Nesta etapa, você verá como criar as contas de serviço do Google Cloud e as credenciais TLS necessárias
para que o Apigee híbrido funcione.
Criar contas de serviço
A Apigee híbrida usa contas de serviço do Google Cloud para
permitir que os componentes híbridos se comuniquem fazendo chamadas de API autorizadas.
Nesta etapa, você usa uma ferramenta de linha de comando da Apigee híbrida para criar um conjunto de contas de serviço e fazer o download dos arquivos de chaves privadas das contas de serviço.
A Apigee fornece uma ferramenta, create-service-account, que cria as contas de serviço, atribui os papéis às contas de serviço e cria e faz o download dos arquivos de chave para a conta de serviço em um único comando.
Para saber mais sobre o create-service-account e todas as
opções disponíveis, consulte create-service-account
Verifique se a variável de ambiente PROJECT_ID está definida como o ID do projeto do Google Cloud.
A ferramenta create-service-account lê a variável de ambiente PROJECT_ID para criar as contas de serviço no projeto correto.
echo $PROJECT_ID
Crie uma conta de serviço de non-prod com o comando a seguir. Esse comando
cria uma única conta de serviço chamada apigee-non-prod para uso em ambientes de
não produção e coloca o arquivo de chave salvo no diretório $HYBRID_FILES/service-accounts.
Verifique se a chave da conta de serviço foi criada usando o seguinte comando. Você é responsável por armazenar essas
chaves privadas com segurança. Os nomes dos arquivos da chave são prefixados com o nome do seu projeto do Google Cloud.
ls $HYBRID_FILES/service-accounts
O resultado será similar a este:
project_id-apigee-non-prod.json
Agora você criou contas de serviço e atribuiu os papéis necessários aos componentes da
Apigee híbrida. Em seguida, crie os certificados TLS exigidos pelo gateway de entrada híbrido.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-28 UTC."],[[["\u003cp\u003eThis guide details how to create Google Cloud service accounts and download their private key files using the \u003ccode\u003ecreate-service-account\u003c/code\u003e tool, essential for Apigee hybrid component communication.\u003c/p\u003e\n"],["\u003cp\u003eFor non-production environments, a single service account named "apigee-non-prod" can be used for all components, but in production, it is recommended to use a separate service account for each component.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003ecreate-service-account\u003c/code\u003e tool simplifies service account creation by also assigning roles and downloading key files, and can be used to create individual accounts for production environments.\u003c/p\u003e\n"],["\u003cp\u003eThe tool requires the \u003cstrong\u003ePROJECT_ID\u003c/strong\u003e environment variable to be set, and after creation, you must verify that the key files were generated successfully.\u003c/p\u003e\n"],["\u003cp\u003eEnsure that the Cloud Pub/Sub API is enabled in your Google Cloud project for the Synchronizer service account.\u003c/p\u003e\n"]]],[],null,["# Step 4: Create service accounts and credentials\n\n| You are currently viewing version 1.8 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\nThis step explains how to create the Google Cloud service accounts and TLS credentials\nthat are required for Apigee hybrid to operate.\n\nCreate the service accounts\n---------------------------\n\n\nApigee hybrid uses Google Cloud [service accounts](/iam/docs/service-accounts) to\nallow hybrid components to communicate by making authorized API calls.\n\n\nIn this step, you use an Apigee hybrid command-line tool to create a set of service accounts\nand download the service account private key files.\n| **Note:** In a production hybrid environment Apigee recommends using a separate service account for each component. For the purposes of this tutorial, you can create a single service account named \"apigee-non-prod\" that you can use for all components.