successThreshold |
Advanced | Introduced in version: 1.0.0
Default value: The minimum consecutive successes needed for a readiness probe to be considered successful after a failure. The minimum value is 1. |
synchronizer.readinessProbe.timeoutSeconds |
Advanced | Introduced in version: 1.0.0
Default value: The number of seconds after which a liveness probe times out. The minimum value is 1. |
synchronizer.replicaCount |
Basic | Introduced in version: 1.0.0
Deprecated: Starting in Hybrid version 1.2, manage the Synchronizer replica
count with:
|
synchronizer.replicaCountMax |
Basic | Introduced in version: 1.2.0
Default value: Maximum number of replicas for autoscaling. |
synchronizer.replicaCountMin |
Basic | Introduced in version: 1.2.0
Default value: Minimum number of replicas for autoscaling. |
synchronizer.resources.limits.cpu |
Advanced | Introduced in version: 1.11.0
Default value: The CPU limit for the resource in a Kubernetes container, in millicores. |
synchronizer.resources.limits.memory |
Advanced | Introduced in version: 1.11.0
Default value: The memory limit for the resource in a Kubernetes container, in mebibytes. |
synchronizer.resources.requests.cpu |
Advanced | Introduced in version: 1.0.0
Default value: The CPU needed for normal operation of the resource in a Kubernetes container, in millicores. |
synchronizer.resources.requests.memory |
Advanced | Introduced in version: 1.0.0
Default value: The memory needed for normal operation of the resource in a Kubernetes container, in gigabytes. |
synchronizer.serviceAccountPath |
Basic | Introduced in version: 1.0.0
Default value: None One of either Path to Google Service Account key file with Apigee Synchronizer Manager role. |
synchronizer.serviceAccountRef |
Basic | Introduced in version: 1.2.0
Default value: None One of either |
synchronizer.targetCPUUtilizationPercentage |
Advanced | Introduced in version: 1.0.0
Default value:
Target CPU utilization for the Synchronizer process on the pod. The
value of this field enables Synchronizer to auto-scale when CPU utilization
reaches this value, up to |
synchronizer.terminationGracePeriodSeconds |
Advanced | Introduced in version: 1.0.0
Default value: The time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully. |
synchronizer.tolerations.effect |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
synchronizer.tolerations.key |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
synchronizer.tolerations.operator |
Advanced | Introduced in version: 1.10.1
Default value: Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
synchronizer.tolerations.tolerationSeconds |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
synchronizer.tolerations.value |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
udca
(Universal Data Collection Agent) Defines the service that runs within the data collection pod in the runtime plane. This service extracts analytics and deployment status data and sends it to the Unified Analytics Platform (UAP).
For more information, see Analytics and deployment status data collection.
The following table describes the properties of the udca
object:
Property | Type | Description |
---|---|---|
udca.annotations |
Advanced | Introduced in version: 1.5.0
Default value: None Optional key/value map used to annotate pods. For more information, see Custom annotations. |
udca.fluentd.image.pullPolicy |
Advanced | Introduced in version: 1.0.0
Default value: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, see Updating images. |
udca.fluentd.image.tag |
Advanced | Introduced in version: 1.0.0
Default value: The version label for this service's Docker image. |
udca.fluentd.image.url |
Advanced | Introduced in version: 1.0.0
Default value: The location of the Docker image for this service. |
udca.fluentd.resources.limits.cpu |
Advanced | Introduced in version: 1.11.0
Default value: The memory limit for the resource in a Kubernetes container, in mebibytes. |
udca.fluentd.resources.limits.memory |
Advanced | Introduced in version: 1.11.0
Default value: The memory limit for the resource in a Kubernetes container, in mebibytes. |
udca.fluentd.resources.requests.cpu |
Advanced | Introduced in version: 1.0.0
Default value: The CPU needed for normal operation of the resource in a Kubernetes container, in millicores. |
udca.fluentd.resources.requests.memory |
Advanced | Introduced in version: 1.0.0
Default value: The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes. |
udca.gsa |
Advanced | Introduced in version: 1.10.0
Default value: None Helm only: The email address of the GSA email addresses typically have the format of: GSA_NAME@PROJECT_ID.iam.gserviceaccount.com For example: apigee-udca@my-hybrid-project.iam.gserviceaccount.com See Enabling Workload Identity on GKE or Enabling Workload Identity Federation on AKS and EKS. |
udca.image.pullPolicy |
Advanced | Introduced in version: 1.0.0
Default value: IfNotPresent Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, see Updating images. |
udca.image.tag |
Advanced | Introduced in version: 1.0.0
Default value: The version label for this service's Docker image. |
udca.image.url |
Advanced | Introduced in version: 1.0.0
Default value: None The location of the Docker image for this service. Use |
udca.jvmXms |
Advanced | Introduced in version: 1.0.0
Deprecated: Starting in Hybrid version 1.8, |
udca.jvmXmx |
Advanced | Introduced in version: 1.0.0
Deprecated: Starting in Hybrid version 1.8, |
udca.livenessProbe.failureThreshold |
Advanced | Introduced in version: 1.0.0
Default value: The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1. |
udca.livenessProbe.initialDelaySeconds |
Advanced | Introduced in version: 1.0.0
Default value: The number of seconds after a container is started before a liveness probe is initiated. |
udca.livenessProbe.periodSeconds |
Advanced | Introduced in version: 1.0.0
Default value: Determines how often to perform a liveness probe, in seconds. The minimum value is 1. |
udca.livenessProbe.timeoutSeconds |
Advanced | Introduced in version: 1.0.0
Default value: The number of seconds after which a liveness probe times out. The minimum value is 1. |
udca.nodeSelector.key |
Basic | Introduced in version: 1.0.0
Default value: None Required Node selector label key used to target dedicated Kubernetes nodes for |
udca.nodeSelector.value |
Basic | Introduced in version: 1.0.0
Default value: None Required Node selector label value used to target dedicated Kubernetes nodes for |
udca.pollingIntervalInSec |
Advanced | Introduced in version: 1.0.0
Default value: The length of time, in seconds, that UDCA waits between polling operations. UDCA polls the data directory on the data collection pod's file system to detect new files to be uploaded. |
udca.replicaCountMax |
Basic | Introduced in version: 1.0.0
Default value: The maximum number of pods that hybrid can automatically add for the UDCA deployment. Because UDCA is implemented as a ReplicaSet, the pods are replicas.
