In diesem Abschnitt wird der Synchronizer beschrieben.
Synchronizer – Übersicht
In Apigee Hybrid besteht die Hauptaufgabe des Synchronizers darin, die von der Verwaltungsebene bereitgestellten Laufzeitverträge abzurufen und herunterzuladen. Zu den im Vertrag enthaltenen Informationen gehören API-Proxys, API-Produkte, Caches und virtuelle Hosts. Synchronizer speichert standardmäßig Umgebungskonfigurationsdaten in der Cassandra-Datenbank.
Synchronizer-Instanzen, die in der Laufzeitebene ausgeführt werden, sollten regelmäßig die Verwaltungsebene abfragen, die Verträge herunterladen und diese den lokalen Laufzeitinstanzen zur Verfügung stellen.
Ein Synchronizer unterstützt viele Nachrichtenverarbeiter, die im gleichen Pod bereitgestellt sind.
Synchronizer-Zugriff aktivieren
Sie müssen die Berechtigung Synchronizer erteilen, um Apigee-Artefakte wie Proxy-Bundles und Ressourcen von der Verwaltungsebene abzurufen. Sie müssen eine Apigee API aufrufen, um den Synchronizer zu autorisieren, Artefakte von der Verwaltungsebene zur Laufzeitebene abzurufen.
Prüfen Sie, ob die Apigee API wie in den Google Cloud-Einrichtungsschritten beschrieben aktiviert wurde.
Weitere Informationen finden Sie unter APIs aktivieren.
Suchen Sie nach dem schreibberechtigten Google Cloud-Dienstkontoschlüssel (eine JSON-Datei), den Sie im Abschnitt Dienstkonten und Anmeldedaten erstellen heruntergeladen haben. Das Dienstkonto hat die Rolle Apigee-Organisationsadministrator und den Namen "apigee-org-admin". Wenn Sie dieses Dienstkonto nicht zuvor erstellt haben, müssen Sie dies tun, bevor Sie fortfahren.
Generieren Sie mithilfe des Apigee-Org Admin-Dienstkontos ein OAuth 2.0-Zugriffstoken.
Dieses Token wird zur Authentifizierung der Apigee APIs benötigt.
gcloud
Verwenden Sie gcloud, um ein OAuth 2.0-Zugriffstoken abzurufen, und übergeben Sie die JSON-Datei mit den Anmeldedaten des Dienstkontos, die Sie mit der Umgebungsvariablen GOOGLE_APPLICATION_CREDENTIALS heruntergeladen haben:
your_org_name ist der Name der Hybridorganisation.
synchronizer-manager-service-account-name ist der Name eines Dienstkontos mit der Rolle Apigee Synchronizer Manager. Der Name sieht wie eine E-Mail-Adresse aus. Beispiel: my-synchronizer-manager-service_account@my_project_id.iam.gserviceaccount.com
[[["Leicht verständlich","easyToUnderstand","thumb-up"],["Mein Problem wurde gelöst","solvedMyProblem","thumb-up"],["Sonstiges","otherUp","thumb-up"]],[["Schwer verständlich","hardToUnderstand","thumb-down"],["Informationen oder Beispielcode falsch","incorrectInformationOrSampleCode","thumb-down"],["Benötigte Informationen/Beispiele nicht gefunden","missingTheInformationSamplesINeed","thumb-down"],["Problem mit der Übersetzung","translationIssue","thumb-down"],["Sonstiges","otherDown","thumb-down"]],["Zuletzt aktualisiert: 2025-08-28 (UTC)."],[[["\u003cp\u003eThe Synchronizer in Apigee hybrid polls and downloads runtime contracts from the management plane, including API proxies, products, caches, and virtual hosts.\u003c/p\u003e\n"],["\u003cp\u003eSynchronizer instances regularly poll the management plane to retrieve and update contracts, making them available to local runtime instances, and one Synchronizer can support multiple Message Processors.\u003c/p\u003e\n"],["\u003cp\u003eTo enable Synchronizer access, you must use an Apigee API to authorize it to pull artifacts from the management plane, using a write-enabled Google Cloud service account with the Apigee Org Admin role.\u003c/p\u003e\n"],["\u003cp\u003eYou can authorize Synchronizer access by generating an OAuth 2.0 access token using the \u003ccode\u003egcloud\u003c/code\u003e tool and the service account key, and then use this token to call the \u003ccode\u003esetSyncAuthorization\u003c/code\u003e API or use the equivalent Terraform attribute.\u003c/p\u003e\n"],["\u003cp\u003eTo ensure proper functionality, the service account added during authorization must have the "Apigee Synchronizer Manager" role, and you can verify the authorization by calling the \u003ccode\u003egetSyncAuthorization\u003c/code\u003e API.\u003c/p\u003e\n"]]],[],null,["# Configure the Synchronizer\n\n| You are currently viewing version 1.10 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\nThis section describes the Synchronizer.\n\nSynchronizer overview\n---------------------\n\nIn Apigee hybrid, the Synchronizer's primary job is to poll and download the runtime contracts\nwhich are supplied by the management plane. Information communicated by contract includes API\nproxies, API products, caches, and virtual hosts. Synchronizer by default stores environment\nconfiguration data in the Cassandra database.