The Apigee hybrid installer uses defaults for many settings; however, there are a few settings
that do not have defaults. You must provide values for these settings, as explained next.
Be sure you are in the hybrid-base-directory/hybrid-files/overrides/ directory.
cd hybrid-base-directory/hybrid-files/overrides
Create a new file named overrides.yaml in your favorite text editor. For
example:
vi overrides.yaml
The overrides.yaml provides the configuration for your unique Apigee hybrid
installation. The overrides file in this step provides a basic configuration for a small-footprint
hybrid runtime installation, suitable for your first installation.
In overrides.yaml, add the required property values, shown below. A detailed
description of each property is also provided below:
Syntax
Make sure the overrides.yaml file has the following structure and syntax.
Values in red, bold italics are
property values that you must provide. They are described in the table below.
There are differences between the different platforms for the Google Cloud project region and
Kubernetes cluster region. Choose the platform where you are installing Apigee hybrid.
gcp:
region: analytics-region
projectID: gcp-project-id
k8sCluster:
name: cluster-name
region: cluster-location # Must be the closest Google Cloud region to your cluster.
org: org-name
instanceID: "unique-instance-identifier"
cassandra:
hostNetwork: false
# Set to false for single region installations and multi-region installations
# with connectivity between pods in different clusters, for example GKE installations.
# Set to true for multi-region installations with no communication between
# pods in different clusters, for example GKE On-prem, GKE on AWS, Anthos on bare metal,
# AKS, EKS, and OpenShift installations.
# See Multi-region deployment: Prerequisites
virtualhosts:
- name: environment-group-name
sslCertPath: ./certs/cert-name.pem
sslKeyPath: ./certs/key-name.key
envs:
- name: environment-name
serviceAccountPaths:
synchronizer: ./service-accounts/synchronizer-service-account-name.json
# for non-production environments, gcp-project-id-apigee-non-prod.json
# for production environments, gcp-project-apigee-synchronizer.json
udca: ./service-accounts/udca-service-account-name.json
# for non-production environments, gcp-project-id-apigee-non-prod.json
# for production environments, gcp-project-id-apigee-udca.json
mart:
serviceAccountPath: ./service-accounts/mart-service-account-name.json
# for non-production environments, gcp-project-id-apigee-non-prod.json
# for production environments, gcp-project-id-apigee-mart.json
connectAgent:
serviceAccountPath: ./service-accounts/mart-service-account-name.json
# for non-production environments, gcp-project-id-apigee-non-prod.json
# for production environments, gcp-project-id-apigee-mart.json
# Same account used for mart and connectAgent
metrics:
serviceAccountPath: ./service-accounts/metrics-service-account-name.json
# for non-production environments, gcp-project-id-apigee-non-prod.json
# for production environments, gcp-project-id-apigee-metrics.json
watcher:
serviceAccountPath: ./service-accounts/watcher-service-account-name.json
# for non-production environments, gcp-project-id-apigee-non-prod.json
# for production environments, gcp-project-id-apigee-watcher.json
logger:
enabled: true # set to "false" for GKE.
serviceAccountPath: ./service-accounts/logger-service-account-name.json
# for non-production environments, gcp-project-id-apigee-non-prod.json
# for production environments, gcp-project-id-apigee-logger.json
Example
The following example shows a completed overrides file with example property values
added:
gcp:
region: us-central1
projectID: hybrid-example
k8sCluster:
name: apigee-hybrid
region: us-central1
org: hybrid-example
instanceID: "my_hybrid_example"
cassandra:
hostNetwork: false
virtualhosts:
- name: example-env-group
sslCertPath: ./certs/keystore.pem
sslKeyPath: ./certs/keystore.key
envs:
- name: test
serviceAccountPaths:
synchronizer: ./service-accounts/hybrid-project-apigee-non-prod.json
# for production environments, hybrid-project-apigee-synchronizer.json
udca: ./service-accounts/hybrid-project-apigee-non-prod.json
# for production environments, hybrid-project-apigee-udca.json
mart:
serviceAccountPath: ./service-accounts/hybrid-project-apigee-non-prod.json
# for production environments, hybrid-project-apigee-mart.json
connectAgent:
serviceAccountPath: ./service-accounts/hybrid-project-apigee-non-prod.json
# for production environments, example-hybrid-apigee-mart.json
metrics:
serviceAccountPath: ./service-accounts/hybrid-project-apigee-non-prod.json
# for production environments, hybrid-project-apigee-metrics.json
watcher:
serviceAccountPath: ./service-accounts/hybrid-project-apigee-non-prod.json
# for production environments, hybrid-project-apigee-watcher.json
logger:
enabled: true # set to "false" for GKE.