It is recommended to set |
udca.replicaCountMin |
Basic | Introduced in version: 1.0.0
Default value: The minimum number of pods for the UDCA deployment. Because UDCA is implemented as a ReplicaSet, the pods are replicas. If the CPU usage goes above |
udca.resources.limits.cpu |
Advanced | Introduced in version: 1.11.0
Default value: The memory limit for the resource in a Kubernetes container, in mebibytes. |
udca.resources.limits.memory |
Advanced | Introduced in version: 1.11.0
Default value: The memory limit for the resource in a Kubernetes container, in mebibytes. |
udca.resources.requests.cpu |
Advanced | Introduced in version: 1.0.0
Default value: The CPU needed for normal operation of the resource in a Kubernetes container, in millicores. |
udca.resources.requests.memory |
Advanced | Introduced in version: 1.0.0
Default value: The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes. |
udca.revision |
Advanced | Introduced in version: 1.0.0
Default value: A static value that is populated in a label to enable canary deployments. |
udca.serviceAccountPath |
Basic | Introduced in version: 1.0.0
Default value: None One of either Path to Google Service Account key file with Apigee Analytics Agent role. |
udca.serviceAccountRef |
Basic | Introduced in version: 1.2.0
Default value: None One of either |
udca.targetCPUUtilizationPercentage |
Advanced | Introduced in version: 1.0.0
Default value: The threshold of CPU usage for scaling the number of pods in the ReplicaSet, as a percentage of total available CPU resources. Hybrid uses the combined utilization of all containers in the data collection pod (both fluentd and UDCA) to calculate the current utilization. When CPU usage goes above this value, then hybrid will gradually
increase the number of pods in the ReplicaSet, up to
|
udca.terminationGracePeriodSeconds |
Advanced | Introduced in version: 1.0.0
Default value: The time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully. |
udca.tolerations.effect |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
udca.tolerations.key |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
udca.tolerations.operator |
Advanced | Introduced in version: 1.10.1
Default value: Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
udca.tolerations.tolerationSeconds |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
udca.tolerations.value |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
virtualhosts
The virtualhosts
property is a required configuration property.
Virtual hosts allow Apigee hybrid to handle API requests to a
specified environment group..
For more information, see Configure virtual hosts.
