Untuk melakukan panggilan Apigee API yang dijelaskan nanti dalam topik ini, Anda perlu mendapatkan token otorisasi yang memiliki peran Admin Organisasi Apigee.
Jika Anda bukan pemilik project Google Cloud yang terkait dengan organisasi hibrida Apigee, pastikan akun pengguna Google Cloud Anda memiliki peran roles/apigee.admin (Admin Organisasi Apigee). Anda dapat memeriksa peran yang ditetapkan kepada Anda dengan perintah ini:
Jika Anda tidak memiliki roles/apigee.admin dalam peran, tambahkan peran Apigee
Organization Admin ke akun pengguna Anda. Gunakan perintah berikut untuk menambahkan peran ke akun pengguna Anda:
Dapatkan alamat email untuk akun layanan yang Anda beri akses sinkronisasi.
Untuk lingkungan non-produksi (seperti yang disarankan dalam tutorial ini), nilainya harus
apigee-non-prod. Untuk lingkungan produksi, nilainya harus
apigee-synchronizer. Gunakan perintah berikut:
Sekarang Anda telah memungkinkan runtime dan platform pengelolaan Apigee hybrid untuk
berkomunikasi. Selanjutnya, mari kita terapkan konfigurasi Anda ke runtime hybrid dan selesaikan penginstalan Apigee hybrid.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-03 UTC."],[[["\u003cp\u003eThis document provides instructions on how to obtain an authorization token with the Apigee Organization Admin role, required for making Apigee API calls.\u003c/p\u003e\n"],["\u003cp\u003eUsers must have the \u003ccode\u003eroles/apigee.admin\u003c/code\u003e role in their Google Cloud account, and instructions are provided to verify and add this role if necessary.\u003c/p\u003e\n"],["\u003cp\u003eInstructions are provided on how to retrieve the necessary \u003ccode\u003egcloud\u003c/code\u003e authentication credentials for both Linux/MacOS and Windows environments.\u003c/p\u003e\n"],["\u003cp\u003eThe guide details how to enable synchronizer access by obtaining the service account email (either \u003ccode\u003eapigee-non-prod\u003c/code\u003e for non-production or \u003ccode\u003eapigee-synchronizer\u003c/code\u003e for production) and using the \u003ccode\u003esetSyncAuthorization\u003c/code\u003e API, and then confirming it.\u003c/p\u003e\n"],["\u003cp\u003eUpon completion, the Apigee hybrid runtime and management planes are able to communicate, preparing for the next step, which is applying configurations and completing the Apigee hybrid installation.\u003c/p\u003e\n"]]],[],null,["# Step 7: Enable Synchronizer access\n\n| You are currently viewing version 1.11 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\nGet an authorization token\n--------------------------\n\n\nTo make the Apigee API calls described later in this topic, you need to get an authorization\ntoken that has the Apigee Organization Admin role.\n\n1. If you are not the owner of the Google Cloud project that is associated with your Apigee hybrid organization, be sure that your Google Cloud user account has the **roles/apigee.admin** (Apigee Organization Admin) role. You can check the roles assigned to you with this command: \n\n ```\n gcloud projects get-iam-policy ${PROJECT_ID} \\\n --flatten=\"bindings[].members\" \\\n --format='table(bindings.role)' \\\n --filter=\"bindings.members:your_account_email\"\n ```\n\n\n For example: \n\n ```transact-sql\n gcloud projects get-iam-policy my-project \\\n --flatten=\"bindings[].members\" \\\n --format='table(bindings.role)' \\\n --filter=\"bindings.members:myusername@example.com\"\n ```\n\n\n The output should look something like: \n\n ```text\n ROLE\n roles/apigee.admin\n roles/compute.admin\n roles/container.admin\n roles/gkehub.admin\n roles/iam.serviceAccountAdmin\n roles/iam.serviceAccountKeyAdmin\n roles/meshconfig.admin\n roles/owner\n roles/resourcemanager.projectIamAdmin\n roles/servicemanagement.admin\n roles/serviceusage.serviceUsageAdmin\n ```\n2. If you do not have `roles/apigee.admin` in your roles, add the **Apigee\n Organization Admin** role to your user account. Use the following command to add the role to your user account: \n\n ```\n gcloud projects add-iam-policy-binding ${PROJECT_ID} \\\n --member user:your_account_email \\\n --role roles/apigee.admin\n ```\n\n\n For example: \n\n ```\n gcloud projects add-iam-policy-binding my-project \\\n --member user:myusername@example.com \\\n --role roles/apigee.admin\n ```\n3. On the command line, get your `gcloud` authentication\n credentials using the following command:\n\n ### Linux / MacOS\n\n ```\n export TOKEN=$(gcloud auth print-access-token)\n ```\n\n To check that your token was populated, use `echo`, as the\n following example shows: \n\n ```\n echo $TOKEN\n ```\n\n This should display your token as an encoded string.