serviceAccountPath: ./service-accounts/hybrid-project-apigee-non-prod.json
# for production environments, logger-service-account-name.json
When you are finished, save the file.
The following table describes each of the property values that you must provide in the
overrides file. For more information, see
Configuration property reference.
Variable
Description
analytics-region
In GKE, You must set this value to the same region where the cluster is running. In all
other platforms, select the closest analytics region to your cluster that has Analytics
support (see the table in
Part 1, Step 4: Create an organization.
This is the value you assigned to the environment variable
ANALYTICS_REGION previously.
gcp-project-id
Identifies the Google Cloud project where the apigee-logger and the apigee-metrics push
their data. This is the value assigned to the environment variable PROJECT_ID.
cluster-name
Your Kubernetes cluster name. This is the value assigned to the environment variable
CLUSTER_NAME.
cluster-location
The region where the cluster is running. This is the region where you created the
cluster in Step 1: Create an cluster.
This is the value you assigned to the environment variable
CLUSTER_LOCATION previously.
org-name
The ID of your Apigee hybrid organization. This is the value assigned to the environment
variable ORG_NAME.
unique-instance-identifier
A unique string to identify this instance. This can be any combination of letters and
numbers up to 63 characters in length.
You can create multiple organizations in the same cluster, but the instanceId
must be the same for all orgs in the same kubernetes cluster.
Enter the name of the self-signed TLS key and certificate files that you generated previously in
Step 6: Create TLS certificates.
These files must be located in
the base_directory/hybrid-files/certs directory. For example:
For non-production environments, the name of the single service account,
non-prod by default. For production environments, the name of the
apigee-synchronizer service account key file that you generated
with the create-service-account tool in
Hybrid runtime setup -
Step 6: Create service accounts and credentials. You can see the list of service
account files in your service-accounts/ directory. Fore example:
ls ../service-accounts/
udca-service-account-name
For non-production environments, the name of the single service account,
non-prod by default. For production environments, the name of the
apigee-udca service account key file that you generated
with the create-service-account tool.
mart-service-account-name
For non-production environments, the name of the single service account,
non-prod by default. For production environments, the name of the
apigee-mart service account key file that you generated
with the create-service-account tool.
metrics-service-account-name
For non-production environments, the name of the single service account,
non-prod by default. For production environments, the name of the
apigee-metrics service account key file that you generated
with the create-service-account tool.
watcher-service-account-name
For non-production environments, the name of the single service account,
non-prod by default. For production environments, the name of the
apigee-watcher service account key file that you generated
with the create-service-account tool.
logger-service-account-name
For non-production environments, the name of the single service account,
non-prod by default. For production environments, the name of the
apigee-logger service account key file that you generated
with the create-service-account tool.