The following table describes the properties of the virtualhosts
object:
Property | Type | Description |
---|---|---|
virtualhosts[].additionalGateways |
Basic | Introduced in version: 1.2.0
Default value: None A list of Istio Gateways to route traffic to. |
virtualhosts[].cipherSuites[] |
Advanced | Introduced in version: 1.9.2
Default value: None This property configures the TLS ciphers used in the ingress gateway. Below is a list of the ciphers enabled by default in OpenSSL format. You can find more information about the supported ciphers in the documentation for the Boring FIPS build of Envoy. A blank value defaults to the cipher suites supported by the Boring FIPS build of Envoy. Enabled by default for TLS v.1.3 (you cannot override TLS 1.3 ciphersuites):
Enabled by default for TLS v.1.2:
If you want to enable older versions of TLS in your Apigee ingress gateway deployment, use the For example, to enable TLS v.1.1: virtualhosts: - name: ENV_GROUP_NAME minTLSProtocolVersion: "1.1" cipherSuites: - "ECDHE-ECDSA-AES128-GCM-SHA256" - "ECDHE-RSA-AES128-GCM-SHA256" - "ECDHE-ECDSA-AES256-GCM-SHA384" - "ECDHE-RSA-AES256-GCM-SHA384" - "ECDHE-ECDSA-CHACHA20-POLY1305" - "ECDHE-RSA-CHACHA20-POLY1305" - "ECDHE-ECDSA-AES128-SHA" - "ECDHE-RSA-AES128-SHA" - "ECDHE-ECDSA-AES256-SHA" - "ECDHE-RSA-AES256-SHA" ... |
virtualhosts[].name |
Basic | Introduced in version: 1.2.0
Default value: None Required The name of the virtual host. |
virtualhosts[].maxTLSProtocolVersion |
Basic | Introduced in version: 1.3.0
Default value: None The maximum version of the TLS protocol Envoy can select. Envoy automatically uses the
optimal TLS protocol version between The value must be in the form of a number. For example: virtualhosts: - name: default maxTLSProtocolVersion: "1.3"
Where the number represents the TLS version number in the form See also
|
virtualhosts[].minTLSProtocolVersion |
Basic | Introduced in version: 1.3.0
Default value: None The minimum version of the TLS protocol Envoy can select. Envoy automatically uses the
optimal TLS protocol version between The value must be in the form of a number. For example: virtualhosts: - name: default minTLSProtocolVersion: "1.2"
Where the number represents the TLS version number in the form See also
|
virtualhosts[].selector |
Basic | Introduced in version: 1.2.0
Default value: Required A key-value selector-value pair for pointing to different ingress selectors.
If no selector label is supplied, the configuration is supplied to Apigee ingress gateway. |
virtualhosts[].sslCertPath |
Basic | Introduced in version: 1.2.0
Default value: None Either
The path on your system to a TLS certificate file. |
virtualhosts[].sslKeyPath |
Basic | Introduced in version: 1.2.0
Default value: None Either
The path on your system to the TLS private key file. |
virtualhosts[].sslSecret |
Basic | Introduced in version: 1.2.0
Default value: None Either
The name of a file stored in a Kubernetes secret that contains the TLS certificate and private key. You must create the secret using the TLS certificate and key data as its input. See also:
|
watcher
The watcher
property is a required configuration property.
The watcher is a process that watches for configuration changes and triggers their application to
the runtime plane..
The following table describes the properties of the watcher
object:
Property | Type | Description |
---|---|---|
watcher.annotations |
Advanced | Introduced in version: 1.5.0
Default value: None Optional key/value map used to annotate pods. For more information, see Custom annotations. |
watcher.args.enableIssueScanning |
Advanced | Introduced in version: 1.10.0
Default value: Enables or disables Automated issue surfacing. When Set to |
watcher.args.issueScanInterval |
Advanced | Introduced in version: 1.10.0
Default value: The interval in seconds for how often Watcher scans the runtime plane for automated issue surfacing. For more information, see Automated issue surfacing. |
watcher.gsa |
Advanced | Introduced in version: 1.10.0
Default value: None Helm only: The email address of the GSA email addresses typically have the format of: GSA_NAME@PROJECT_ID.iam.gserviceaccount.com For example: apigee-watcher@my-hybrid-project.iam.gserviceaccount.com See Enabling Workload Identity on GKE or Enabling Workload Identity Federation on AKS and EKS. |
watcher.image.pullPolicy |
Advanced | Introduced in version: 1.4.0
Default value: Determines when kubelet pulls the pod's Docker image. Possible values include:
For more information, see Updating images. |
watcher.image.tag |
Advanced | Introduced in version: 1.4.0
Default value: The version label for this service's Docker image. |
watcher.image.url |
Advanced | Introduced in version: 1.4.0
Default value: None The location of the Docker image for this service. Use |
watcher.replicaCountMax |
Basic | Introduced in version: 1.3.0
Default value: The maximum number of watcher replicas. This should be kept at
|
watcher.replicaCountMin |
Basic | Introduced in version: 1.3.0
Default value: The minimum number of watcher replicas. |
watcher.resources.limits.cpu |
Advanced | Introduced in version: 1.11.0
Default value: The CPU limit for the resource in a Kubernetes container, in millicores. |
watcher.resources.limits.memory |
Advanced | Introduced in version: 1.11.0
Default value: The memory limit for the resource in a Kubernetes container, in mebibytes. |
watcher.serviceAccountPath |
Basic | Introduced in version: 1.3.0
Default value: None Required. Path to Google Service Account key file with Apigee Runtime Agent role. |
watcher.serviceAccountRef |
Advanced | Introduced in version: 1.3.0
Default value: None One of either serviceAccountPath or serviceAccountRef is required. |
watcher.tolerations.effect |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
watcher.tolerations.key |
Advanced | Introduced in version: 1.10.1
Default value: None Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
watcher.tolerations.operator |
Advanced | Introduced in version: 1.10.1
Default value: Required to use the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
watcher.tolerations.tolerationSeconds |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |
watcher.tolerations.value |
Advanced | Introduced in version: 1.10.1
Default value: None Used by the Taints and Tolerations feature of Kubernetes.
See Taints and Tolerations: Concepts for details. |