Configuration property reference

You are currently viewing version 1.3 of the Apigee hybrid documentation. This version is end of life. You should upgrade to a newer version. For more information, see Supported versions.

Version 1.3 (unsupported)

   Supported versions:

• v1.13 (latest)                        
• v1.12                         
• v1.11                         
• List of supported versions

   Unsupported versions:

• v1.10                                      
• v1.9                                         
• v1.8                                         
• v1.7                                         
• v1.6                                         
• v1.5                                         
• v1.4                                         
• v1.3                                         
• v1.2                                         
• v1.1                                         

This section lists all of the configuration properties that you can use to customize the runtime plane of your Apigee hybrid deployment.

About configuration properties

You can override many configuration properties, if needed, by adding them to HYBRID_ROOT_DIR/overrides.yaml.

Tip: Apigee provides a small set of sample configurations that you can use for further guidance. See Sample overrides files.

For example, to change the replica count minimum and maximum for the MART service, you could add this stanza to overrides.yaml:

mart:
    replicaCountMin: 3
    replicaCountMax: 6

You can also find these config properties and their default settings in HYBRID_ROOT_INSTALL/1.0.0/values.yaml

For more information, see Manage runtime plane components.

Additionally, if you are configuring an Anthos-based deployment see Step 4: Configure the cluster for information on setting these properties for Anthos.

Top-level properties

The following table describes the top-level properties in the overrides.yaml file. These are properties that do not belong to another object, and apply at the org or environment level:

Property	Description
axHashSalt	Introduced in version: 1.3.0 Default value: Your organization name Optional The name of a Kubernetes secret that contains a hashing salt value used to encrypt obfuscated user data sent to Apigee analytics. If you do not specify a salt value, your organization name is used by default. Create the secret with the salt value as its input. You can use the same salt across multiple clusters to ensure consistent hashing results between the clusters.
contractProvider	Introduced in version: 1.0.0 Default value: https://apigee.googleapis.com Defines the API path for all APIs in your installation.
gcpProjectID	Deprecated: For v1.2.0 and later, use gcp.projectID instead. Introduced in version: 1.0.0 Default value: none Required ID of your Google Cloud project. Works with k8sClusterName (deprecated) and gcpRegion (deprecated) to identify the project and determine where the apigee-logger and the apigee-metrics push their data.
gcpRegion	Deprecated: For v1.2.0 and later, use gcp.region instead. Introduced in version: 1.0.0 Default value: us-central1 Required The closet Google Cloud region or zone of your Kubernetes cluster. Works with gcpProjectID (deprecated) and k8sClusterName (deprecated) to identify the project and determine where the apigee-logger and the apigee-metrics push their data.
imagePullSecrets.name	Introduced in version: 1.0.0 Default value: None Kubernetes secret name configured as docker-registry type; used to pull images from private repo.
k8sClusterName	Deprecated: For v1.2.0 and later, use k8sCluster.name and k8sCluster.region instead. Introduced in version: 1.0.0 Default value: None Name of the Kubernetes (K8S) procluster where your hybrid project is running. Works with gcpProjectID (deprecated) and gcpRegion (deprecated) to identify the project and determine where the apigee-logger and the apigee-metrics push their data.
kmsEncryptionKey	Introduced in version: 1.0.0 Default value: defaults.org.kmsEncryptionKey Optional. Use only one of kmsEncryptionKey or kmsEncryptionPath or kmsEncryptionSecret. Local file system path for the Apigee KMS data's encryption key.
kmsEncryptionPath	Introduced in version: 1.2.0 Default value: None Optional. Use only one of kmsEncryptionKey or kmsEncryptionPath or kmsEncryptionSecret. The path to a file containing a base64-encoded encryption key. See Data encryption.
kmsEncryptionSecret.key	Introduced in version: 1.2.0 Default value: None Optional. Use only one of kmsEncryptionKey or kmsEncryptionPath or kmsEncryptionSecret. The key of a Kubernetes secret containing a base64-encoded encryption key. See Data encryption.
kmsEncryptionSecret.name	Introduced in version: 1.2.0 Default value: None Optional. Use only one of kmsEncryptionKey or kmsEncryptionPath or kmsEncryptionSecret. The name of a Kubernetes secret containing a base64-encoded encryption key. See Data encryption.
kvmEncryptionKey	Introduced in version: 1.0.0 Default value: defaults.org.kmsEncryptionKey Optional. Use only one of kvmEncryptionKey or kvmEncryptionPath or kvmEncryptionSecret. Local file system path for the Apigee KVM data's encryption key.
kvmEncryptionPath	Introduced in version: 1.2.0 Default value: None Optional. Use only one of kvmEncryptionKey or kvmEncryptionPath or kvmEncryptionSecret. The path to a file containing a base64-encoded encryption key. See Data encryption.
kvmEncryptionSecret.key	Introduced in version: 1.2.0 Default value: None Optional. Use only one of kvmEncryptionKey or kvmEncryptionPath or kvmEncryptionSecret. The key of a Kubernetes secret containing a base64-encoded encryption key. See Data encryption.
kvmEncryptionSecret.name	Introduced in version: 1.2.0 Default value: None Optional. Use only one of kvmEncryptionKey or kvmEncryptionPath or kvmEncryptionSecret. The name of a Kubernetes secret containing a base64-encoded encryption key. See Data encryption.
namespace	Introduced in version: 1.0.0 Default value: apigee The namespace of your Kubernetes cluster where the Apigee components will be installed.
org	Introduced in version: 1.0.0 Default value: None Required The hybrid-enabled organization that was provisioned for you by Apigee during the hybrid installation. An organization is the top-level container in Apigee. It contains all your API proxies and related resources. If the value is empty, you must update it with your org name once you have created it.
revision	Introduced in version: 1.0.0 Default value: v120 Apigee hybrid supports rolling Kubernetes updates, which allow deployment updates to take place with zero downtime by incrementally updating Pod instances with new ones. When updating certain YAML overrides that result in underlying Kubernetes PodTemplateSpec change, the revision override property must also be changed in the customer's override.yaml. This is required for the underlying Kubernetes ApigeeDeployment (AD) controller to conduct a safe rolling update of from the previous version to the new version. You can use any lowercase text value, such as: blue, a, 1.0.0 Note: revision can accept only lowercase alpha characters, numbers, and punctuation. When the revision property is changed and applied, a rolling update will occur for all components Changes to properties of the following objects require an update to revision: nodeSelector envs imagePullSecrets gcpProjectID k8sClusterName contractProvider org For more information, see Rolling updates.
validateServiceAccounts	Introduced in version: 1.0.0 Default value: true Enables strict validation of service account permissions. This uses Cloud Resource Manager API method testIamPermissions to verify that the provided service account has the required permissions. In the case of service accounts for an Apigee Org, the project ID check is the one mapped to the Organization. For Metrics and Logger, the project checked is based on the gcpProjectID overrides.yaml configuration. See also gcpProjectID

ao

Apigee Operators (AO) creates and updates low level Kubernetes and Istio resources that are required to deploy and maintain the ApigeeDeployment (AD). For example, the controller carries out the release of message processors. Also validates the ApigeeDeployment configuration before persisting it in Kubernetes cluster.

Note: In version 1.2.0, Apigee Operators replaces Apigee Deployment Admissionhook (ADAH) and Apigee Deployment Controller (ADC).

The following table describes the properties of the apigee-operators ao object:

Property	Description
ao.image.pullPolicy	Introduced in version: 1.2.0 Default value: IfNotPresent Determines when kubelet pulls the pod's Docker image. Possible values include: IfNotPresent: Do not pull a new image if it already exists. Always: Always pull the image, regardless of whether it exists already. For more information, see Updating images.
ao.image.tag	Introduced in version: 1.2.0 Default value: 1.2.0 The version label for this service's Docker image.
ao.image.url	Introduced in version: 1.2.0 Default value: google/apigee-deployment-controller The location of the Docker image for this service.
ao.resources.limits.cpu	Introduced in version: 1.2.0 Default value: 250m The CPU limit for the resource in a Kubernetes container, in millicores.
ao.resources.limits.memory	Introduced in version: 1.2.0 Default value: 256Mi The memory limit for the resource in a Kubernetes container, in mebibytes.
ao.resources.requests.cpu	Introduced in version: 1.2.0 Default value: 250m The CPU needed for normal operation of the resource in a Kubernetes container, in millicores.
ao.resources.requests.memory	Introduced in version: 1.2.0 Default value: 256Mi The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes.

authz

The following table describes the properties of the authz object:

