Configuration property reference

This section lists all of the configuration properties that you can use to customize the runtime plane of your Apigee hybrid deployment.

Filter this page

To filter the properties displayed on this page, select Basic (most common properties) or Advanced (properties that rarely need changing):

Display   configuration properties on this page.

Top-level properties

The following table describes the top-level properties in the overrides.yaml file. These are properties that do not belong to another object, and apply at the org or environment level:

Property Type Description
axHashSalt Advanced

Introduced in version: 1.3.0

Default value: Your organization name

Optional

The name of a Kubernetes secret that contains a salt used when computing hashes to obfuscate user data before it is sent to Apigee analytics. If you do not specify a salt value, iloveapis123 is used by default. Create the secret with the salt value as its input. You can use the same salt across multiple clusters to ensure consistent hashing results between the clusters.

Apigee uses SHA512 to hash the original value before sending data from the runtime plane to the control plane.

See: Obfuscate user data for analytics.

contractProvider Advanced Introduced in version: 1.0.0

Default value: https://apigee.googleapis.com

Defines the API path for all APIs in your installation.

gcpProjectID Advanced Deprecated: For v1.2.0 and later, use gcp.projectID instead.

Introduced in version: 1.0.0

Default value: none

Required

ID of your Google Cloud project. Works with k8sClusterName (deprecated) and gcpRegion (deprecated) to identify the project and determine where the apigee-logger and the apigee-metrics push their data.

gcpRegion Advanced Deprecated: For v1.2.0 and later, use gcp.region instead.

Introduced in version: 1.0.0

Default value: us-central1

Required

The closet Google Cloud region or zone of your Kubernetes cluster. Works with gcpProjectID (deprecated) and k8sClusterName (deprecated) to identify the project and determine where the apigee-logger and the apigee-metrics push their data.

imagePullSecrets.name Advanced Introduced in version: 1.0.0

Default value: None

Kubernetes secret name configured as docker-registry type; used to pull images from private repo.

instanceID Basic Introduced in version: 1.3.0

Default value: None

Required

A unique identifier for this installation.

A unique string to identify this instance. This can be any combination of letters and numbers up to 63 characters in length.

k8sClusterName Advanced Deprecated: For v1.2.0 and later, use k8sCluster.name and k8sCluster.region instead.

Introduced in version: 1.0.0

Default value: None

Name of the Kubernetes (K8S) procluster where your hybrid project is running. Works with gcpProjectID (deprecated) and gcpRegion (deprecated) to identify the project and determine where the apigee-logger and the apigee-metrics push their data.

kmsEncryptionKey Advanced Introduced in version: 1.0.0

Default value: defaults.org.kmsEncryptionKey

Optional. Use only one of kmsEncryptionKey or kmsEncryptionPath or kmsEncryptionSecret.

Local file system path for the Apigee KMS data's encryption key.

kmsEncryptionPath Advanced Introduced in version: 1.2.0

Default value: None

Optional. Use only one of kmsEncryptionKey or kmsEncryptionPath or kmsEncryptionSecret.

The path to a file containing a base64-encoded encryption key. See Data encryption.

kmsEncryptionSecret.key Advanced Introduced in version: 1.2.0

Default value: None

Optional. Use only one of kmsEncryptionKey or kmsEncryptionPath or kmsEncryptionSecret.

The key of a Kubernetes secret containing a base64-encoded encryption key. See Data encryption.

kmsEncryptionSecret.name Advanced Introduced in version: 1.2.0

Default value: None

Optional. Use only one of kmsEncryptionKey or kmsEncryptionPath or kmsEncryptionSecret.

The name of a Kubernetes secret containing a base64-encoded encryption key. See Data encryption.

kvmEncryptionKey Advanced Introduced in version: 1.0.0

Default value: defaults.org.kmsEncryptionKey

Optional. Use only one of kvmEncryptionKey or kvmEncryptionPath or kvmEncryptionSecret.

Local file system path for the Apigee KVM data's encryption key.

kvmEncryptionPath Advanced Introduced in version: 1.2.0

Default value: None

Optional. Use only one of kvmEncryptionKey or kvmEncryptionPath or kvmEncryptionSecret.

The path to a file containing a base64-encoded encryption key. See Data encryption.

kvmEncryptionSecret.key Advanced Introduced in version: 1.2.0

Default value: None

Optional. Use only one of kvmEncryptionKey or kvmEncryptionPath or kvmEncryptionSecret.

