Quando i pod sono pronti, vai al passaggio successivo.
Esegui una "prova" di installazione. Esegui il comando apply con il flag --dry-run=true. Eseguire un'esercitazione simulata consente di verificare la presenza di errori prima di apportare modifiche al cluster.
Ripeti questo passaggio finché tutti i pod non sono pronti.
L'avvio dei pod potrebbe richiedere diversi minuti.
Attivare l'accesso al sincronizzatore
Crea un account di servizio Google Cloud e aggiungi il ruolo Amministratore dell'organizzazione Apigee. Questo account di servizio verrà utilizzato per autenticare una chiamata API che effettuerai in un passaggio successivo. Un modo semplice per creare l'account di servizio è tramite la console Google Cloud.
Per le istruzioni, vedi
Creare e gestire gli account di servizio nella documentazione di Google Cloud.
Scarica la chiave dell'account di servizio sul tuo sistema. Segui le istruzioni riportate in
Creare chiavi account di servizio nella documentazione di Google Cloud.
Sposta la chiave dell'account di servizio scaricata nella directory degli account di servizio:
/hybrid-base-directory/hybrid-files/service-accounts.
dove org-admin-service-account-file è il percorso sul sistema della chiave dell'account di servizio che hai scaricato con il ruolo Amministratore dell'organizzazione Apigee.
Chiama l'API setSyncAuthorization per attivare le autorizzazioni richieste per il sincronizzatore:
your_org_name: il nome della tua organizzazione ibrida.
synchronizer-manager-service-account-email: il nome di un account di servizio con il ruolo Gestore sincronizzatore Apigee.
Il nome è formato come un indirizzo email. Ad esempio:
apigee-synchronizer@my-project.iam.gserviceaccount.com
Devi aggiungere l'alias host dell'endpoint MART alla tua organizzazione Apigee. Hai impostato questo valore in precedenza quando hai impostato il valore della proprietà mart.hostAlias nel file delle sostituzioni.
Il piano di gestione ha bisogno di questo indirizzo per poter comunicare con il piano di runtime tramite MART.
Per aggiungere l'alias host MART alla tua organizzazione:
Recupera il valore impostato in precedenza nel file delle sostituzioni per la proprietà
mart.hostAlias. Affinché MART funzioni, l'alias host deve essere un nome di dominio completo.
Individua la chiave dell'account di servizio con il ruolo Amministratore dell'organizzazione Apigee
che hai scaricato in precedenza nella sezione
Attivare l'accesso del sincronizzatore.
dove org-admin-service-account-file è il percorso sul sistema della chiave dell'account di servizio che hai scaricato con il ruolo Amministratore dell'organizzazione Apigee.
Chiama la seguente API di gestione per aggiornare la tua organizzazione con l'endpoint MART:
Assicurati di salvare il file delle sostituzioni. Ti servirà questo file per eseguire futuri upgrade, patch o altre modifiche alla configurazione del cluster.
[[["Facile da capire","easyToUnderstand","thumb-up"],["Il problema è stato risolto","solvedMyProblem","thumb-up"],["Altra","otherUp","thumb-up"]],[["Difficile da capire","hardToUnderstand","thumb-down"],["Informazioni o codice di esempio errati","incorrectInformationOrSampleCode","thumb-down"],["Mancano le informazioni o gli esempi di cui ho bisogno","missingTheInformationSamplesINeed","thumb-down"],["Problema di traduzione","translationIssue","thumb-down"],["Altra","otherDown","thumb-down"]],["Ultimo aggiornamento 2025-09-05 UTC."],[[["\u003cp\u003eThis documentation outlines the steps to install Apigee hybrid into a cluster, starting with verifying the directory and kubectl context.\u003c/p\u003e\n"],["\u003cp\u003eThe installation process involves using the \u003ccode\u003eapigeectl\u003c/code\u003e command to initialize the deployment services, including the Apigee Deployment Controller, Admission Webhook, Istio, and Cert Manager.\u003c/p\u003e\n"],["\u003cp\u003eA "dry run" is recommended before applying Apigee-specific runtime components to the cluster to check for potential errors.\u003c/p\u003e\n"],["\u003cp\u003eEnabling synchronizer access requires creating a GCP service account with the Apigee Organization Admin role, downloading its key, and using it to authenticate and set permissions via API calls.\u003c/p\u003e\n"],["\u003cp\u003eAdding the MART host alias to the Apigee organization is a necessary step, involving obtaining the \u003ccode\u003emart.hostAlias\u003c/code\u003e value from the overrides file and updating the organization properties using a management API call.