Property	Description
authz.image.pullPolicy	Introduced in version: 1.0.0 Default value: IfNotPresent Determines when kubelet pulls the pod's Docker image. Possible values include: IfNotPresent: Do not pull a new image if it already exists. Always: Always pull the image, regardless of whether it exists already. For more information, see Updating images.
authz.image.tag	Introduced in version: 1.0.0 Default value: 1.2.0 The version label for this service's Docker image.
authz.image.url	Introduced in version: 1.0.0 Default value: google/apigee-authn-authz The location of the Docker image for this service.
authz.livenessProbe.failureThreshold	Introduced in version: 1.0.0 Default value: 2 The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1.
authz.livenessProbe.initialDelaySeconds	Introduced in version: 1.0.0 Default value: 0 The number of seconds after a container is started before a liveness probe is initiated.
authz.livenessProbe.periodSeconds	Introduced in version: 1.0.0 Default value: 5 Determines how often to perform a liveness probe, in seconds. The minimum value is 1.
authz.livenessProbe.timeoutSeconds	Introduced in version: 1.0.0 Default value: 1 The number of seconds after which a liveness probe times out. The minimum value is 1.
authz.readinessProbe.failureThreshold	Introduced in version: Beta2 Default value: 2 The number of times Kubernetes will verify that readiness probes have failed before marking the pod unready. The minimum value is 1.
authz.readinessProbe.initialDelaySeconds	Introduced in version: 1.0.0 Default value: 0 The number of seconds after a container is started before a readiness probe is initiated.
authz.readinessProbe.periodSeconds	Introduced in version: 1.0.0 Default value: 5 Determines how often to perform a readiness probe, in seconds. The minimum value is 1.
authz.readinessProbe.successThreshold	Introduced in version: 1.0.0 Default value: 1 The minimum consecutive successes needed for a readiness probe to be considered successful after a failure. The minimum value is 1.
authz.readinessProbe.timeoutSeconds	Introduced in version: 1.0.0 Default value: 1 The number of seconds after which a liveness probe times out. The minimum value is 1.
authz.resources.requests.cpu	Introduced in version: 1.0.0 Default value: 50m The amount of CPU resources to allocate for authentication requests.
authz.resources.requests.memory	Introduced in version: 1.0.0 Default value: 128Mi The amount of memory resources to allocate for authentication requests.

busyBoxInit (Deprecated)

The following table describes the properties of the busyBoxInit object:

Property	Description
busyBoxInit.image.pullPolicy	Deprecated. Introduced in version: 1.0.0 Default value: IfNotPresent Determines when kubelet pulls the pod's Docker image. Possible values include: IfNotPresent: Do not pull a new image if it already exists. Always: Always pull the image, regardless of whether it exists already. For more information, see Updating images.
busyBoxInit.image.tag	Deprecated. Introduced in version: 1.0.0 Default value: 1.0.0 The version label for this service's Docker image.
busyBoxInit.image.url	Deprecated. Introduced in version: 1.0.0 Default value: busybox The location of the Docker image for this service.

cassandra

Defines the hybrid service that manages the runtime data repository. This repository stores application configurations, distributed quota counters, API keys, and OAuth tokens for applications running on the gateway.

For more information, see StorageClass configuration.

The following table describes the properties of the cassandra object:

Property	Description
cassandra.auth.admin.password	Introduced in version: 1.0.0 Default value: iloveapis123 Required Password for the Cassandra administrator. The admin user is used for any administrative activities performed on the Cassandra cluster.
cassandra.auth.ddl.password	Introduced in version: 1.0.0 Default value: iloveapis123 Required Password for the Cassandra Data Definition Language (DDL) user. Used by MART for any of the data definition tasks like keyspace creation, update, and deletion.
cassandra.auth.default.password	Introduced in version: 1.0.0 Default value: iloveapis123 Required The password for the default Cassandra user created when Authentication is enabled. This password must be reset when configuring Cassandra authentication. See Configuring TLS for Cassandra.
cassandra.auth.dml.password	Introduced in version: 1.0.0 Default value: iloveapis123 Required Password for the Cassandra Data Manipulation Language (DML) user. The DML user is used by the client communication to read and write data to Cassandra.
cassandra.auth.image.pullPolicy	Introduced in version: 1.0.0 Default value: IfNotPresent Determines when kubelet pulls the pod's Docker image. Possible values include: IfNotPresent: Do not pull a new image if it already exists. Always: Always pull the image, regardless of whether it exists already. For more information, see Updating images.
cassandra.auth.image.tag	Introduced in version: 1.0.0 Default value: 1.2.0 The version label for this service's Docker image.
cassandra.auth.image.url	Introduced in version: 1.0.0 Default value: google/apigee-hybrid-cassandra-client The location of the Docker image for this service.
cassandra.auth.secret	Introduced in version: 1.3.3 Default value: None The name of a file stored in a Kubernetes secret that contains the TLS certificate and private key. You must create the secret using the TLS certificate and key data as its input. See also: Storing data in a Kubernetes secret Secrets in the Kubernetes documentation Creating a Secret Using kubectl in the Kubernetes documentation
cassandra.backup.cloudProvider	Introduced in version: 1.0.0 Default value: GCP Required if backup is enabled. Cloud provider for backup storage.
cassandra.backup.dbStorageBucket	Introduced in version: 1.0.0 Default value: None Required if backup is enabled. Cloud storage bucket for the backup data.
cassandra.backup.enabled	Introduced in version: 1.0.0 Default value: false Data backup is not enabled by default. To enable, set to true. See Cassandra backup and recovery.
cassandra.backup.image.pullPolicy	Introduced in version: 1.0.0 Default value: IfNotPresent Determines when kubelet pulls the pod's Docker image. Possible values include: IfNotPresent: Do not pull a new image if it already exists. Always: Always pull the image, regardless of whether it exists already. For more information, see Updating images.
cassandra.backup.image.tag	Introduced in version: 1.0.0 Default value: 1.2.0 The version label for this service's Docker image.
cassandra.backup.image.url	Introduced in version: 1.0.0 Default value: google/apigee-cassandra-backup-utility The location of the Docker image for this service.
cassandra.backup.schedule	Introduced in version: 1.0.0 Default value: 0 2 * * * The schedule for the cron job. See Cassandra backup and recovery.
cassandra.backup.serviceAccountPath	Introduced in version: 1.0.0 Default value: None One of either backup.serviceAccountPath or backup.serviceAccountSecretRef is required if backup is enabled. Path to Google Service Account key file with Storage Object Admin role.
cassandra.backup.serviceAccountSecretRef	Introduced in version: 1.2.0 Default value: None One of either backup.serviceAccountPath or backup.serviceAccountSecretRef is required if backup is enabled. The name of a Kubernetes secret. You must create the secret using a Google Service Account key with the Storage Object Admin role as its input.
cassandra.clusterName	Introduced in version: 1.0.0 Default value: apigeecluster Specifies the name of the Cassandra cluster.
cassandra.datacenter	Introduced in version: 1.0.0 Default value: dc-1 Specifies the datacenter of the Cassandra node.
cassandra.dnsPolicy	Introduced in version: 1.1.1 Default value: None Note: In Apigee hybrid v1.3, this property is no longer supported. When you set hostNetwork to true, the DNS policy is set to ClusterFirstWithHostNet for you.
cassandra.externalSeedHost	Introduced in version: 1.0.0 Default value: None Hostname or IP of a Cassandra cluster node. If not set, the Kubernetes local service is used.
cassandra.heapNewSize	Introduced in version: 1.0.0 Default value: 100M The amount of JVM system memory allocated to newer objects, in megabytes.
cassandra.hostNetwork	Introduced in version: 1.1.1 Default value: false Set this property to true for Anthos installations. When true, DNS policy is automatically set to ClusterFirstWithHostNet.
cassandra.image.pullPolicy	Introduced in version: 1.0.0 Default value: IfNotPresent Determines when kubelet pulls the pod's Docker image. Possible values include: IfNotPresent: Do not pull a new image if it already exists. Always: Always pull the image, regardless of whether it exists already. For more information, see Updating images.
cassandra.image.tag	Introduced in version: 1.0.0 Default value: 1.2.0 The version label for this service's Docker image.
cassandra.image.url	Introduced in version: 1.0.0 Default value: google/apigee-hybrid-cassandra The location of the Docker image for this service.
cassandra.maxHeapSize	Introduced in version: 1.0.0 Default value: 512M The upper limit of JVM system memory available fo Cassandra operations, in megabytes.
cassandra.multiRegionSeedHost	Introduced in version: 1.0.0 Default value: None IP address of an existing Cassandra cluster used to expand the existing cluster to a new region. See Configure the multi-region seed host.
cassandra.nodeSelector.key	Introduced in version: 1.0.0 Default value: None Required Node selector label key used to target dedicated Kubernetes nodes for cassandra data services. See Configuring dedicated node pools.
cassandra.nodeSelector.value	Introduced in version: 1.0.0 Default value: None Optional node selector label value used to target dedicated Kubernetes nodes for cassandra data services and override the nodeSelector.apigeeData settings. See nodeSelector.
cassandra.port	Introduced in version: 1.0.0 Default value: 9042 Port number used to connect to cassandra.
cassandra.rack	Introduced in version: 1.0.0 Default value: ra-1 Specifies the rack of the Cassandra node.
cassandra.readinessProbe.failureThreshold	Introduced in version: 1.0.0 Default value: 2 The number of times Kubernetes will verify that readiness probes have failed before marking the pod unready. The minimum value is 1.
cassandra.readinessProbe.initialDelaySeconds	Introduced in version: 1.0.0 Default value: 0 The number of seconds after a container is started before a readiness probe is initiated.
cassandra.readinessProbe.periodSeconds	Introduced in version: 1.0.0 Default value: 10 Determines how often to perform a readiness probe, in seconds. The minimum value is 1.
cassandra.readinessProbe.successThreshold	Introduced in version: 1.0.0 Default value: 1 The minimum consecutive successes needed for a readiness probe to be considered successful after a failure. The minimum value is 1.
cassandra.readinessProbe.timeoutSeconds	Introduced in version: 1.0.0 Default value: 5 The number of seconds after which a liveness probe times out. The minimum value is 1.
cassandra.replicaCount	Introduced in version: 1.0.0 Default value: 1 Cassandra is a replicated database. This property specifies the number of Cassandra nodes employed as a StatefulSet.
cassandra.resources.requests.cpu	Introduced in version: 1.0.0 Default value: 500m The CPU needed for normal operation of the resource in a Kubernetes container, in millicores.
cassandra.resources.requests.memory	Introduced in version: 1.0.0 Default value: 1Gi The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes.
cassandra.restore.cloudProvider	Introduced in version: 1.0.0 Default value: GCP Required if restore is enabled. Cloud provider for backup storage.
cassandra.restore.dbStorageBucket	Introduced in version: 1.0.0 Default value: None Required if restore is enabled. Cloud storage bucket for the backup data to restore.
cassandra.restore.enabled	Introduced in version: 1.0.0 Default value: false
cassandra.restore.image.pullPolicy	Introduced in version: 1.0.0 Default value: IfNotPresent Determines when kubelet pulls the pod's Docker image. Possible values include: IfNotPresent: Do not pull a new image if it already exists. Always: Always pull the image, regardless of whether it exists already. For more information, see Updating images.
cassandra.restore.image.tag	Introduced in version: 1.0.0 Default value: 1.2.0 The version label for this service's Docker image.
cassandra.restore.image.url	Introduced in version: 1.0.0 Default value: google/apigee-cassandra-backup-utility The location of the Docker image for this service.
cassandra.restore.serviceAccountPath	Introduced in version: 1.0.0 Default value: None One of either restore.serviceAccountPath or restore.serviceAccountSecretRef is required if restore is enabled. Path to Google Service Account key file with Storage Object Admin role.
cassandra.restore.serviceAccountSecretRef	Introduced in version: 1.2.0 Default value: None One of either restore.serviceAccountPath or restore.serviceAccountSecretRef is required if restore is enabled. The name of a Kubernetes secret. You must create the secret using a Google Service Account key with the Storage Object Admin role as its input.
cassandra.restore.snapshotTimestamp	Introduced in version: 1.0.0 Default value: None Required if restore is enabled. Timestamp of the backup that should be restored.
cassandra.restore.user	Introduced in version: 1.0.0 Default value: admin account Cassandra username used for schema backup restoration. If not specified, the admin user will be used.
cassandra.sslCertPath	Introduced in version: 1.2.0 Default value: None The path on your system to a TLS certificate file. Note: For each configured environment, the Common Name (CN) in the cert must match the domain in the hostAliases[] property. For example, if the CN is *.example.com, the hostAliases[] could be foo.example.com or bar.example.com.
cassandra.sslKeyPath	Introduced in version: 1.2.0 Default value: None The path on your system to the TLS private key file.
cassandra.sslRootCAPath	Introduced in version: 1.2.0 Default value: None The certificate chain to the root CA (certificate authority).
cassandra.storage.capacity	Introduced in version: 1.0.0 Default value: 50Gi Required if storage.storageClass is specified Specifies the disk size required, in mebibytes.
cassandra.storage.storageClass	Introduced in version: 1.0.0 Default value: None Specifies the class of on-prem storage being used.
cassandra.terminationGracePeriodSeconds	Introduced in version: 1.0.0 Default value: 300 The time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully.