The key of a Kubernetes secret containing a base64-encoded encryption key. See Data encryption.

kvmEncryptionSecret.name Advanced Introduced in version: 1.2.0

Default value: None

Optional. Use only one of kvmEncryptionKey or kvmEncryptionPath or kvmEncryptionSecret.

The name of a Kubernetes secret containing a base64-encoded encryption key. See Data encryption.

namespace Basic Introduced in version: 1.0.0

Default value: apigee

The namespace of your Kubernetes cluster where the Apigee components will be installed.

org Basic

Introduced in version: 1.0.0

Default value: None

Required

The hybrid-enabled organization that was provisioned for you by Apigee during the hybrid installation. An organization is the top-level container in Apigee. It contains all your API proxies and related resources. If the value is empty, you must update it with your org name once you have created it.

orgScopedUDCA Advanced Introduced in version: 1.8.0

Default value: true

Enables the Universal Data Collection Agent service (UDCA) at the org level, that extracts analytics, monetization and debug (trace) and sends it to the Unified Analytics Platform (UAP) which resides in the Control Plane.

The Org-scoped UDCA uses a single service account for all the Apigee Environments. The service account needs to be set through udca:serviceAccountPath property in the overrides.yaml configuration (the property should set the path to Google Service Account key file with Apigee Analytics Agent role).

If you prefer to use a separate UDCA agent for each environment, set orgScopedUDCA: false and set the values for envs[].serviceAccountPaths.udca and envs[].serviceAccountSecretRefs.udca.

See also: udca.

revision Advanced Introduced in version: 1.0.0

Default value: "194" (Your Apigee hybrid version without periods. For example for version 1.9.0, the default value is "190".)

Apigee hybrid supports rolling Kubernetes updates, which allow deployment updates to take place with zero downtime by incrementally updating Pod instances with new ones.

When updating certain YAML overrides that result in underlying Kubernetes PodTemplateSpec change, the revision override property must also be changed in the customer's override.yaml. This is required for the underlying Kubernetes ApigeeDeployment (AD) controller to conduct a safe rolling update of from the previous version to the new version. You can use any lowercase text value, eg: blue, a, 1.0.0

When the revision property is changed and applied, a rolling update will occur for all components

Changes to properties of the following objects require an update to revision:

For more information, see Rolling updates.

validateOrg Advanced Introduced in version: 1.8.0

Default value: true

Enables strict validation of the link between the Apigee Org and GCP project and checks for the existence of environment groups.

See also org

validateServiceAccounts Advanced Introduced in version: 1.0.0

Default value: true

Enables strict validation of service account permissions. This uses Cloud Resource Manager API method testIamPermissions to verify that the provided service account has the required permissions. In the case of service accounts for an Apigee Org, the project ID check is the one mapped to the Organization. For Metrics and Logger, the project checked is based on the gcpProjectID overrides.yaml configuration.

See also gcpProjectID

ao

Apigee Operators (AO) creates and updates low level Kubernetes and Istio resources that are required to deploy and maintain a component. For example, the controller carries out the release of message processors.

The following table describes the properties of the apigee-operators ao object:

Property Type Description
ao.args.disableIstioConfigInAPIServer Advanced Introduced in version: 1.8.0

Default value: false

Stops Apigee from supplying configuration to customer-installed ASM.

  • Set to true for hybrid installations using Apigee ingress gateway.
  • Set to false for hybrid installations using Anthos Service Mesh (Apigee hybrid versions 1.8 and earlier).
ao.image.pullPolicy Advanced Introduced in version: 1.2.0

Default value: IfNotPresent

Determines when kubelet pulls the pod's Docker image. Possible values include:

  • IfNotPresent: Do not pull a new image if it already exists.
  • Always: Always pull the image, regardless of whether it exists already.

For more information, see Updating images.

ao.image.tag Advanced Introduced in version: 1.2.0

Default value: 1.9.4

The version label for this service's Docker image.

ao.image.url Advanced Introduced in version: 1.2.0

Default value: gcr.io/apigee-release/hybrid/apigee-operators

The location of the Docker image for this service.

ao.installer.pullPolicy Advanced Introduced in version: 1.3.0

Default value: IfNotPresent

Determines when kubelet pulls the pod's Docker image. Possible values include:

  • IfNotPresent: Do not pull a new image if it already exists.
  • Always: Always pull the image, regardless of whether it exists already.

