This step explains how to download and install apigeectl, set up the installation directories, and create Google Cloud service accounts, and TLS credentials that are required for Apigee hybrid to operate.
Download and install
apigeectl is the command-line interface
(CLI) for installing and managing Apigee hybrid in a Kubernetes cluster.
The following steps describe how to get
Download the release package for your operating system using the following command:
Mac 64 bit:
curl -LO \ https://storage.googleapis.com/apigee-public/apigee-hybrid-setup/1.2.0/apigeectl_mac_64.tar.gz
Linux 64 bit:
curl -LO \ https://storage.googleapis.com/apigee-public/apigee-hybrid-setup/1.2.0/apigeectl_linux_64.tar.gz
Mac 32 bit:
curl -LO \ https://storage.googleapis.com/apigee-public/apigee-hybrid-setup/1.2.0/apigeectl_mac_32.tar.gz
Linux 32 bit:
curl -LO \ https://storage.googleapis.com/apigee-public/apigee-hybrid-setup/1.2.0/apigeectl_linux_32.tar.gz
- Create a directory on your system to serve as the base directory for the Apigee hybrid installation.
Extract the downloaded gzip file contents into the base directory you just created. For example:
tar xvzf filename.tar.gz -C path-to-base-directory
- Change directory to the base directory.
The tar contents are, by default, expanded into a directory with the version and platform in its name. For example:
./apigeectl_1.0.0-f7b96a8_linux_64. Rename that directory to
apigeectlusing the following command:
mv apigeectl_1.0.0-f7b96a8_linux_64 apigeectl
- Change directory into the directory. For example:
This directory is the
apigeectlhome directory. It is where the
apigeectlexecutable command is located.
- Create an environment variable to hold this home directory path using the following command:
- Verify that the variable holds the correct path using the following command:
Set up the project directory structure
The directory structure described below is a suggested approach. It separates Apigee hybrid
release software from configuration files that you must create. Through the use of the
$APIGEECTL_HOME variable and symbolic links that you create, you can easily
switch to a new software version if you choose to. See also Upgrading Apigee hybrid.
- Be sure you are in the base directory (the directory where the
apigeectldirectory is located).
- Create a new folder called
hybrid-files. You can give the directory any name you wish, but in the docs, the name
hybrid-filesis used consistently. Later, you will store configuration files, service account keys, and TLS certificates in this folder. This folder lets you keep your config files separate from the
- The current directory structure now looks like the following:
pwd && ls/hybrid-base-directory apigeectl hybrid-files
- Change directory into the
hybrid-filesfolder using the following command:
- Inside the
hybrid-filesdirectory, create the following subdirectories to organize files that you will create later using the following commands:
- Inside the
hybrid-filesdirectory, create the following symbolic links to
$APIGEECTL_HOME. These links allow you to run the
apigeectlcommand from inside the
- To check that the symlinks were created correctly, execute the following command and make
sure the link paths point to the correct locations:
ls -l | grep ^l
Create service accounts
Apigee hybrid uses Google Cloud service accounts to allow hybrid components to communicate by making authorized API calls. In this step, you use an Apigee hybrid command-line tool to create a set of services accounts. The tool also downloads the service account private keys for you. You must then add these keys to your Apigee hybrid cluster configuration file.
Click to learn more
The following table describes the service accounts that are required by hybrid components to perform authorized communication. See also About service accounts.
|Component*||Role||Required for basic install?||Description|
||Storage Object Admin||Allows Cassandra backups to Google Cloud Storage (GCS), as described in Backup and recovery.|
||Logs Writer||Allows logging data collection, as described in Logging. Only required for non-GKE cluster installations.|
||No role||Allows MART service authentication. This service account should not have a role associated with it; as a result, when you create this service account, do not assign a role to it.|
||Monitoring Metric Writer||Allows metrics data collection, as described in Metrics collection|
||Apigee Organization Admin||Lets you call the getSyncAuthorization API and
setSyncAuthorization API. You cannot create this service account with the
||Apigee Synchronizer Manager||Allows the synchronizer to download proxy bundles and environment configuration data. Also enables operation of the trace feature.|
||Apigee Analytics Agent||Allows the transfer of trace, analytics and deployment status data to the management plane.|
|* This name is used in the downloaded service account key's filename.|
Create the keys:
- Be sure that you are in the
- Execute the following command from inside
hybrid-filesdirectory. This command creates a service account for the
apigee-metricscomponent and places the downloaded key in the
./tools/create-service-account apigee-metrics ./service-accounts
When you see the following prompt, enter y:
[INFO]: gcloud configured project ID is project_id. Press: y to proceed with creating service account in project: project_id Press: n to abort.