certmanager

cert-manager is a certificate manager for Kubernetes implementations used by Apigee. See Welcome to cert-manager.

The following table describes the properties of the certmanager object:

Property	Description
certmanager.image.tag	Introduced in version: 1.2.0 Default value: v0.12.0 The version label for this service's Docker image.
certmanager.image.url	Introduced in version: 1.2.0 Default value: apigee-cert-manager-controller The location of the Docker image for this service.

certmanagercainjector

The cert-manager CA injector is a cert-manager process responsible for injecting the CA bundle into the cert-manager Webhook process. See CA injector in the cert-manager documentation.

The following table describes the properties of the certmanagercainjector object:

Property	Description
certmanagercainjector.image.tag	Introduced in version: 1.2.0 Default value: v0.12.0 The version label for this service's Docker image.
certmanagercainjector.image.url	Introduced in version: 1.2.0 Default value: google/apigee-cert-manager-cainjector The location of the Docker image for this service.

certmanagerwebhook

The cert-manager Webhook is a process that provides dynamic admission control over cert-manager resources. See Webhook in the cert-manager documentation.

The following table describes the properties of the certmanagerwebhook object:

Property	Description
certmanagerwebhook.image.tag	Introduced in version: 1.2.0 Default value: v0.12.0 The version label for this service's Docker image.
certmanagerwebhook.image.url	Introduced in version: 1.2.0 Default value: google/apigee-cert-manager-webhook The location of the Docker image for this service.

connectAgent

Apigee Connect allows the Apigee hybrid management plane to connect securely to the MART service in the runtime plane without requiring you to expose the MART endpoint on the internet.

See Apigee Connect.

The following table describes the properties of the connectAgent object:

Property	Description
connectAgent.enabled	Introduced in version: 1.2.0 Default value: false Is this installation using Apigee Connect instead of Istio ingress for mart? True or False. See Apigee Connect.
connectAgent.server	Introduced in version: 1.2.0 Default value: apigeeconnect.googleapis.com:443 The location of the server and port for this service.
connectAgent.logLevel	Introduced in version: 1.2.0 Default value: INFO The level of log reporting. Values can be: INFO: Informational messages in addition to warning, error, and fatal messages. Most useful for debugging. WARNING: Non-fatal warnings in addition to error and fatal messages. ERROR: Internal errors and errors that are not returned to the user in addition to fatal messages. FATAL: Unrecoverable errors and events that cause Apigee Connect to crash.
connectAgent.image.pullPolicy	Introduced in version: 1.2.0 Default value: IfNotPresent Determines when kubelet pulls the pod's Docker image. Possible values include: IfNotPresent: Do not pull a new image if it already exists. Always: Always pull the image, regardless of whether it exists already. For more information, see Updating images.
connectAgent.image.tag	Introduced in version: 1.2.0 Default value: 1.2.0 The version label for this service's Docker image.
connectAgent.image.url	Introduced in version: 1.2.0 Default value: google/apigee-connect-agent The location of the Docker image for this service. Check the values.yaml file for the specific URL.
connectAgent.replicaCountMax	Introduced in version: 1.2.0 Default value: 5 Maximum number of replicas available for autoscaling.
connectAgent.replicaCountMin	Introduced in version: 1.2.0 Default value: 1 Minimum number of replicas available for autoscaling. In production, you may want to increase replicaCountMin to 3, to have a greater number of connections to the control plane for reliability and scalability.
connectAgent.resources.requests.cpu	Introduced in version: 1.0.0 Default value: 100m The CPU needed for normal operation of the resource in a Kubernetes container, in millicores.
connectAgent.resources.requests.memory	Introduced in version: 1.0.0 Default value: 30Mi The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes.
connectAgent.targetCPUUtilizationPercentage	Introduced in version: 1.2.0 Default value: 75 Target CPU utilization for the Apigee Connect agent on the pod. The value of this field enables Apigee Connect to auto-scale when CPU utilization reaches this value, up to replicaCountMax.
connectAgent.terminationGracePeriodSeconds	Introduced in version: 1.2.0 Default value: 600 The time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully.

defaults

The Default encryption keys for the Apigee hybrid installation.

Note: You need to update these for your installation.