\u003c/p\u003e\n"]]],[],null,["# Step 4: Install hybrid on GKE\n\n| You are currently viewing version 1.2 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\nApply the configuration to the cluster\n--------------------------------------\n\n\nTo install Apigee hybrid into your cluster:\n\n1. Be sure that you are in the \u003cvar translate=\"no\"\u003ehybrid-base-directory\u003c/var\u003e`/hybrid-files` directory.\n2. Verify that `kubectl` is set to the correct context. The current context should be set to the cluster to which you are deploying: \n\n ```\n kubectl config get-contexts\n ```\n3. Execute the `init` command: \n\n ```\n $APIGEECTL_HOME/apigeectl init -f overrides/overrides.yaml\n ```\n\n The `init` command installs the [Apigee deployment services](/apigee/docs/hybrid/v1.2/apigee-deployment-services)\n Apigee Deployment Controller and Apigee Admission Webhook, and it deploys non-Apigee\n components [Istio](https://istio.io/) and\n [Cert Manager](https://docs.cert-manager.io/en/latest/).\n4. To check the status of the deployment, you can use these commands: \n\n ```\n $APIGEECTL_HOME/apigeectl check-ready -f overrides/overrides.yaml\n ```\n\n\n and \n\n ```\n kubectl get pods -n apigee-system\n ```\n\n\n and \n\n ```\n kubectl get pods -n istio-system\n ```\n\n\n When the pods are ready, go to the next step.\n5. Do a \"dry run\" install. Execute the `apply` command with the `--dry-run=true` flag. Doing a dry run lets you check for any errors before any changes are made to the cluster. \n\n ```\n $APIGEECTL_HOME/apigeectl apply -f overrides/overrides.yaml --dry-run=true\n ```\n6. If there are no errors, you can apply the [Apigee-specific\n runtime components](/apigee/docs/hybrid/v1.2/what-is-hybrid#about-the-runtime-plane) to the cluster: \n\n ```\n $APIGEECTL_HOME/apigeectl apply -f overrides/overrides.yaml\n ```\n7. To check the status of the deployment: \n\n ```\n $APIGEECTL_HOME/apigeectl check-ready -f overrides/overrides.yaml\n ```\n\n\n Repeat this step until the pods are all ready.\n The pods may take several minutes\n to start up.\n\nEnable synchronizer access\n--------------------------\n\n1. Create a GCP service account and add the **Apigee Organization Admin** role to it. This service account will be used to authenticate an API call that you will make in a later step. An easy way to create the service account is through the GCP console. For instructions, see [Creating and managing service accounts](https://cloud.google.com/iam/docs/creating-managing-service-accounts#iam-service-accounts-create-gcloud) in the GCP documentation.\n2. Download the service account key to your system. Follow the instructions in [Creating service account keys](https://cloud.google.com/iam/docs/creating-managing-service-account-keys#iam-service-account-keys-create-gcloud) in the GCP documentation.\n3. Move the downloaded service account key into your service accounts directory: \u003cvar translate=\"no\"\u003e/hybrid-base-directory\u003c/var\u003e`/hybrid-files/service-accounts`.\n4. Execute these two commands to get a token: \n\n export GOOGLE_APPLICATION_CREDENTIALS=\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003eorg\u003c/span\u003e\u003cspan class=\"devsite-syntax-o\"\u003e-\u003c/span\u003e\u003cspan class=\"devsite-syntax-n\"\u003eadmin\u003c/span\u003e\u003cspan class=\"devsite-syntax-o\"\u003e-\u003c/span\u003e\u003cspan class=\"devsite-syntax-n\"\u003eservice\u003c/span\u003e\u003cspan class=\"devsite-syntax-o\"\u003e-\u003c/span\u003e\u003cspan class=\"devsite-syntax-n\"\u003eaccount\u003c/span\u003e\u003cspan class=\"devsite-syntax-o\"\u003e-\u003c/span\u003e\u003cspan class=\"devsite-syntax-n\"\u003efile\u003c/span\u003e\u003c/var\u003e\n export TOKEN=$(gcloud auth application-default print-access-token)\n\n\n Where \u003cvar translate=\"no\"\u003eorg-admin-service-account-file\u003c/var\u003e is the path on your system to the service\n account key you downloaded with the **Apigee Organization Admin** role.\n5. Call the [setSyncAuthorization](/apigee/docs/reference/apis/apigee/rest/v1/organizations/setSyncAuthorization) API to enable the required permissions for Synchronizer: \n\n ```\n curl -X POST -H \"Authorization: Bearer $TOKEN\" \\\n -H \"Content-Type:application/json\" \\\n \"https://apigee.googleapis.com/v1/organizations/your_org_name:setSyncAuthorization\" \\\n -d '{\"identities\":[\"serviceAccount:synchronizer-manager-service-account-email\"]}'\n ```\n\n\n Where:\n - `your_org_name`: The name of your hybrid organization.