Summary
The configuration file tells Kubernetes how to deploy the hybrid components to
a cluster. Next, you will enable synchronizer access so the Apigee runtime and management planes
will be able to communicate.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-26 UTC."],[[["\u003cp\u003eThis document provides instructions for configuring the \u003ccode\u003eoverrides.yaml\u003c/code\u003e file, which is essential for customizing your unique Apigee hybrid installation, using a basic setup suitable for a first-time installation.\u003c/p\u003e\n"],["\u003cp\u003eYou must navigate to the \u003ccode\u003ehybrid-base-directory/hybrid-files/overrides\u003c/code\u003e directory and create an \u003ccode\u003eoverrides.yaml\u003c/code\u003e file to specify required properties like \u003ccode\u003egcp\u003c/code\u003e, \u003ccode\u003ek8sCluster\u003c/code\u003e, \u003ccode\u003eorg\u003c/code\u003e, and others to enable a functional Apigee hybrid environment.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eoverrides.yaml\u003c/code\u003e file uses a specific syntax, including defining values for regions, project IDs, cluster names, organization names, and unique instance identifiers, along with service account paths and virtual host details, that must be specified.\u003c/p\u003e\n"],["\u003cp\u003eSpecific service account key files, generated by the create-service-account tool, must be referenced within the \u003ccode\u003eoverrides.yaml\u003c/code\u003e file for components such as synchronizer, udca, mart, metrics, watcher, and logger.\u003c/p\u003e\n"],["\u003cp\u003eThe document version (1.5) of the Apigee hybrid documentation you are viewing is end-of-life, and you should consider upgrading to a newer version for the most up-to-date information and support.\u003c/p\u003e\n"]]],[],null,["# Step 7: Configure the hybrid runtime\n\n| You are currently viewing version 1.5 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\nSpecify configuration overrides\n-------------------------------\n\n\nThe Apigee hybrid installer uses defaults for many settings; however, there are a few settings\nthat do not have defaults. You must provide values for these settings, as explained next.\n\n1. Be sure you are in the \u003cvar translate=\"no\"\u003ehybrid-base-directory\u003c/var\u003e`/hybrid-files/overrides/` directory. \n\n ```\n cd hybrid-base-directory/hybrid-files/overrides\n ```\n2. Create a new file named **\u003cvar translate=\"no\"\u003eoverrides\u003c/var\u003e`.yaml`** in your favorite text editor. For example: \n\n ```\n vi overrides.yaml\n ```\n\n\n The \u003cvar translate=\"no\"\u003eoverrides\u003c/var\u003e`.yaml` provides the configuration for your unique Apigee hybrid\n installation. The overrides file in this step provides a basic configuration for a small-footprint\n hybrid runtime installation, suitable for your first installation.\n3. In \u003cvar translate=\"no\"\u003eoverrides\u003c/var\u003e`.yaml`, add the required property values, shown below. A detailed description of each property is also provided below: \n\n ### Syntax\n\n Make sure the \u003cvar translate=\"no\"\u003eoverrides\u003c/var\u003e`.yaml` file has the following structure and syntax.\n Values in \u003cvar translate=\"no\"\u003ered, bold italics\u003c/var\u003e are\n property values that you must provide. They are described in the [table below](#tablebelow).\n\n\n There are differences between the different platforms for the Google Cloud project region and\n Kubernetes cluster region. Choose the platform where you are installing Apigee hybrid. \n\n ```\n gcp:\n region: analytics-region\n projectID: gcp-project-id\n\n k8sCluster:\n name: cluster-name\n region: cluster-location # Must be the closest Google Cloud region to your cluster.\n org: org-name\n\n instanceID: \"unique-instance-identifier\"\n \n cassandra:\n hostNetwork: false\n # Set to false for single region installations and multi-region installations\n # with connectivity between pods in different clusters, for example GKE installations.\n # Set to true for multi-region installations with no communication between\n # pods in different clusters, for example GKE On-prem, GKE on AWS, Anthos on bare metal,\n # AKS, EKS, and OpenShift installations.