The following table describes the properties of the defaults object:

Property	Description
defaults.org.kmsEncryptionKey	Introduced in version: 1.0.0 Default value: aWxvdmVhcGlzMTIzNDU2Nw== Default encryption key for the org in KMS.
defaults.org.kvmEncryptionKey	Introduced in version: 1.0.0 Default value: aWxvdmVhcGlzMTIzNDU2Nw== Default encryption key for the org in KVM.
defaults.env.kmsEncryptionKey	Introduced in version: 1.0.0 Default value: aWxvdmVhcGlzMTIzNDU2Nw== Default encryption key for the environment (env) in KMS.
defaults.env.kvmEncryptionKey	Introduced in version: 1.0.0 Default value: aWxvdmVhcGlzMTIzNDU2Nw== Default encryption key for the environment (env) in KVM.
defaults.env.cacheEncryptionKey	Introduced in version: 1.0.0 Default value: aWxvdmVhcGlzMTIzNDU2Nw== Default cache encryption key for the environment (env).

envs

Defines an array of environments to which you can deploy your API proxies. Each environment provides an isolated context or sandbox for running API proxies.

Your hybrid-enabled organization must have at least one environment.

For more information, see About environments.

The following table describes the properties of the envs object:

Property	Description
envs[].cacheEncryptionKey	Introduced in version: 1.0.0 Default value: None One of either cacheEncryptionKey, cacheEncryptionPath, or cacheEncryptionSecret is required. A base64-encoded encryption key. See Data encryption.
envs[].cacheEncryptionPath	Introduced in version: 1.2.0 Default value: None One of either cacheEncryptionKey, cacheEncryptionPath, or cacheEncryptionSecret is required. The path to a file containing a base64-encoded encryption key. See Data encryption.
envs[].cacheEncryptionSecret.key	Introduced in version: 1.2.0 Default value: None One of either cacheEncryptionKey, cacheEncryptionPath, or cacheEncryptionSecret is required. The key of a Kubernetes secret containing a base64-encoded encryption key. See Data encryption.
envs[].cacheEncryptionSecret.name	Introduced in version: 1.2.0 Default value: None One of either cacheEncryptionKey, or cacheEncryptionPath, or cacheEncryptionSecret is required. The name of a Kubernetes secret containing a base64-encoded encryption key. See Data encryption.
envs[].hostAlias	Introduced in version: 1.0.0 Default value: None Deprecated: use hostAliases[] instead.
envs[].hostAliases[]	Introduced in version: 1.2.0 Default value: None The host aliases pointing to the environment. Each host alias must be a fully-qualified domain name.
envs[].httpProxy.host	Introduced in version: 1.2.0 Default value: None Specifies the host name or IP address where the HTTP proxy is running. List httpProxy properties in the order scheme, host, port. For example: envs: - name: test httpProxy: scheme: HTTP host: 10.12.0.47 port: 3128 ... See also: Configure forward proxying for API proxies.
envs[].httpProxy.port	Introduced in version: 1.2.0 Default value: None Specifies the port on which the HTTP proxy is running. If this property is omitted, by default it uses port 80 for HTTP and port 443 for HTTPS.
envs[].httpProxy.scheme	Introduced in version: 1.2.0 Default value: None Specifies the type of the HTTP proxy as HTTP or HTTPS. By default, it uses HTTP.
envs[].httpProxy.username	Introduced in version: 1.2.0 Default value: None If the HTTP proxy requires basic authentication, then use this property to provide a username.
envs[].httpProxy.password	Introduced in version: 1.2.0 Default value: None If the HTTP proxy requires basic authentication, then use this property to provide a password.
envs[].kmsEncryptionKey	Introduced in version: 1.0.0 Default value: None One of either kmsEncryptionKey, kmsEncryptionPath, or kmsEncryptionSecret is required. Local file system path for the Apigee KMS data's encryption key.
envs[].kmsEncryptionPath	Introduced in version: 1.2.0 Default value: None One of either kmsEncryptionKey, kmsEncryptionPath, or kmsEncryptionSecret is required. The path to a file containing a base64-encoded encryption key. See Data encryption.
envs[].kmsEncryptionSecret.key	Introduced in version: 1.2.0 Default value: None kmsEncryptionKey, kmsEncryptionPath, or kmsEncryptionSecret is required. The key of a Kubernetes secret containing a base64-encoded encryption key. See Data encryption.
envs[].kmsEncryptionSecret.name	Introduced in version: 1.2.0 Default value: None One of either kmsEncryptionKey, kmsEncryptionPath, or kmsEncryptionSecret is required. The name of a Kubernetes secret containing a base64-encoded encryption key. See Data encryption.
envs[].name	Introduced in version: 1.0.0 Default value: None Required Apigee environment name to be synchronized.
envs[].pollInterval	Introduced in version: 1.0.0 Default value: None Interval used for polling organization and environment synchronization changes, in seconds.
envs[].port	Introduced in version: 1.0.0 Default value: None TCP port number for HTTPS traffic.
envs[].serviceAccountPaths.synchronizer	Introduced in version: GA Default value: None Path to file on local system to a Google Service Account key with the Apigee Synchronizer Manager role.
envs[].serviceAccountPaths.udca	Introduced in version: GA Default value: None Path to file on local system to a Google Service Account key with the Apigee Analytic Agent role.
envs[].serviceAccountSecretRefs.synchronizer	Introduced in version: 1.2.0 Default value: None The name of a Kubernetes secret. You must create the secret using a Google Service Account key with the Apigee Synchronizer Manager role as its input.
envs[].serviceAccountSecretRefs.udca	Introduced in version: 1.2.0 Default value: None The name of a Kubernetes secret. You must create the secret using a Google Service Account key with the Apigee Analytic Agent role as its input.
envs[].sslCertPath	Introduced in version: 1.2.0 Default value: None Either sslCertPath/sslKeyPath or sslSecret is required. The path on your system to a TLS certificate file. Note: For each configured environment, the Common Name (CN) in the cert must match the domain in the hostAliases[] property. For example, if the CN is *.example.com, the hostAliases[] could be foo.example.com or bar.example.com.
envs[].sslKeyPath	Introduced in version: 1.2.0 Default value: None Either sslCertPath/sslKeyPath or sslSecret is required. The path on your system to the TLS private key file.
envs[].sslSecret	Introduced in version: 1.2.0 Default value: None Either sslCertPath/sslKeyPath or sslSecret is required. The name of a file stored in a Kubernetes secret that contains the TLS certificate and private key. You must create the secret using the TLS certificate and key data as its input. See also: Storing data in a Kubernetes secret Secrets in the Kubernetes documentation Creating a Secret Using kubectl in the Kubernetes documentation

gcp

Identifies the Google Cloud project ID and region where the apigee-logger and the apigee-metrics push their data.

The following table describes the properties of the gcp object:

Property	Description
gcp.region	Introduced in version: 1.2.0 Default value: None Required Identifies the Google Cloud region where the apigee-logger and the apigee-metrics push their data.
gcp.projectID	Introduced in version: 1.2.0 Default value: None Required Identifies the Google Cloud project where apigee-logger and the apigee-metrics push their data.
gcp.projectIDRuntime	Introduced in version: 1.2.0 Default value: None Identifies the runtime Kubernetes cluster project. The projectIDRuntime property is optional. If not used, it is assumed that the projectID value is used for both the Apigee organization's Google Cloud project and the runtime K8S cluster's project.

httpProxy

httpProxy provides configuration parameters for an HTTP forward proxy server. When configured in overrides.yaml, all internet communication for the MART, Synchronizer, and UDCA components pass through the proxy server.

Note: You can also configure environment-scoped HTTP proxy forwarding for API proxies. See Configure proxy forwarding for API proxies.

See also: logger, mart, metrics, synchronizer, and udca.

The following table describes the properties of the httpProxy object:

Property	Description
httpProxy.host	Introduced in version: 1.1.1 Default value: None The hostname of the HTTP Proxy.
httpProxy.port	Introduced in version: 1.1.1 Default value: None The port of the HTTP Proxy.
httpProxy.scheme	Introduced in version: 1.1.1 Default value: HTTPS The scheme used by the proxy. Values can be HTTP or HTTPS. Values must be uppercase only.

k8sCluster

Identifies Kubernetes cluster where the hybrid runtime is installed.

The following table describes the properties of the k8sCluster object:

Property	Description
k8sCluster.name	Introduced in version: 1.2.0 Default value: None The name of the Kubernetes cluster where the hybrid runtime is installed.
k8sCluster.region	Introduced in version: 1.2.0 Default value: None Identifies the Google Cloud region in which your Kubernetes cluster was created.

kubeRBACProxy

Identifies where Apigee should look for Kubernetes role-based access controls.

