Membuat akun layanan Google Cloud Platform (GCP) dengan peran yang memungkinkan
setiap komponen campuran Apigee melakukan panggilan API yang diotorisasi dan mendownload
file kunci akun layanan terkait. Anda dapat menggunakan
file kunci akun layanan yang dihasilkan oleh perintah ini dalam file penggantian konfigurasi.
Alat create-service-account terletak di
direktori hybrid_root_dir/tools.
Prasyarat
Alat create-service-account memerlukan penginstalan CLI gcloud. Pengguna yang memanggil utilitas harus memiliki peran Service Account Admin.
component_name: Menentukan layanan campuran yang menggunakan akun layanan. Nilai yang valid adalah:
apigee-cassandra
apigee-logger
apigee-mart
apigee-metrics
apigee-synchronizer
apigee-udca
Perhatikan bahwa alat create-service-account tidak dapat membuat akun layanan apigee-org-admin. Anda harus membuatnya dengan GCP atau gCloud API, seperti yang dijelaskan dalam Membuat akun layanan.
output_dir: Direktori output tempat menyimpan kunci akun layanan
yang didownload.
gcp_project_id: (Opsional) Menentukan project ID GCP dari project yang terikat dengan organisasi yang mengaktifkan hybrid Anda. Jika project ID GCP tidak diberikan, alat ini akan mencoba
mengambilnya dari konfigurasi gcloud saat ini.
Deskripsi mendetail
Alat create-service-account:
Membuat akun layanan GCP
yang digunakan oleh komponen campuran. Akun layanan yang dibuat diberi peran yang diperlukan oleh komponen tertentu untuk beroperasi.
Mendownload kunci akun layanan ke sistem Anda. Anda menempatkan kunci akun layanan di file penggantian konfigurasi hibrida, seperti yang dijelaskan dalam petunjuk penginstalan hibrida.
Alat ini membuat akun layanan untuk komponen berikut:
Komponen*
Peran
Diperlukan untuk penginstalan dasar?
Deskripsi
apigee-cassandra
Storage Object Admin
Mengizinkan pencadangan Cassandra ke Google Cloud Storage, seperti yang dijelaskan dalam Pencadangan dan pemulihan.
apigee-logger
Penulis Log
Mengizinkan pengumpulan data logging, seperti yang dijelaskan dalam Logging. Hanya diperlukan untuk penginstalan cluster
non-GKE.
apigee-mart
Tidak ada peran
Mengizinkan autentikasi layanan MART. Akun layanan ini tidak boleh memiliki peran
yang terkait dengannya; oleh karena itu, saat Anda membuat akun layanan ini, jangan tetapkan peran
ke akun tersebut.
apigee-metrics
Penulis Metrik Pemantauan
Mengizinkan pengumpulan data metrik, seperti yang dijelaskan dalam Pengumpulan metrik
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eThis documentation pertains to version 1.2 of Apigee hybrid, which is end-of-life and should be upgraded.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003ecreate-service-account\u003c/code\u003e tool, located in the \u003ccode\u003e<var>hybrid_root_dir</var>/tools\u003c/code\u003e directory, creates GCP service accounts with specific roles for various Apigee hybrid components.\u003c/p\u003e\n"],["\u003cp\u003eUsers must have the \u003ccode\u003eService Account Admin\u003c/code\u003e role and have the \u003ccode\u003egcloud\u003c/code\u003e CLI installed to utilize the \u003ccode\u003ecreate-service-account\u003c/code\u003e tool effectively.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003ecreate-service-account\u003c/code\u003e tool downloads service account keys to a specified output directory, and these keys are used in the hybrid configuration overrides file.\u003c/p\u003e\n"],["\u003cp\u003eThe tool does not create the \u003ccode\u003eapigee-org-admin\u003c/code\u003e service account and this account must be manually created through other means.\u003c/p\u003e\n"]]],[],null,["# create-service-account\n\n| You are currently viewing version 1.2 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\nCreates Google Cloud Platform (GCP) service accounts with roles that allow\nindividual Apigee hybrid components to make authorized API calls and downloads\nthe associated service account key files. You can use\nthe service account key files generated by this command in your configuration overrides file.\n\nThe `create-service-account` tool is located in\n\u003cvar translate=\"no\"\u003ehybrid_root_dir\u003c/var\u003e`/tools` directory.\n\nPrerequisites\n-------------\n\nThe `create-service-account` tool requires that the [gcloud](https://cloud.google.com/sdk/gcloud/) CLI be\ninstalled. Users invoking the utility should have the role `Service Account Admin`.\n\nTo get started, be sure your `gcloud` project\nconfiguration is set to the project you created in [Step 2: Create a Google Cloud project](/apigee/docs/hybrid/v1.2/precog-gcpproject): \n\n```\ngcloud config list project\n```\n\n\nIf you need to change the current project ID, use this command: \n\n```\ngcloud config set project gcp_project_id\n```\n\nWhere \u003cvar translate=\"no\"\u003egcp_project_id\u003c/var\u003e is the project created in [Step 2: Create a Google Cloud project](/apigee/docs/hybrid/v1.2/precog-gcpproject).\n\ncreate-service-account syntax\n-----------------------------\n\nThe `create-service-account` tool uses the following syntax: \n\n```\ncreate-service-account component_name output_dir [gcp_project_id]\n```\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003ecomponent_name\u003c/var\u003e: Specifies the hybrid service that uses the service account. Valid values are:\n - `apigee-cassandra`\n - `apigee-logger`\n - `apigee-mart`\n - `apigee-metrics`\n - `apigee-synchronizer`\n - `apigee-udca`\n\n Note that the `create-service-account` tool cannot create the\n `apigee-org-admin` service account. You must create that either with the\n GCP or gCloud APIs, as described in [Create service accounts](/apigee/docs/hybrid/v1.2/install-download-install#create-service-accounts).\n- \u003cvar translate=\"no\"\u003eoutput_dir\u003c/var\u003e: The output directory in which to store the downloaded service account key.\n- \u003cvar translate=\"no\"\u003egcp_project_id\u003c/var\u003e: (Optional) Specifies the GCP project ID of the project that is bound to your hybrid-enabled organization. If the GCP project ID is not provided, the tool attempts to retrieve it from the current gcloud configuration.\n\n| **NOTE:** When you generate a service account for `apigee-mart` you'll see this error: \n|\n| ```\n| [ERROR]: No roles found for component apigee-mart\n| ```\n|\n| You can ignore the error---the service account for MART does not need a role and is created\n| with no role assigned to it.\n\nDetailed description\n--------------------\n\nThe `create-service-account` tool:\n\n- Creates [GCP service accounts](https://cloud.google.com/iam/docs/service-accounts) used by hybrid components. The created service account is granted the role required by the specific component to operate.\n- Downloads the service account key to your system. You place the service account keys in your hybrid configuration overrides file, as explained in the hybrid [installation instructions](/apigee/docs/hybrid/v1.2/install-before-begin).\n\nThe tool creates service accounts for the following components:\n\nYou can also create service accounts in the GCP Console. See also\n[Creating\nand managing service accounts](https://cloud.google.com/iam/docs/creating-managing-service-accounts).\n\nExample\n-------\n\nThe following example creates a new service account for the `apigee-logger`\nservice and places the downloaded key in the `./service-accounts` directory. \n\n```\n./my-hybrid-root/tools/create-service-account apigee-logger ./service-accounts\n```"]]
