Para habilitar el acceso del sincronizador, haz lo siguiente:
Crea una cuenta de servicio de Google Cloud y agrégale la función Administrador de la organización de Apigee. Esta cuenta de servicio se usará para autenticar una llamada a la API que realizarás en un paso posterior. Una forma sencilla de crear la cuenta de servicio es a través de GCP Console.
Para obtener instrucciones, consulta Crea y administra cuentas de servicio en la documentación de GCP.
Por ejemplo, con los siguientes comandos gcloud, se creará la cuenta de servicio y se le asignará la función Administrador de la organización de Apigee:
Crea la cuenta:
gcloud iam service-accounts create apigee-org-admin \
--display-name="apigee-org-admin"
En que apigee-org-admin es el nombre de la cuenta de servicio que creas.
Se recomienda “apigee-org-admin” para este instructivo.
Asigna la función Administrador de la organización de Apigee a la cuenta de servicio:
apigee-org-admin es el nombre de la cuenta de servicio que acabas de crear.
roles/apigee.admin es la función Administrador de la organización de Apigee.
Descarga la clave de la cuenta de servicio a tu sistema. Usa el siguiente comando para descargar la clave en tu directorio service-accounts/. Para obtener más información, consulta las instrucciones en Crea claves de cuentas de servicio en la documentación de GCP.
Asegúrate de estar en el directorio /hybrid-base-directory/hybrid-files/.
Descarga la clave:
gcloud iam service-accounts keys create ./service-accounts/$PROJECT_ID-apigee-org-admin.json \
--iam-account apigee-org-admin@$PROJECT_ID.iam.gserviceaccount.com
El resultado debería ser similar a lo siguiente:
created key [a0b1c2d3e4f5a0b1c2d3e4f5a0b1c2d3e4f5a0b1] of type [json] as [./service-accounts/hybrid-
example-apigee-org-admin.json] for [apigee-org-admin@my-hybrid.iam.gserviceaccount.com]
$
Verifica la ruta a la clave de la cuenta de servicio de Administrador de la organización de Apigee con el siguiente comando:
$ORG_NAME: Es el nombre de tu organización híbrida.
apigee-synchronizer$ORG_NAME.iam.gserviceaccount.com: Es la dirección de correo electrónico de la cuenta de servicio de apigee-syncnronizer.
A fin de verificar que se haya configurado la cuenta de servicio, usa el siguiente comando para llamar a la API y obtener una lista de cuentas de servicio:
Sigue estos pasos para instalar Apigee Hybrid en tu clúster:
Asegúrate de estar en el directorio hybrid-base-directory/hybrid-files.
Verifica que kubectl esté configurado en el contexto correcto con el siguiente comando.
El contexto actual se debe configurar en el clúster en el que implementas Apigee Hybrid.
kubectl config get-contexts
Para las plataformas de AWS en GKE, EKS y GKE On-Prem, verifica que la variable KUBECONFIG se configure con el siguiente comando.
echo $KUBECONFIG
Realiza una inicialización de ejecución de prueba. Ejecuta el comando init con la marca --dry-run. Realizar una ejecución de prueba te permite comprobar si hay errores antes de que se realicen cambios en el clúster.
En la versión 1.4.4 híbrida, la sintaxis de la marca --dry-run depende de la versión de kubectl que ejecutes. Verifica la versión de kubectl con el siguiente comando:
Con el comando init, se instalan los servicios de implementación de Apigee del controlador de implementación de Apigee y el webhook de admisión de Apigee.
Para verificar el estado de la implementación, puedes usar los siguientes comandos:
$APIGEECTL_HOME/apigeectl check-ready -f overrides/overrides.yamlkubectl get pods -n apigee-systemkubectl get pods -n istio-system
Cuando los pods estén listos, continúa con el siguiente paso.
Realiza una instalación de ejecución de prueba. Ejecuta el comando apply con la marca --dry-run.