The following table describes the properties of the kubeRBACProxy object:

Property	Description
kubeRBACProxy.image.pullPolicy	Introduced in version: 1.2.0 Default value: IfNotPresent Determines when kubelet pulls the pod's Docker image. Possible values include: IfNotPresent: Do not pull a new image if it already exists. Always: Always pull the image, regardless of whether it exists already. For more information, see Updating images.
kubeRBACProxy.image.tag	Introduced in version: v0.4.1 Default value: 1.2.0 The version label for this service's Docker image.
kubeRBACProxy.image.url	Introduced in version: 1.2.0 Default value: google/apigee-kube-rbac-proxy The location of the Docker image for this service. If you do not want to use the Google Docker Hub, download the images and use the address where your docker images are hosted internally.

logger

Defines the service that manages operational logs. All of the Apigee hybrid services that run in your Kubernetes cluster output this information.

For more information, see Logging overview.

The following table describes the properties of the logger object:

Property	Description
logger.enabled	Introduced in version: 1.0.0 Default value: false Enables or disables logging on the cluster. For non-GKE set to true, for Anthos or GKE set to false.
logger.fluentd.buffer_chunk_limit	Introduced in version: 1.0.0 Default value: 512k The maximum size of a buffer chunk allowed, in kilobytes. Chunks exceeding the limit will be flushed to the output queue automatically.
logger.fluentd.buffer_queue_limit	Introduced in version: 1.0.0 Default value: 6 The maximum length of the output queue. The default limit is 256 chunks.
logger.fluentd.flush_interval	Introduced in version: 1.0.0 Default value: 5s The interval to wait before invoking the next buffer flush, in seconds.
logger.fluentd.max_retry_wait	Introduced in version: 1.0.0 Default value: 30 The maximum interval between write retries, in seconds.
logger.fluentd.num_threads	Introduced in version: 1.0.0 Default value: 2 The number of threads used to flush the buffer. The default is 1.
logger.image.pullPolicy	Introduced in version: 1.0.0 Default value: IfNotPresent Determines when kubelet pulls the pod's Docker image. Possible values include: IfNotPresent: Do not pull a new image if it already exists. Always: Always pull the image, regardless of whether it exists already. For more information, see Updating images.
logger.image.tag	Introduced in version: 1.0.0 Default value: 1.6.8 The version label for this service's Docker image.
logger.image.url	Introduced in version: 1.0.0 Default value: google/apigee-stackdriver-logging-agent The location of the Docker image for this service.
logger.livenessProbe.failureThreshold	Introduced in version: 1.0.0 Default value: 3 The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1.
logger.livenessProbe.initialDelaySeconds	Introduced in version: 1.0.0 Default value: 0 The number of seconds after a container is started before a liveness probe is initiated.
logger.livenessProbe.periodSeconds	Introduced in version: 1.0.0 Default value: 60 Determines how often to perform a liveness probe, in seconds. The minimum value is 1.
logger.livenessProbe.successThreshold	Introduced in version: 1.0.0 Default value: 1 The minimum consecutive successes needed for a liveness probe to be considered successful after a failure. The minimum value is 1.
logger.livenessProbe.timeoutSeconds	Introduced in version: 1.0.0 Default value: 1 The number of seconds after which a liveness probe times out. The minimum value is 1.
logger.nodeSelector.key	Introduced in version: 1.0.0 Default value: apigee.com/apigee-logger-enabled Required Node selector label key used to target dedicated Kubernetes nodes for logger runtime services. See Configuring dedicated node pools.
logger.nodeSelector.value	Introduced in version: 1.0.0 Default value: true Required Node selector label value used to target dedicated Kubernetes nodes for logger runtime services. See Configuring dedicated node pools.
logger.proxyURL	Introduced in version: 1.0.0 Default value: None URL of the customer's proxy server.
logger.resources.limits.memory	Introduced in version: 1.0.0 Default value: 500Mi The memory limit for the resource in a Kubernetes container, in mebibytes.
logger.resources.limits.cpu	Introduced in version: 1.0.0 Default value: 200m The CPU limit for the resource in a Kubernetes container, in millicores.
logger.resources.requests.cpu	Introduced in version: 1.0.0 Default value: 100m The CPU needed for normal operation of the resource in a Kubernetes container, in millicores.
logger.resources.requests.memory	Introduced in version: 1.0.0 Default value: 250Mi The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes.
logger.serviceAccountPath	Introduced in version: 1.0.0 Default value: None One of either serviceAccountPath or serviceAccountSecretRef is required. Path to Google Service Account key file with Logs Writer role.
logger.serviceAccountSecretRef	Introduced in version: 1.2.0 Default value: None One of either serviceAccountPath or serviceAccountSecretRef is required. The name of a Kubernetes secret. You must create the secret using a Google Service Account key with the Logs Writer role as its input.
logger.terminationGracePeriodSeconds	Introduced in version: 1.0.0 Default value: 30 The time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully.

mart

Defines the MART (Management API for RunTime data) service, which acts as an API provider for public Apigee APIs so that you can access and manage runtime data entities such as KMS (API Keys and OAuth tokens), KVM, Quota, and API products.

The following table describes the properties of the mart object:

Property	Description
mart.hostAlias	Introduced in version: 1.0.0 Default value: None The host alias pointing to the MART object. You can set this property to * or a fully-qualified domain name.
mart.image.pullPolicy	Introduced in version: 1.0.0 Default value: IfNotPresent Determines when kubelet pulls the pod's Docker image. Possible values include: IfNotPresent: Do not pull a new image if it already exists. Always: Always pull the image, regardless of whether it exists already. For more information, see Updating images.
mart.image.tag	Introduced in version: 1.0.0 Default value: 1.2.0 The version label for this service's Docker image.
mart.image.url	Introduced in version: 1.0.0 Default value: google/apigee-mart-server The location of the Docker image for this service. Check the values.yaml file for the specific URL.You can override this.
mart.initCheckCF.resources.requests.cpu	Introduced in version: 1.0.0 Default value: 10m The amount of CPU resources allocated to the initialization check of the Cloud Foundry process.
mart.livenessProbe.failureThreshold	Introduced in version: 1.0.0 Default value: 12 The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1.
mart.livenessProbe.initialDelaySeconds	Introduced in version: 1.0.0 Default value: 15 The number of seconds after a container is started before a liveness probe is initiated.
mart.livenessProbe.periodSeconds	Introduced in version: 1.0.0 Default value: 5 Determines how often to perform a liveness probe, in seconds. The minimum value is 1.
mart.livenessProbe.timeoutSeconds	Introduced in version: 1.0.0 Default value: 1 The number of seconds after which a liveness probe times out. The minimum value is 1.
mart.metricsURL	Introduced in version: 1.0.0 Default value: /v1/server/metrics
mart.nodeSelector.key	Introduced in version: 1.0.0 Default value: None Optional node selector label key for targeting Kubernetes nodes for mart runtime services. If you do not specify a key for mart.nodeselector, then your runtime uses the node specified in the nodeSelector object. See Configuring dedicated node pools.
mart.nodeSelector.value	Introduced in version: 1.0.0 Default value: None Optional node selector label value for targeting Kubernetes nodes for mart runtime services. See also the nodeSelector object. See Configuring dedicated node pools.
mart.readinessProbe.failureThreshold	Introduced in version: 1.0.0 Default value: 2 The number of times Kubernetes will verify that readiness probes have failed before marking the pod unready. The minimum value is 1.
mart.readinessProbe.initialDelaySeconds	Introduced in version: 1.0.0 Default value: 15 The number of seconds after a container is started before a readiness probe is initiated.
mart.readinessProbe.periodSeconds	Introduced in version: 1.0.0 Default value: 5 Determines how often to perform a readiness probe, in seconds. The minimum value is 1.
mart.readinessProbe.successThreshold	Introduced in version: 1.0.0 Default value: 1 The minimum consecutive successes needed for a readiness probe to be considered successful after a failure. The minimum value is 1.
mart.readinessProbe.timeoutSeconds	Introduced in version: 1.0.0 Default value: 1 The number of seconds after which a liveness probe times out. The minimum value is 1.
mart.replicaCountMax	Introduced in version: 1.0.0 Default value: 5 Maximum number of replicas available for autoscaling.
mart.replicaCountMin	Introduced in version: 1.0.0 Default value: 1 Minimum number of replicas available for autoscaling.
mart.resources.requests.cpu	Introduced in version: 1.0.0 Default value: 500m The CPU needed for normal operation of the resource in a Kubernetes container, in millicores.
mart.resources.requests.memory	Introduced in version: 1.0.0 Default value: 512Mi The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes.
mart.serviceAccountPath	Introduced in version: 1.1.1 Default value: None One of either serviceAccountPath or serviceAccountSecretRef is required. Path to Google Service Account key file with no role.
mart.serviceAccountSecretRef	Introduced in version: 1.2.0 Default value: None One of either serviceAccountPath or serviceAccountSecretRef is required. The name of a Kubernetes secret. You must create the secret using a Google Service Account key with no role as its input.
mart.sslCertPath	Introduced in version: 1.0.0 Default value: None Either sslCertPath/sslKeyPath or sslSecret is required. Local file system path for loading and encoding the SSL cert to a Secret.
mart.sslKeyPath	Introduced in version: 1.0.0 Default value: None Either sslCertPath/sslKeyPath or sslSecret is required. Local file system path for loading and encoding the SSL key to a Secret.
mart.sslSecret	Introduced in version: 1.2.0 Default value: None Either sslCertPath/sslKeyPath or sslSecret is required. The name of a file stored in a Kubernetes secret that contains the TLS certificate and private key. You must create the secret using the TLS certificate and key data as its input. See also: Storing data in a Kubernetes secret Secrets in the Kubernetes documentation Creating a Secret Using kubectl in the Kubernetes documentation
mart.targetCPUUtilizationPercentage	Introduced in version: 1.0.0 Default value: 75 Target CPU utilization for the MART process on the pod. The value of this field enables MART to auto-scale when CPU utilization reaches this value, up to replicaCountMax.
mart.terminationGracePeriodSeconds	Introduced in version: 1.0.0 Default value: 30 The time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully.

metrics

Defines the service that collects operations metrics. You can use metrics data to monitor the health of Hybrid services, to set up alerts, and so on.