\n - `synchronizer-manager-service-account-email`: The name of a service account with the **Apigee Synchronizer Manager** role. The name is formed like an email address. For example: `apigee-synchronizer@my-project.iam.gserviceaccount.com`\n\n Example: \n\n ```\n curl -X POST -H \"Authorization: Bearer $TOKEN\" \\\n -H \"Content-Type:application/json\" \\\n \"https://apigee.googleapis.com/v1/organizations/my_org:setSyncAuthorization\" \\\n -d '{\"identities\":[\"serviceAccount:apigee-synchronizer@my-project.iam.gserviceaccount.com\"]}'\n ```\n6. To verify that the service account was set, call the following API to get a list of service accounts: \n\n ```\n curl -X POST -H \"Authorization: Bearer $TOKEN\" \\\n -H \"Content-Type:application/json\" \\\n \"https://apigee.googleapis.com/v1/organizations/your_org_name:getSyncAuthorization\" \\\n -d ''\n ```\n\n\n The output looks similar to the following: \n\n ```\n {\n \"identities\":[\n \"serviceAccount:my-synchronizer-manager-service_account@my_project_id.iam.gserviceaccount.com\"\n ],\n \"etag\":\"BwWJgyS8I4w=\"\n }\n \n ```\n\nAdd the MART host alias to your org\n-----------------------------------\n\n\nYou must add the host alias of the [MART](/apigee/docs/hybrid/v1.2/what-is-hybrid#mart) endpoint\nto your Apigee organization. You set this value previously when set\nthe value of the `mart.hostAlias` property in your overrides\nfile.\nThe management plane needs this address so that it can communicate with the runtime\nplane over MART.\n\n\nFollow these steps to add the MART host alias to your organization:\n\n1. Get the value you set previously in your overrides file for the `mart.hostAlias` property. For MART to function, the host alias must be a fully qualified domain name.\n2. Locate the service account key with the **Apigee Organization Admin** role that you downloaded previously, in the section [Enable synchronizer access](#enable-synchronizer-access).\n3. Execute these two commands to get a token: \n\n export GOOGLE_APPLICATION_CREDENTIALS=\u003cvar translate=\"no\"\u003e\u003cspan class=\"devsite-syntax-n\"\u003eorg\u003c/span\u003e\u003cspan class=\"devsite-syntax-o\"\u003e-\u003c/span\u003e\u003cspan class=\"devsite-syntax-n\"\u003eadmin\u003c/span\u003e\u003cspan class=\"devsite-syntax-o\"\u003e-\u003c/span\u003e\u003cspan class=\"devsite-syntax-n\"\u003eservice\u003c/span\u003e\u003cspan class=\"devsite-syntax-o\"\u003e-\u003c/span\u003e\u003cspan class=\"devsite-syntax-n\"\u003eaccount\u003c/span\u003e\u003cspan class=\"devsite-syntax-o\"\u003e-\u003c/span\u003e\u003cspan class=\"devsite-syntax-n\"\u003efile\u003c/span\u003e\u003c/var\u003e\n export TOKEN=$(gcloud auth application-default print-access-token)\n\n\n Where \u003cvar translate=\"no\"\u003eorg-admin-service-account-file\u003c/var\u003e is the path on your system to the service\n account key you downloaded with the **Apigee Organization Admin** role.\n4. Call the following management API to update your organization with the MART endpoint: \n\n ```\n curl -v -X PUT \\\n https://apigee.googleapis.com/v1/organizations/your_org_name \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer $TOKEN\" \\\n -d '{\n \"name\" : \"your_org_name\",\n \"properties\" : {\n \"property\" : [ {\n \"name\" : \"features.hybrid.enabled\",\n \"value\" : \"true\"\n }, {\n \"name\" : \"features.mart.server.endpoint\",\n \"value\" : \"https://HOST_ALIAS_DNS\"\n } ]\n }\n }'\n ```\n\n Here is an example. Be sure to add the prefix \"https://\" to the host alias. \n\n ```\n curl -v -X PUT \\\n https://apigee.googleapis.com/v1/organizations/my_organization \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer $TOKEN\" \\\n -d '{\n \"name\" : \"my_organization\",\n \"properties\" : {\n \"property\" : [ {\n \"name\" : \"features.hybrid.enabled\",\n \"value\" : \"true\"\n }, {\n \"name\" : \"features.mart.server.endpoint\",\n \"value\" : \"https://foo-mart.example.com\"\n } ]\n }\n }'\n ```\n\nSave the overrides file\n-----------------------\n\n\nBe sure to save your overrides file. You will need this file to perform future upgrades,\npatches, or any other modifications to the cluster configuration.\n| **CONGRATULATIONS!**\n|\n| **You've successfully installed Apigee hybrid. You are now ready to test\n| it.**"]]