If this is the first time an SA with the exact name assigned by the tool was created, then the tool just creates it, and you do not have to do anything further.
If, however, you see the following message and prompt, enter y to generate new keys:
[INFO]: Service account apigee-metrics@project_id.iam.gserviceaccount.com already exists. ... [INFO]: The service account might have keys associated with it. It is recommended to use existing keys. Press: y to generate new keys.(this does not de-activate existing keys) Press: n to skip generating new keys.
- Now, create the rest of the service accounts using the following commands:
./tools/create-service-account apigee-synchronizer ./service-accounts
./tools/create-service-account apigee-udca ./service-accounts
./tools/create-service-account apigee-mart ./service-accounts
./tools/create-service-account apigee-cassandra ./service-accounts
./tools/create-service-account apigee-logger ./service-accounts
- Verify that the service account keys were created. You are responsible for storing these
private keys securely. The key filenames are prefixed with the name of your Google Cloud project.
ls ./service-accounts gcp-project-id-apigee-cassandra.json gcp-project-id-apigee-logger.json gcp-project-id-apigee-mart.json gcp-project-id-apigee-metrics.json gcp-project-id-apigee-synchronizer.json gcp-project-id-apigee-udca.json
Create TLS certificates
You are required to provide TLS certificates for the MART and runtime ingress gateways in your Apigee hybrid configuration. The credentials used for the MART gateway must be authorized by a certificate authority (CA). For the purpose of this quickstart (a non-production trial installation), the runtime gateway can accept self-signed credentials.
In this step, you will create the TLS credential files and add them to
In Step 3: Configure the cluster, you will add the file
paths to the cluster configuration file.
Create TLS credentials for the runtime gateway
The runtime ingress gateway (the gateway that handles API proxy traffic) requires a TLS certificate/key pair. For this quickstart installation, you can use self-signed credentials. In the following steps, openssl is used to generate the credentials.
- Be sure that you are in the
- Execute the following command from inside the
hybrid-filesdirectory using the following command:
openssl req -nodes -new -x509 -keyout ./certs/keystore.key -out \ ./certs/keystore.pem -subj '/CN=mydomain.net' -days 3650
This command creates a self-signed certificate/key pair that you can use for the quickstart installation. The CN mydomain.net can be any value you wish for the self-signed credentials.
- Check to make sure the files are in the
./certsdirectory using the following command:
ls ./certskeystore.pem keystore.key
keystore.pemis the self-signed TLS certificate file and
keystore.keyis the key file.
Create TLS credentials for the MART gateway
As noted in Before you begin, you must use an authorized TLS certificate/key pair for the MART gateway configuration. If you have not done so, obtain or create these credentials now.
- Obtain or create an TLS certificate/key pair that is authorized by a certificate authority. An example is provided showing how to obtain these credentials using the Let's Encrypt CA. Note that the certificate's common name (CN) must be a valid DNS name. For the example steps, see Obtain TLS credentials: An example.
- Copy the credentials into the
- When you are finished, you should have two pairs of credential files in the
./certsdirectory. For example:
ls ./certsfullchain.pem privkey.key keystore.pem keystore.key
fullchain.pemis the authorized TLS certificate file and
privkey.keyis the authorized key file.
You now have a home base from which you can configure, deploy, and manage Apigee hybrid in your Kubernetes cluster. Next, you will create a file that will be used by Kubernetes to deploy the hybrid runtime components to the cluster.