For more information, see Metrics collection overview.

The following table describes the properties of the metrics object:

Property	Description
metrics.enabled	Introduced in version: 1.0.0 Default value: true Enables Apigee metrics. Set to true to enable metrics. Set to false to disable metrics.
metrics.nodeSelector.key	Introduced in version: 1.0.0 Default value: None Required Node selector label key used to target dedicated Kubernetes nodes for metrics runtime services. See Configuring dedicated node pools.
metrics.nodeSelector.value	Introduced in version: 1.0.0 Default value: None Required Node selector label value used to target dedicated Kubernetes nodes for metrics runtime services. See Configuring dedicated node pools.
metrics.prometheus.args.storage_tsdb_retention	Introduced in version: 1.0.0 Default value: 48h The amount of time Prometheus waits before removing old data from local storage, in hours.
metrics.prometheus.containerPort	Introduced in version: 1.0.0 Default value: 9090 The port to connect to the Prometheus metrics service.
metrics.prometheus.image.pullPolicy	Introduced in version: 1.0.0 Default value: IfNotPresent Determines when kubelet pulls the pod's Docker image. Possible values include: IfNotPresent: Do not pull a new image if it already exists. Always: Always pull the image, regardless of whether it exists already. For more information, see Updating images.
metrics.prometheus.image.tag	Introduced in version: 1.0.0 Default value: v2.9.2 The version label for this service's Docker image.
metrics.prometheus.image.url	Introduced in version: 1.0.0 Default value: google/apigee-prom-prometheus The location of the Docker image for this service.
metrics.prometheus.livenessProbe.failureThreshold	Introduced in version: 1.0.0 Default value: 6 The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1.
metrics.prometheus.livenessProbe.periodSeconds	Introduced in version: 1.0.0 Default value: 5 Determines how often to perform a liveness probe, in seconds. The minimum value is 1.
metrics.prometheus.livenessProbe.timeoutSeconds	Introduced in version: 1.0.0 Default value: 3 The number of seconds after which a liveness probe times out. The minimum value is 1.
metrics.prometheus.readinessProbe.failureThreshold	Introduced in version: 1.0.0 Default value: 120 The number of times Kubernetes will verify that readiness probes have failed before marking the pod unready. The minimum value is 1.
metrics.prometheus.readinessProbe.periodSeconds	Introduced in version: 1.0.0 Default value: 5 Determines how often to perform a readiness probe, in seconds. The minimum value is 1.
metrics.prometheus.readinessProbe.timeoutSeconds	Introduced in version: 1.0.0 Default value: 3 The number of seconds after which a liveness probe times out. The minimum value is 1.
prometheus.sslCertPath	Introduced in version: 1.0.0 Default value: None Required Path to the SSL cert for the Prometheus metrics collection process. Prometheus is a tool Apigee can use for collecting and processing metrics. See: metrics For background information, the Prometheus website
prometheus.sslKeyPath	Introduced in version: 1.0.0 Default value: None Required Path to the SSL Key for the Prometheus metrics collection process. Prometheus is a tool Apigee can use for collecting and processing metrics. See: metrics For background information, the Prometheus website
metrics.proxyURL	Introduced in version: 1.0.0 Default value: None URL for the metrics process sidecar proxy in the Kubernetes cluster.
metrics.resources.limits.cpu	Introduced in version: 1.0.0 Default value: 250m The CPU limit for the resource in a Kubernetes container, in millicores.
metrics.resources.limits.memory	Introduced in version: 1.0.0 Default value: 256Mi The memory limit for the resource in a Kubernetes container, in mebibytes.
metrics.resources.requests.cpu	Introduced in version: 1.0.0 Default value: 250m The CPU needed for normal operation of the resource in a Kubernetes container, in millicores.
metrics.resources.requests.memory	Introduced in version: 1.0.0 Default value: 256Mi The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes.
metrics.sdSidecar.containerPort	Introduced in version: 1.0.0 Default value: 9091 The port for connecting to the Cloud Operations metrics service.
metrics.sdSidecar.image.pullPolicy	Introduced in version: 1.0.0 Default value: IfNotPresent Determines when Kubelet pulls this service's Docker image. Possible values include: IfNotPresent: Do not pull a new image if it already exists Always: Always pull the policy, even if it already exists For more information, see Updating images.
metrics.sdSidecar.image.tag	Introduced in version: 1.0.0 Default value: release-0.4.0 The version label for this service's Docker image.
metrics.sdSidecar.image.url	Introduced in version: 1.0.0 Default value: google/apigee-stackdriver-prometheus-sidecar The location of the Docker image for this service.
metrics.serviceAccountPath	Introduced in version: 1.0.0 Default value: None One of either serviceAccountPath or serviceAccountSecretRef is required. Path to Google Service Account key file with Monitoring Metric Writer role.
metrics.serviceAccountSecretRef	Introduced in version: 1.2.0 Default value: None One of either serviceAccountPath or serviceAccountSecretRef is required. The name of a Kubernetes secret. You must create the secret using a Google Service Account key with the Monitoring Metric Writer role as its input.
metrics.terminationGracePeriodSeconds	Introduced in version: 1.0.0 Default value: 300 The time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully.

nodeSelector

The nodeSelector object defines the node for your Apigee instance. Behind the scenes when apigeectl runs, it is taking care to map the label key/value for apigeeRuntime and apigeeData to the individual Istio and MART components. You can override this for individual objects in the mart:nodeSelector property.

The following table describes the properties of the nodeSelector object:

Property	Description
nodeSelector.apigeeData.key	Introduced in version: 1.0.0 Default value: cloud.google.com/gke-nodepool ApigeeData is the node for the Cassandra database. Node selector label key for targeting Kubernetes nodes for working with Apigee services data. See Configure dedicated node pools.
nodeSelector.apigeeData.value	Introduced in version: 1.0.0 Default value: apigee-data apigee-data is the node for the Cassandra database. Node selector label value for targeting Kubernetes nodes for working with Apigee services data. See Configure dedicated node pools.
nodeSelector.apigeeRuntime.key	Introduced in version: 1.0.0 Default value: cloud.google.com/gke-nodepool Apigee Runtime is the node for the runtime environment for the project. Node selector label key for targeting Kubernetes nodes for Apigee runtime services. See Configure dedicated node pools.
nodeSelector.apigeeRuntime.value	Introduced in version: 1.0.0 Default value: apigee-runtime apigee-runtime is the node for the runtime environment for the project. Node selector label value for targeting Kubernetes nodes for Apigee runtime services. See Configure dedicated node pools.
nodeSelector.requiredForScheduling	Introduced in version: 1.0.0 Default value: false The requiredForScheduling property defaults to false. If this value is overridden to true, it means that if Kubernetes cannot find nodes with the label key/value that is configured then the underlying Pods will not get scheduled on VM worker nodes. For production, nodeSelector.requiredForScheduling should be set to true. See Configure dedicated node pools.

runtime

The following table describes the properties of the runtime object:

Property	Description
runtime.image.pullPolicy	Introduced in version: 1.0.0 Default value: IfNotPresent Determines when kubelet pulls the pod's Docker image. Possible values include: IfNotPresent: Do not pull a new image if it already exists. Always: Always pull the image, regardless of whether it exists already. For more information, see Updating images.
runtime.image.tag	Introduced in version: 1.0.0 Default value: 1.2.0 The version label for this service's Docker image.
runtime.image.url	Introduced in version: 1.0.0 Default value: URL to your installation's image resource, for example: google/apigee-runtime The location of the Docker image for this service.
runtime.livenessProbe.failureThreshold	Introduced in version: 1.0.0 Default value: 2 The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1.
runtime.livenessProbe.initialDelaySeconds	Introduced in version: 1.0.0 Default value: 60 The number of seconds after a container is started before a liveness probe is initiated.
runtime.livenessProbe.periodSeconds	Introduced in version: 1.0.0 Default value: 5 Determines how often to perform a liveness probe, in seconds. The minimum value is 1.
runtime.livenessProbe.timeoutSeconds	Introduced in version: 1.0.0 Default value: 1 The number of seconds after which a liveness probe times out. The minimum value is 1.
runtime.nodeSelector.key	Introduced in version: 1.0.0 Default value: None Optional Node selector label key for targeting Kubernetes nodes for runtime services. See nodeSelector property.
runtime.nodeSelector.value	Introduced in version: 1.0.0 Default value: None Node selector label value for targeting Kubernetes nodes for runtime services. See Configuring dedicated node pools.
runtime.readinessProbe.failureThreshold	Introduced in version: 1.0.0 Default value: 2 The number of times Kubernetes will verify that readiness probes have failed before marking the pod unready. The minimum value is 1.
runtime.readinessProbe.initialDelaySeconds	Introduced in version: 1.0.0 Default value: 60 The number of seconds after a container is started before a readiness probe is initiated.
runtime.readinessProbe.periodSeconds	Introduced in version: 1.0.0 Default value: 5 Determines how often to perform a readiness probe, in seconds. The minimum value is 1.
runtime.readinessProbe.successThreshold	Introduced in version: 1.0.0 Default value: 1 The minimum consecutive successes needed for a readiness probe to be considered successful after a failure. The minimum value is 1.
runtime.readinessProbe.timeoutSeconds	Introduced in version: 1.0.0 Default value: 1 The number of seconds after which a liveness probe times out. The minimum value is 1.
runtime.replicaCountMax	Introduced in version: 1.0.0 Default value: 4 Maximum number of replicas available for autoscaling.
runtime.replicaCountMin	Introduced in version: 1.0.0 Default value: 1 Minimum number of replicas available for autoscaling.
runtime.resources.requests.cpu	Introduced in version: 1.0.0 Default value: 500m The CPU needed for normal operation of the resource in a Kubernetes container, in millicores. Note: To achieve smooth autoscaling of the message processors to accommodate traffic increases, we recommend that you do not exceed 2 cores (2000 millicores) if you decide to override the default. Apigee runtime components are bounded by I/O, and adding more CPU capacity does not always help with traffic increases. When there are high CPU requests, message processors may not autoscale and liveliness probes may fail with high traffic.
runtime.resources.requests.memory	Introduced in version: 1.0.0 Default value: 512Mi (see note below) The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes (Mi) or Gibibytes (Gi). Note: Reset the value of runtime.resources.requests.memory to at least 1Gi in your overrides.yaml. The default of 512Mi is enough for initial operation and configuration, but should be raised for production. To achieve smooth autoscaling of the message processors to accommodate traffic increases, we recommend that you do not exceed 2.5Gi (2560Mi) if you decide to override the default.
runtime.service.type	Introduced in version: 1.0.0 Default value: ClusterIP The type of service. You can set this to a service other than ClusterIP; for example, LoadBalancer.
runtime.targetCPUUtilizationPercentage	Introduced in version: 1.0.0 Default value: 75 Target CPU utilization for the runtime process on the pod. The value of this field enables the runtime to auto-scale when CPU utilization reaches this value, up to replicaCountMax.
runtime.terminationGracePeriodSeconds	Introduced in version: 1.0.0 Default value: 180 The time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully.

synchronizer

Ensures that the Message Processors are kept up to date with the latest deployed API proxy bundles. To do this, the Synchronizer polls the management plane; when a new contract is detected, the Synchronizer sends it to the runtime plane.

For more information, see Synchronizer.

The following table describes the properties of the synchronizer object:

Property	Description
synchronizer.image.pullPolicy	Introduced in version: 1.0.0 Default value: IfNotPresent Determines when kubelet pulls the pod's Docker image. Possible values include: IfNotPresent: Do not pull a new image if it already exists. Always: Always pull the image, regardless of whether it exists already. For more information, see Updating images.
synchronizer.image.tag	Introduced in version: 1.0.0 Default value: 1.2.0 The version label for this service's Docker image.
synchronizer.image.url	Introduced in version: 1.0.0 Default value: google/apigee-synchronizer The location of the Docker image for this service.
synchronizer.livenessProbe.failureThreshold	Introduced in version: 1.0.0 Default value: 2 The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1.
synchronizer.livenessProbe.initialDelaySeconds	Introduced in version: 1.0.0 Default value: 0 The number of seconds after a container is started before a liveness probe is initiated.
synchronizer.livenessProbe.periodSeconds	Introduced in version: 1.0.0 Default value: 5 Determines how often to perform a liveness probe, in seconds. The minimum value is 1.
synchronizer.livenessProbe.timeoutSeconds	Introduced in version: 1.0.0 Default value: 1 The number of seconds after which a liveness probe times out. The minimum value is 1.
synchronizer.nodeSelector.key	Introduced in version: 1.0.0 Default value: None Required Optional node selector label key for targeting Kubernetes nodes for synchronizer runtime services. See nodeSelector.
synchronizer.nodeSelector.value	Introduced in version: 1.0.0 Default value: None Optional node selector label value used for targeting Kubernetes nodes for synchronizer runtime services. See nodeSelector.
synchronizer.pollInterval	Introduced in version: 1.0.0 Default value: 60 The length of time that Synchronizer waits between polling operations. Synchronizer polls Apigee control plane services to detect and pull new runtime contracts.
synchronizer.readinessProbe.failureThreshold	Introduced in version: 1.0.0 Default value: 2 The number of times Kubernetes will verify that readiness probes have failed before marking the pod unready. The minimum value is 1.
synchronizer.readinessProbe.initialDelaySeconds	Introduced in version: 1.0.0 Default value: 0 The number of seconds after a container is started before a readiness probe is initiated.
synchronizer.readinessProbe.periodSeconds	Introduced in version: 1.0.0 Default value: 5 Determines how often to perform a readiness probe, in seconds. The minimum value is 1.
synchronizer.readinessProbe.successThreshold	Introduced in version: 1.0.0 Default value: 1 The minimum consecutive successes needed for a readiness probe to be considered successful after a failure. The minimum value is 1.
synchronizer.readinessProbe.timeoutSeconds	Introduced in version: 1.0.0 Default value: 1 The number of seconds after which a liveness probe times out. The minimum value is 1.
synchronizer.replicaCount	Introduced in version: 1.0.0 Default value: 2 Number of replicas for autoscaling.
synchronizer.replicaCountMax	Introduced in version: 1.2.0 Default value: 4 Maximum number of replicas for autoscaling.
synchronizer.replicaCountMin	Introduced in version: 1.2.0 Default value: 1 Minimum number of replicas for autoscaling.
synchronizer.resources.requests.cpu	Introduced in version: 1.0.0 Default value: 100m The CPU needed for normal operation of the resource in a Kubernetes container, in millicores.
synchronizer.resources.requests.memory	Introduced in version: 1.0.0 Default value: 1Gi The memory needed for normal operation of the resource in a Kubernetes container, in gigabytes.
synchronizer.serviceAccountPath	Introduced in version: 1.0.0 Default value: None One of either serviceAccountPath or serviceAccountSecretRef is required. Path to Google Service Account key file with Apigee Synchronizer Manager role.
synchronizer.serviceAccountSecretRef	Introduced in version: 1.2.0 Default value: None One of either serviceAccountPath or serviceAccountSecretRef is required. The name of a Kubernetes secret. You must create the secret using a Google Service Account key with the Apigee Synchronizer Manager role as its input.
synchronizer.targetCPUUtilizationPercentage	Introduced in version: 1.0.0 Default value: 75 Target CPU utilization for the Synchronizer process on the pod. The value of this field enables Synchronizer to auto-scale when CPU utilization reaches this value, up to replicaCountMax.
synchronizer.terminationGracePeriodSeconds	Introduced in version: 1.0.0 Default value: 30 The time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully.

udca

(Universal Data Collection Agent) Defines the service that runs within the data collection pod in the runtime plane. This service extracts analytics and deployment status data and sends it to the Unified Analytics Platform (UAP).

For more information, see Analytics and deployment status data collection.