For more information, see Updating images.

ao.installer.tag Advanced Introduced in version: 1.3.0

Default value: 1.9.4

The version label for this service's Docker image.

ao.installer.url Advanced Introduced in version: 1.3.0

Default value: gcr.io/apigee-release/hybrid/apigee-installer

The location of the Docker image for this service.

ao.resources.limits.cpu Advanced Introduced in version: 1.2.0

Default value: 250m

The CPU limit for the resource in a Kubernetes container, in millicores.

ao.resources.limits.memory Advanced Introduced in version: 1.2.0

Default value: 256Mi

The memory limit for the resource in a Kubernetes container, in mebibytes.

ao.resources.requests.cpu Advanced Introduced in version: 1.2.0

Default value: 250m

The CPU needed for normal operation of the resource in a Kubernetes container, in millicores.

ao.resources.requests.memory Advanced Introduced in version: 1.2.0

Default value: 256Mi

The memory needed for normal operation of the resource in a Kubernetes container, in mebibytes.

cassandra

Defines the hybrid service that manages the runtime data repository. This repository stores application configurations, distributed quota counters, API keys, and OAuth tokens for applications running on the gateway.

For more information, see StorageClass configuration.

The following table describes the properties of the cassandra object:

Property Type Description
cassandra.annotations Advanced Introduced in version: 1.5.0

Default value: None

Optional key/value map used to annotate pods. For more information, see Custom annotations.

cassandra.auth.admin.password Basic Introduced in version: 1.0.0

Default value: iloveapis123

Required

Password for the Cassandra administrator. The admin user is used for any administrative activities performed on the Cassandra cluster.

cassandra.auth.ddl.password Basic Introduced in version: 1.0.0

Default value: iloveapis123

Required

Password for the Cassandra Data Definition Language (DDL) user. Used by MART for any of the data definition tasks like keyspace creation, update, and deletion.

cassandra.auth.default.password Basic Introduced in version: 1.0.0

Default value: iloveapis123

Required

The password for the default Cassandra user created when Authentication is enabled. This password must be reset when configuring Cassandra authentication. See Configuring TLS for Cassandra.

cassandra.auth.dml.password Basic Introduced in version: 1.0.0

Default value: iloveapis123

Required

Password for the Cassandra Data Manipulation Language (DML) user. The DML user is used by the client communication to read and write data to Cassandra.

cassandra.auth.image.pullPolicy Advanced Introduced in version: 1.0.0

Default value: IfNotPresent

Determines when kubelet pulls the pod's Docker image. Possible values include:

  • IfNotPresent: Do not pull a new image if it already exists.
  • Always: Always pull the image, regardless of whether it exists already.

For more information, see Updating images.

cassandra.auth.image.tag Advanced Introduced in version: 1.0.0

Default value: 1.9.4

The version label for this service's Docker image.

cassandra.auth.image.url Advanced Introduced in version: 1.0.0

Default value: gcr.io/apigee-release/hybrid/apigee-hybrid-cassandra-client

The location of the Docker image for this service.

cassandra.auth.jmx.password Basic Introduced in version: 1.4.0

Default value: iloveapis123

Required

Password for the Cassandra JMX operations user. Used to authenticate and communicate with the Cassandra JMX interface.

cassandra.auth.jmx.username Basic Introduced in version: 1.4.0

Default value: jmxuser

Required

Username for the Cassandra JMX operations user. Used to authenticate and communicate with the Cassandra JMX interface.

cassandra.auth.jolokia.password Basic Introduced in version: 1.4.0

Default value: iloveapis123

Required

Password for the Cassandra Jolokia JMX operations user. Used to authenticate and communicate with the Cassandra JMX API.

cassandra.auth.jolokia.username Basic Introduced in version: 1.4.0

Default value: apigee

Required

Username for the Cassandra Jolokia JMX operations user. Used to authenticate and communicate with the Cassandra JMX API.

cassandra.auth.secret Basic Introduced in version: 1.3.3

Default value: None

The name of the file stored in a Kubernetes secret that contains the Cassandra users and passwords. You can create the secret using following the following instructions: Create the Secret.

See also:

cassandra.backup.cloudProvider Advanced Introduced in version: 1.0.0

Default value: GCP

Required if backup is enabled.

Cloud provider for backup storage.

You can set the value to either