\n\n ### Windows\n\n ```\n for /f \"tokens=*\" %a in ('gcloud auth print-access-token') do set TOKEN=%a\n ```\n\n To check that your token was populated, use `echo`, as the\n following example shows: \n\n ```\n echo %TOKEN%\n ```\n\n This should display your token as an encoded string.\n\nEnable synchronizer access\n--------------------------\n\n\nTo enable synchronizer access:\n\n1. Get the email address for the service account to which you are granting synchronizer access. For non-production environments (as suggested in this tutorial) it should be `apigee-non-prod`. For production environments, it should be `apigee-synchronizer`. Use the following command:\n\n ### Non-prod\n\n ```\n gcloud iam service-accounts list --project ${PROJECT_ID} --filter \"apigee-non-prod\"\n ```\n\n\n If it matches the pattern `apigee-non-prod`**@${ORG_NAME}**`.iam.gserviceaccount.com`, you\n can use that pattern in the next step.\n\n ### Prod\n\n ```\n gcloud iam service-accounts list --project ${PROJECT_ID} --filter \"apigee-synchronizer\"\n ```\n\n\n If it matches the pattern `apigee-synchronizer`**@${ORG_NAME}**`.iam.gserviceaccount.com`, you\n can use that pattern in the next step.\n2. Call the [setSyncAuthorization](/apigee/docs/reference/apis/apigee/rest/v1/organizations/setSyncAuthorization) API to enable the required permissions for Synchronizer using the following command:\n\n ### Non-prod\n\n ```\n curl -X POST -H \"Authorization: Bearer ${TOKEN}\" \\\n -H \"Content-Type:application/json\" \\\n \"https://apigee.googleapis.com/v1/organizations/${ORG_NAME}:setSyncAuthorization\" \\\n -d \"{\\\"identities\\\":[\\\"serviceAccount:apigee-non-prod@${ORG_NAME}.iam.gserviceaccount.com\\\"]}\"\n ```\n\n ### Prod\n\n ```\n curl -X POST -H \"Authorization: Bearer ${TOKEN}\" \\\n -H \"Content-Type:application/json\" \\\n \"https://apigee.googleapis.com/v1/organizations/${ORG_NAME}:setSyncAuthorization\" \\\n -d \"{\\\"identities\\\":[\\\"serviceAccount:apigee-synchronizer@${ORG_NAME}.iam.gserviceaccount.com\\\"]}\"\n ```\n\n\n Where:\n - **`${ORG_NAME}`**: The name of your hybrid organization.\n - **`apigee-non-prod${ORG_NAME}.iam.gserviceaccount.com`** or \n **`apigee-synchronizer${ORG_NAME}.iam.gserviceaccount.com`**: The email address of the service account.\n3. To verify that the service account was set, use the following command to call the API to get a list of service accounts: \n\n ```\n curl -X GET -H \"Authorization: Bearer $TOKEN\" \\\n -H \"Content-Type:application/json\" \\\n \"https://apigee.googleapis.com/v1/organizations/${ORG_NAME}:getSyncAuthorization\"\n \n ```\n\n\n The output looks similar to the following:\n\n ### Non-prod\n\n ```transact-sql\n {\n \"identities\":[\n \"serviceAccount:apigee-non-prod@\u003cvar translate=\"no\"\u003emy_project_id\u003c/var\u003e.iam.gserviceaccount.com\"\n ],\n \"etag\":\"BwWJgyS8I4w=\"\n }\n ```\n\n ### Prod\n\n ```transact-sql\n {\n \"identities\":[\n \"serviceAccount:apigee-synchronizer@\u003cvar translate=\"no\"\u003emy_project_id\u003c/var\u003e.iam.gserviceaccount.com\"\n ],\n \"etag\":\"BwWJgyS8I4w=\"\n }\n ```\n | **Note:** The call to the Apigee API uses \u003cvar translate=\"no\"\u003e${ORG_NAME}\u003c/var\u003e, and the results from the IAM service account mappings use \u003cvar translate=\"no\"\u003emy_project_id\u003c/var\u003e. In most cases, the values are the same. One uncommon exception is when using a [multi-org cluster](/apigee/docs/hybrid/latest/multi-org), where there would be more than one org name, and the service accounts could be different per org.\n\nYou have now made it possible for your Apigee hybrid runtime and management planes to\ncommunicate. Next, let's apply your configuration to the hybrid runtime and complete your\ninstallation of Apigee hybrid.\n[1](/apigee/docs/hybrid/v1.11/install-create-cluster) [2](/apigee/docs/hybrid/v1.11/install-cert-manager) [3](/apigee/docs/hybrid/v1.11/install-apigeectl) [4](/apigee/docs/hybrid/v1.11/install-service-accounts) [5](/apigee/docs/hybrid/v1.11/install-create-tls-certificates) [6](/apigee/docs/hybrid/v1.11/install-configure-cluster) [7](/apigee/docs/hybrid/v1.11/install-enable-synchronizer-access) [(NEXT) Step 8: Check cluster readiness](/apigee/docs/hybrid/v1.11/install-check-cluster) [9](/apigee/docs/hybrid/v1.11/install-hybrid-runtime) [10](/apigee/docs/hybrid/v1.11/install-workload-identity)\n\n\u003cbr /\u003e"]]