The following table describes the properties of the udca object:

Property	Description
udca.fluentd.image.pullPolicy	Introduced in version: 1.0.0 Default value: IfNotPresent Determines when kubelet pulls the pod's Docker image. Possible values include: IfNotPresent: Do not pull a new image if it already exists. Always: Always pull the image, regardless of whether it exists already. For more information, see Updating images.
udca.fluentd.image.tag	Introduced in version: 1.0.0 Default value: 1.2.0 The version label for this service's Docker image.
udca.fluentd.image.url	Introduced in version: 1.0.0 Default value: google/apigee-stackdriver-logging-agent The location of the Docker image for this service.
udca.fluentd.resource.limits.memory	Introduced in version: 1.0.0 Default value: 500Mi The memory limit for the resource in a Kubernetes container, in mebibytes.
udca.fluentd.resource.requests.cpu	Introduced in version: 1.0.0 Default value: 500m The CPU needed for normal operation of the resource in a Kubernetes container, in millicores.
udca.fluentd.resource.requests.memory	Introduced in version: 1.0.0 Default value: 250Mi The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes.
udca.image.pullPolicy	Introduced in version: 1.0.0 Default value: IfNotPresent Determines when kubelet pulls the pod's Docker image. Possible values include: IfNotPresent: Do not pull a new image if it already exists. Always: Always pull the image, regardless of whether it exists already. For more information, see Updating images.
udca.image.tag	Introduced in version: 1.0.0 Default value: 1.2.0 The version label for this service's Docker image.
udca.image.url	Introduced in version: 1.0.0 Default value: google/apigee-udca The location of the Docker image for this service.
udca.jvmXms	Introduced in version: 1.0.0 Default value: 256m The starting amount of memory for the data collection pod's JVM.
udca.jvmXmx	Introduced in version: 1.0.0 Default value: 256m The maximum allocation of memory for the data collection pod's JVM.
udca.livenessProbe.failureThreshold	Introduced in version: 1.0.0 Default value: 2 The number of times Kubernetes will verify that liveness probes have failed before restarting the container. The minimum value is 1.
udca.livenessProbe.initialDelaySeconds	Introduced in version: 1.0.0 Default value: 0 The number of seconds after a container is started before a liveness probe is initiated.
udca.livenessProbe.periodSeconds	Introduced in version: 1.0.0 Default value: 5 Determines how often to perform a liveness probe, in seconds. The minimum value is 1.
udca.livenessProbe.timeoutSeconds	Introduced in version: 1.0.0 Default value: 1 The number of seconds after which a liveness probe times out. The minimum value is 1.
udca.nodeSelector.key	Introduced in version: 1.0.0 Default value: None Required Node selector label key used to target dedicated Kubernetes nodes for udca runtime services. See Configuring dedicated node pools.
udca.nodeSelector.value	Introduced in version: 1.0.0 Default value: None Required Node selector label value used to target dedicated Kubernetes nodes for udca runtime services. See Configuring dedicated node pools.
udca.pollingIntervalInSec	Introduced in version: 1.0.0 Default value: 1 The length of time, in seconds, that UDCA waits between polling operations. UDCA polls the data directory on the data collection pod's file system to detect new files to be uploaded.
udca.replicaCountMax	Introduced in version: 1.0.0 Default value: 4 The maximum number of pods that hybrid can automatically add for the UDCA deployment. Because UDCA is implemented as a ReplicaSet, the pods are replicas.
udca.replicaCountMin	Introduced in version: 1.0.0 Default value: 1 The minimum number of pods for the UDCA deployment. Because UDCA is implemented as a ReplicaSet, the pods are replicas. If the CPU usage goes above udca.targetCPUUtilizationPercentage, then hybrid will gradually increase the number of pods, up to udca.replicaCountMax.
udca.resources.requests.cpu	Introduced in version: 1.0.0 Default value: 250m The CPU needed for normal operation of the resource in a Kubernetes container, in millicores.
udca.revision	Introduced in version: 1 Default value: v1 A static value that is populated in a label to enable canary deployments.
udca.serviceAccountPath	Introduced in version: 1.0.0 Default value: None One of either serviceAccountPath or serviceAccountSecretRef is required. Path to Google Service Account key file with Apigee Analytics Agent role.
udca.serviceAccountSecretRef	Introduced in version: 1.2.0 Default value: None One of either serviceAccountPath or serviceAccountSecretRef is required. The name of a Kubernetes secret. You must create the secret using a Google Service Account key with the Apigee Analytics Agent role as its input.
udca.targetCPUUtilizationPercentage	Introduced in version: 1.0.0 Default value: 75 The threshold of CPU usage for scaling the number of pods in the ReplicaSet, as a percentage of total available CPU resources. Hybrid uses the combined utilization of all containers in the data collection pod (both fluentd and UDCA) to calculate the current utilization. When CPU usage goes above this value, then hybrid will gradually increase the number of pods in the ReplicaSet, up to udca.replicaCountMax.
udca.terminationGracePeriodSeconds	Introduced in version: 1.0.0 Default value: 600 The time between a request for pod deletion and when the pod is killed, in seconds. During this period, any prestop hooks will be executed and any running process should terminate gracefully.

virtualhosts

The virtualhosts property is a required configuration property. Virtual hosts allow Apigee hybrid to handle API requests to a specified environment group..

For more information, see Configure virtual hosts.

The following table describes the properties of the virtualhosts object:

Property	Description
virtualhosts[].additionalGateways	Introduced in version: 1.2.0 Default value: None A list of Istio Gateways to route traffic to.
virtualhosts[].name	Introduced in version: 1.2.0 Default value: None Required The name of the virtual host.
virtualhosts[].hostAliases[]	Introduced in version: 1.2.0 Default value: None Required One or more DNS names for your server. For example, foo-test.mydomain.com. If you employ multiple host aliases in a virtual host, each host alias must be unique. For example, foo-test.mydomain.com and foo-prod.mydomain.com. If you create multiple virtual host definitions, you must have unique host aliases in each one. In other words, two virtual host definitions cannot include the same host alias domain name. Note: You can use a subdomain wildcard in the host alias. For example: *.mydomain.com. However, the single wildcard character configuration hostAliases['*'] is not supported.
virtualhosts[].maxTLSProtocolVersion	Introduced in version: 1.3.0 Default value: None The maximum version of the TLS protocol Envoy can select. Envoy automatically uses the optimal TLS protocol version between virtualhosts[].minTLSProtocolVersion and virtualhosts[].maxTLSProtocolVersion. The value must be in the form of a number. For example: virtualhosts: - name: default maxTLSProtocolVersion: "1.3" Where the number represents the TLS version number in the form #.#. In the example above, 1.3 represents the Istio TLS version TLSV1_3. See also ServerTLSSettings.TLSProtocol in the Istio documentation.
virtualhosts[].minTLSProtocolVersion	Introduced in version: 1.3.0 Default value: None The minimum version of the TLS protocol Envoy can select. Envoy automatically uses the optimal TLS protocol version between virtualhosts[].minTLSProtocolVersion and virtualhosts[].maxTLSProtocolVersion. The value must be in the form of a number. For example: virtualhosts: - name: default minTLSProtocolVersion: "1.2" Where the number represents the TLS version number in the form #.#. In the example above, 1.2 represents the Istio TLS version TLSV1_2. See also ServerTLSSettings.TLSProtocol in the Istio documentation.
virtualhosts[].selector	Introduced in version: 1.2.0 Default value: app: istio-ingressgateway Required A key-value selector-value pair for pointing to different ingress selectors.
virtualhosts[].sslCertPath	Introduced in version: 1.2.0 Default value: None Either sslCertPath/sslKeyPath or sslSecret is required. The path on your system to a TLS certificate file. Note: For each configured environment, the Common Name (CN) in the cert must match the domain in the hostAliases[] property. For example, if the CN is *.example.com, the hostAliases[] could be foo.example.com or bar.example.com.
virtualhosts[].sslKeyPath	Introduced in version: 1.2.0 Default value: None Either sslCertPath/sslKeyPath or sslSecret is required. The path on your system to the TLS private key file.
virtualhosts[].sslSecret	Introduced in version: 1.2.0 Default value: None Either sslCertPath/sslKeyPath or sslSecret is required. The name of a file stored in a Kubernetes secret that contains the TLS certificate and private key. You must create the secret using the TLS certificate and key data as its input. See also: Storing data in a Kubernetes secret Secrets in the Kubernetes documentation Creating a Secret Using kubectl in the Kubernetes documentation

watcher

The watcher property is a required configuration property. The watcher is a process that watches for configuration changes and triggers their application to the runtime plane..

The following table describes the properties of the watcher object:

Property	Description
watcher.replicaCountMax	Introduced in version: 1.0.0 Default value: 1 The maximum number of watcher replicas. This should be kept at 1 to avoid conflicts.
watcher.replicaCountMin	Introduced in version: 1.0.0 Default value: 1 The minimum number of watcher replicas.
watcher.serviceAccountPath	Introduced in version: 1.0.0 Default value: None Required. Path to Google Service Account key file with Apigee Runtime Agent role.