[[["Fácil de comprender","easyToUnderstand","thumb-up"],["Resolvió mi problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Información o código de muestra incorrectos","incorrectInformationOrSampleCode","thumb-down"],["Faltan la información o los ejemplos que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-09-08 (UTC)"],[[["\u003cp\u003eThis documentation is for Apigee hybrid version 1.4, which is end-of-life, and users should upgrade to a newer version.\u003c/p\u003e\n"],["\u003cp\u003eEnabling synchronizer access requires creating a Google Cloud service account with the Apigee Organization Admin role.\u003c/p\u003e\n"],["\u003cp\u003eThe process involves downloading the service account key and using \u003ccode\u003egcloud\u003c/code\u003e commands to manage the key and set necessary permissions.\u003c/p\u003e\n"],["\u003cp\u003eInstalling Apigee hybrid in a cluster includes using the \u003ccode\u003eapigeectl\u003c/code\u003e command for initialization and application, with dry-run options to check for errors.\u003c/p\u003e\n"],["\u003cp\u003eUsers should verify the \u003ccode\u003ekubectl\u003c/code\u003e context, \u003ccode\u003eKUBECONFIG\u003c/code\u003e variable (if applicable), and check pod statuses throughout the hybrid deployment process.\u003c/p\u003e\n"]]],[],null,["# Step 7: Install hybrid runtime\n\n| You are currently viewing version 1.4 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\nEnable synchronizer access\n--------------------------\n\n\nTo enable synchronizer access:\n\n1. Create a Google Cloud service account and add the **Apigee Organization Admin** role to it. This service account will be used to authenticate an API call that you will make in a later step. An easy way to create the service account is through the GCP console. For instructions, see [Creating and managing service accounts](https://cloud.google.com/iam/docs/creating-managing-service-accounts#iam-service-accounts-create-gcloud) in the GCP documentation.\n\n\n For example, the following `gcloud` commands will create the service account and\n assign the **Apigee Organization Admin** to it:\n 1. Create the account: \n\n ```\n gcloud iam service-accounts create apigee-org-admin \\\n --display-name=\"apigee-org-admin\"\n ```\n\n\n Where \u003cvar translate=\"no\"\u003eapigee-org-admin\u003c/var\u003e is the name of the service account you are creating.\n \"`apigee-org-admin`\" is recommended for this tutorial.\n 2. Assign the **Apigee Org Admin** role to the service account: \n\n ```\n gcloud projects add-iam-policy-binding $PROJECT_ID \\\n --member=\"serviceAccount:apigee-org-admin@$PROJECT_ID.iam.gserviceaccount.com\" \\\n --role=\"roles/apigee.admin\"\n ```\n\n\n Where:\n - \u003cvar translate=\"no\"\u003e$PROJECT_ID\u003c/var\u003e is the name of your Google Cloud project that you created in [Step 2: Create a Google Cloud project](/apigee/docs/hybrid/v1.4/precog-gcpproject).\n - \u003cvar translate=\"no\"\u003eapigee-org-admin\u003c/var\u003e is the name of the service account you just created.\n - **roles/apigee.admin** is the **Apigee Org Admin** role.\n2. Download the service account key to your system. Use the following command to make download the key into your `service-accounts/` directory. For more information see the instructions in [Creating service account keys](https://cloud.google.com/iam/docs/creating-managing-service-account-keys#iam-service-account-keys-create-gcloud) in the GCP documentation.\n 1. Make sure you are in the \u003cvar translate=\"no\"\u003e/hybrid-base-directory\u003c/var\u003e`/hybrid-files/` directory.\n 2. Download the key: \n\n ```\n gcloud iam service-accounts keys create ./service-accounts/$PROJECT_ID-apigee-org-admin.json \\\n --iam-account apigee-org-admin@$PROJECT_ID.iam.gserviceaccount.com\n ```\n\n\n The output should look something like: \n\n ```\n created key [a0b1c2d3e4f5a0b1c2d3e4f5a0b1c2d3e4f5a0b1] of type [json] as [./service-accounts/hybrid-\n example-apigee-org-admin.json] for [apigee-org-admin@my-hybrid.iam.gserviceaccount.com]\n $ \n ```\n3. Verify the path to the Apigee Org Admin service account key with the following command: \n\n ```\n ls service-accounts/*admin*\n ```\n\n The result should look something like the following: \n\n ```\n service-accounts/hybrid-example-apigee-org-admin.json\n ```\n4. Create an **ORG_ADMIN_ACCOUNT** environment variable with the name of the key file. For example: \n\n ```\n export ORG_ADMIN_ACCOUNT=\"hybrid-example-apigee-org-admin.json\"\n ```\n5. Execute the following commands to get a token: \n\n export GOOGLE_APPLICATION_CREDENTIALS=./service-accounts/$ORG_ADMIN_ACCOUNT\n export TOKEN=$(gcloud auth application-default print-access-token)\n\n6. Get the email address for your `apigee-synchronizer` service account with the following command: \n\n ```\n gcloud iam service-accounts list --filter \"apigee-synchronizer\"\n ```\n\n\n If it matches the pattern `apigee-synchronizer`**$ORG_NAME**`.iam.gserviceaccount.com`, you\n can use that pattern in the next step.