\n # See Multi-region deployment: Prerequisites\n\n virtualhosts:\n - name: environment-group-name\n sslCertPath: ./certs/cert-name.pem\n sslKeyPath: ./certs/key-name.key\n\n envs:\n - name: environment-name\n serviceAccountPaths:\n synchronizer: ./service-accounts/synchronizer-service-account-name.json\n # for non-production environments, gcp-project-id-apigee-non-prod.json\n # for production environments, gcp-project-apigee-synchronizer.json\n udca: ./service-accounts/udca-service-account-name.json\n # for non-production environments, gcp-project-id-apigee-non-prod.json\n # for production environments, gcp-project-id-apigee-udca.json\n\n mart:\n serviceAccountPath: ./service-accounts/mart-service-account-name.json\n # for non-production environments, gcp-project-id-apigee-non-prod.json\n # for production environments, gcp-project-id-apigee-mart.json\n\n connectAgent:\n serviceAccountPath: ./service-accounts/mart-service-account-name.json\n # for non-production environments, gcp-project-id-apigee-non-prod.json\n # for production environments, gcp-project-id-apigee-mart.json\n # Same account used for mart and connectAgent\n\n metrics:\n serviceAccountPath: ./service-accounts/metrics-service-account-name.json\n # for non-production environments, gcp-project-id-apigee-non-prod.json\n # for production environments, gcp-project-id-apigee-metrics.json\n\n watcher:\n serviceAccountPath: ./service-accounts/watcher-service-account-name.json\n # for non-production environments, gcp-project-id-apigee-non-prod.json\n # for production environments, gcp-project-id-apigee-watcher.json\n\n logger:\n enabled: true # set to \"false\" for GKE.\n serviceAccountPath: ./service-accounts/logger-service-account-name.json\n # for non-production environments, gcp-project-id-apigee-non-prod.json\n # for production environments, gcp-project-id-apigee-logger.json\n\n ```\n\n ### Example\n\n The following example shows a completed overrides file with example property values\n added: \n\n ```\n gcp:\n region: us-central1\n projectID: hybrid-example\n\n k8sCluster:\n name: apigee-hybrid\n region: us-central1\n\n org: hybrid-example\n\n instanceID: \"my_hybrid_example\"\n \n cassandra:\n hostNetwork: false\n\n virtualhosts:\n - name: example-env-group\n sslCertPath: ./certs/keystore.pem\n sslKeyPath: ./certs/keystore.key\n\n envs:\n - name: test\n serviceAccountPaths:\n synchronizer: ./service-accounts/hybrid-project-apigee-non-prod.json\n # for production environments, hybrid-project-apigee-synchronizer.json\n udca: ./service-accounts/hybrid-project-apigee-non-prod.json\n # for production environments, hybrid-project-apigee-udca.json\n\n mart:\n serviceAccountPath: ./service-accounts/hybrid-project-apigee-non-prod.json\n # for production environments, hybrid-project-apigee-mart.json\n\n connectAgent:\n serviceAccountPath: ./service-accounts/hybrid-project-apigee-non-prod.json\n # for production environments, example-hybrid-apigee-mart.json\n\n metrics:\n serviceAccountPath: ./service-accounts/hybrid-project-apigee-non-prod.json\n # for production environments, hybrid-project-apigee-metrics.json\n\n watcher:\n serviceAccountPath: ./service-accounts/hybrid-project-apigee-non-prod.json\n # for production environments, hybrid-project-apigee-watcher.json\n\n logger:\n enabled: true # set to \"false\" for GKE.\n serviceAccountPath: ./service-accounts/hybrid-project-apigee-non-prod.json\n # for production environments, logger-service-account-name.json\n\n ```\n4. When you are finished, save the file.\n\n\nThe following table describes each of the property values that you must provide in the\noverrides file. For more information, see\n[Configuration property reference](/apigee/docs/hybrid/v1.5/config-prop-ref).\n\n| **Note:** If you want to create a security perimeter around your cluster and related Cloud services, you can configure one using Google Cloud [Virtual Private Cloud (VPC) Service\n| Controls](https://cloud.google.com/vpc-service-controls) with Apigee hybrid. See [Using\n| VPC Service Controls with Apigee and Apigee hybrid](/apigee/docs/api-platform/security/vpc-sc) for instructions.\n\nSummary\n-------\n\n\nThe configuration file tells Kubernetes how to deploy the hybrid components to\na cluster. Next, you will enable synchronizer access so the Apigee runtime and management planes\nwill be able to communicate.\n[1](/apigee/docs/hybrid/v1.5/install-create-cluster) [2](/apigee/docs/hybrid/v1.5/install-cert-manager) [3](/apigee/docs/hybrid/v1.5/install-asm) [4](/apigee/docs/hybrid/v1.5/install-apigeectl) [5](/apigee/docs/hybrid/v1.5/install-service-accounts) [6](/apigee/docs/hybrid/v1.5/install-create-tls-certificates) [7](/apigee/docs/hybrid/v1.5/install-configure-cluster) [(NEXT) Step 8: Enable Synchronizer access](/apigee/docs/hybrid/v1.5/install-enable-synchronizer-access) [9](/apigee/docs/hybrid/v1.5/install-hybrid-runtime)\n\n\u003cbr /\u003e"]]