\n\nSynchronizer instances running in the runtime-plane are expected to poll the management\nplane on a regular basis, download the contracts and make the same available to local runtime\ninstances.\n\nOne Synchronizer can support many Message Processors deployed in the same pod.\n\nEnable Synchronizer access\n--------------------------\n\nYou must grant the [Synchronizer](/apigee/docs/hybrid/v1.10/what-is-hybrid#synchronizer) permission to pull down\nApigee artifacts, such as proxy bundles and resources from the management plane. You must call an\nApigee API to authorize the Synchronizer to pull artifacts down from the management plane to the\nruntime plane.\n\n1. Ensure that you have enabled the Apigee API as explained in the Google Cloud setup steps. For details, see [Enable APIs](./precog-enableapi).\n2. Locate the **write-enabled Google Cloud service account key** (a JSON file) that you downloaded as part of [Create service accounts and credentials](./install-service-accounts). The service account has the **Apigee Org Admin** role and is the one named \"apigee-org-admin\". If you did not previously create this service account, you must do so before continuing.\n3. Use the Apigee Org Admin service account key to generate an OAuth 2.0 access token. This token is required to authenticate the [Apigee APIs](/apigee/docs/reference/apis/apigee/rest). \n\n ### gcloud\n\n Use [gcloud](/sdk/docs) to obtain an\n OAuth 2.0 access token, passing the service account credentials JSON file that you\n downloaded using `GOOGLE_APPLICATION_CREDENTIALS` environment variable: \n\n export GOOGLE_APPLICATION_CREDENTIALS=\u003cvar translate=\"no\"\u003eyour_sa_credentials_file\u003c/var\u003e.json\n gcloud auth application-default print-access-token\n\n An OAuth2.0 token is returned.\n\n For more information, see\n [gcloud beta auth application-default print-access-token](/sdk/gcloud/reference/beta/auth/application-default/print-access-token).\n4. Copy the OAuth 2.0 token returned and store it in a variable, such as `TOKEN`. For example: \n\n ```\n export TOKEN=ya29....Ts13inj3LrqMJlztwygtM\n ```\n5. Call the [setSyncAuthorization](/apigee/docs/reference/apis/apigee/rest/v1/organizations/setSyncAuthorization) to enable the required permissions for Synchronizer: **TIP:** If your are using Terraform, you can use the [`google_apigee_sync_authorization`\n | Terraform attribute](https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/apigee_sync_authorization) instead of calling the `setSyncAuthorization` API.\n **IMPORTANT:** Be sure that the service account name that you add to this API has the role **Apigee Synchronizer Manager** . See also [Create service accounts and credentials](./install-service-accounts). \n\n ```\n curl -X POST -H \"Authorization: Bearer $TOKEN\" \\\n -H \"Content-Type:application/json\" \\\n \"https://apigee.googleapis.com/v1/organizations/your_org_name:setSyncAuthorization\" \\\n -d '{\"identities\":[\"serviceAccount:synchronizer-manager-service-account-name\"]}'\n ```\n\n Where:\n - `your_org_name`: The name of the hybrid organization.\n - `synchronizer-manager-service-account-name`: The name of a service account with the **Apigee Synchronizer Manager** role. The name is formed like an email address. For example: `my-synchronizer-manager-service_account@my_project_id.iam.gserviceaccount.com`\n\n Example: \n\n ```\n curl -X POST -H \"Authorization: Bearer $TOKEN\" \\\n -H \"Content-Type:application/json\" \\\n \"https://apigee.googleapis.com/v1/organizations/my_org:setSyncAuthorization\" \\\n -d '{\"identities\":[\"serviceAccount:my-synchronizer-manager-service_account@my_project_id.iam.gserviceaccount.com\"]}'\n ```\n\n For more information on this API, see [setSyncAuthorization API](/apigee/docs/reference/apis/apigee/rest/v1/organizations/setSyncAuthorization).\n6. To verify that the service account was set, call the following API to get a list of service accounts: \n\n ```\n curl -X POST -H \"Authorization: Bearer $TOKEN\" \\\n -H \"Content-Type:application/json\" \\\n \"https://apigee.googleapis.com/v1/organizations/your_org_name:getSyncAuthorization\" \\\n -d ''\n ```\n\n The output looks similar to the following: \n\n ```transact-sql\n {\n \"identities\":[\n \"serviceAccount:my-synchronizer-manager-service_account@my_project_id.iam.gserviceaccount.com\"\n ],\n \"etag\":\"BwWJgyS8I4w=\"\n }\n ```"]]