\n7. Call the [setSyncAuthorization](/apigee/docs/reference/apis/apigee/rest/v1/organizations/setSyncAuthorization) API to enable the required permissions for Synchronizer using the following command: \n\n ```\n curl -X POST -H \"Authorization: Bearer $TOKEN\" \\\n -H \"Content-Type:application/json\" \\\n \"https://apigee.googleapis.com/v1/organizations/$ORG_NAME:setSyncAuthorization\" \\\n -d '{\"identities\":[\"'\"serviceAccount:apigee-synchronizer@$ORG_NAME.iam.gserviceaccount.com\"'\"]}'\n ```\n\n\n Where:\n - **`$ORG_NAME`**: The name of your hybrid organization.\n - **`apigee-synchronizer$ORG_NAME.iam.gserviceaccount.com`**: The email address of the apigee-syncnronizer service account.\n8. To verify that the service account was set, use the following command to call the API to get a list of service accounts: \n\n ```\n curl -X POST -H \"Authorization: Bearer $TOKEN\" \\\n -H \"Content-Type:application/json\" \\\n \"https://apigee.googleapis.com/v1/organizations/$ORG_NAME:getSyncAuthorization\" \\\n -d ''\n ```\n\n\n The output looks similar to the following: \n\n ```\n {\n \"identities\":[\n \"serviceAccount:my-synchronizer-manager-service_account@my_project_id.iam.gserviceaccount.com\"\n ],\n \"etag\":\"BwWJgyS8I4w=\"\n }\n ```\n\nApply the configuration to the cluster\n--------------------------------------\n\n\nUse the following steps to install Apigee hybrid into your cluster:\n\n1. Be sure that you are in the \u003cvar translate=\"no\"\u003ehybrid-base-directory\u003c/var\u003e`/hybrid-files` directory.\n2. Verify that `kubectl` is set to the correct context using the following command. The current context should be set to the cluster to which you are deploying Apigee hybrid. \n\n ```\n kubectl config get-contexts\n ```\n3. *For **AWS on GKE** , **EKS** , and **GKE on prem** platforms only* , Verify that the `KUBECONFIG` variable is set using the following command. \n\n ```\n echo $KUBECONFIG\n ```\n4. Do a *dry run* initialization. Execute the `init` command with the `--dry-run` flag. Doing a dry run lets you check for any errors before any changes are made to the cluster.\n\n\n In hybrid version 1.4.4, the syntax of the `--dry-run`\n flag depends on the version of `kubectl` you are running. Check the version of\n `kubectl` with the following command: \n\n ```\n kubectl version\n ```\n\n\n `kubectl` version 1.17 and older: \n\n ```\n $APIGEECTL_HOME/apigeectl init -f overrides/overrides.yaml --dry-run=true\n ```\n\n\n `kubectl` version 1.18 and newer: \n\n ```\n $APIGEECTL_HOME/apigeectl init -f overrides/overrides.yaml --dry-run=client\n ```\n5. If there are no errors, execute the `init` command as follows: \n\n ```\n $APIGEECTL_HOME/apigeectl init -f overrides/overrides.yaml\n ```\n\n The `init` command installs the [Apigee deployment\n services](/apigee/docs/hybrid/v1.4/apigee-deployment-services) Apigee Deployment Controller and Apigee Admission Webhook.\n6. To check the status of the deployment, you can use the following commands: \n\n $APIGEECTL_HOME/apigeectl check-ready -f overrides/\u003cvar translate=\"no\"\u003eoverrides\u003c/var\u003e.yaml\n kubectl get pods -n apigee-system\n kubectl get pods -n istio-system\n\n\n When the pods are ready, go to the next step.\n7. Do a *dry run* install. Execute the `apply` command with the `--dry-run` flag.\n\n\n `kubectl` version 1.17 and older: \n\n ```\n $APIGEECTL_HOME/apigeectl apply -f overrides/overrides.yaml --dry-run=true\n ```\n\n\n `kubectl` version 1.18 and newer: \n\n ```\n $APIGEECTL_HOME/apigeectl apply -f overrides/overrides.yaml --dry-run=client\n ```\n8. If there are no errors, you can apply the [Apigee-specific runtime components](/apigee/docs/hybrid/v1.4/what-is-hybrid#about-the-runtime-plane) to the cluster with the following command: \n\n ```\n $APIGEECTL_HOME/apigeectl apply -f overrides/overrides.yaml\n ```\n9. To check the status of the deployment, run the following command: \n\n ```\n $APIGEECTL_HOME/apigeectl check-ready -f overrides/overrides.yaml\n ```\n\n\n Repeat this step until the pods are all ready. The pods may take several minutes to start up.\n\n| **Congratulations!**\n|\n| You've successfully installed Apigee hybrid. You are now ready to test\n| it."]]