\n|\n|\n| To learn more about service accounts and read the full list of service accounts recommended for\n| production environments, see the following:\n|\n| - [About service accounts](/apigee/docs/hybrid/v1.8/sa-about)\n| - [Service accounts and roles used by hybrid components](/apigee/docs/hybrid/v1.8/sa-about#recommended-sas)\n\n\nApigee provides a tool, `create-service-account`, that creates the service accounts,\nassigns the roles to the service accounts, and creates and downloads the key files for the service\naccount in a single command.\n\n- To learn more about `create-service-account` and all its options see [`create-service-account`](/apigee/docs/hybrid/v1.8/create-service-account)\n- To learn about the related Google Cloud concepts, see [Creating\n and managing service accounts](https://cloud.google.com/iam/docs/creating-managing-service-accounts) and [Creating\n and managing service account keys](https://cloud.google.com/iam/docs/creating-managing-service-account-keys).\n\n1. Make sure your **PROJECT_ID** environment variable is set to your Google cloud project ID. The `create-service-account` tool reads the **PROJECT_ID** environment variable to create the service accounts in the correct project. \n\n ```\n echo $PROJECT_ID\n ```\n2. Create a *non-prod* service account with the following command. This command creates a single service account named `apigee-non-prod` for use in non-production environments and places the downloaded key file in the `$HYBRID_FILES/service-accounts` directory. \n\n ```\n $HYBRID_FILES/tools/create-service-account --env non-prod --dir $HYBRID_FILES/service-accounts\n ```\n | **Note:** If you would prefer to create all the individual service accounts for a production environment, use the following command: \n |\n | ```\n | $HYBRID_FILES/tools/create-service-account --env prod --dir $HYBRID_FILES/service-accounts\n | ```\n\n\n If you see the following prompt, enter \u003ckbd\u003ey\u003c/kbd\u003e: \n\n ```transact-sql\n [INFO]: gcloud configured project ID is project_id.\n Enter: y to proceed with creating service account in project: project_id\n Enter: n to abort.\n ```\n\n\n If this is the first time you are creating an SA with a particular name assigned, then the\n tool creates it without further prompts.\n\n\n If, however, you see the following message and prompt, enter \u003ckbd\u003ey\u003c/kbd\u003e to generate\n new keys: \n\n ```transact-sql\n [INFO]: Service account apigee-non-prod@\u003cvar translate=\"no\"\u003eproject_id\u003c/var\u003e.iam.gserviceaccount.com already exists.\n ...\n [INFO]: The service account might have keys associated with it. It is recommended to use existing keys.\n Press: y to generate new keys.(this does not deactivate existing keys)\n Press: n to skip generating new keys.\n ```\n | **Note:** The Cloud Pub/Sub API must be enabled in the Google Cloud project that owns the service account for Synchronizer. To see if you enabled this API, see [Enable APIs](/apigee/docs/hybrid/v1.8/precog-enableapi).\n3. Verify that the service account key was created using the following command. You are responsible for storing these private keys securely. The key filenames are prefixed with the name of your Google Cloud project. \n\n ```\n ls $HYBRID_FILES/service-accounts\n ```\n\n\n The result should look something like the following: \n\n ```scdoc\n project_id-apigee-non-prod.json\n ```\n\n| **Tip:** Apigee hybrid includes a validator that checks your service accounts' key files and permissions when [apigeectl](/apigee/docs/hybrid/v1.8/cli-reference) applies the Apigee hybrid runtime components to your cluster. This validation is enabled by default. For more information, see [Service account\n| validation](/apigee/docs/hybrid/v1.8/sa-validation).\n\n\nYou now have created service accounts and assigned the roles needed by the Apigee hybrid\ncomponents. Next, create the TLS certificates required by the hybrid ingress gateway.\n[1](/apigee/docs/hybrid/v1.8/install-create-cluster) [2](/apigee/docs/hybrid/v1.8/install-cert-manager) [3](/apigee/docs/hybrid/v1.8/install-apigeectl) [4](/apigee/docs/hybrid/v1.8/install-service-accounts) [(NEXT) Step 5: Create TLS certificates](/apigee/docs/hybrid/v1.8/install-create-tls-certificates) [6](/apigee/docs/hybrid/v1.8/install-configure-cluster) [7](/apigee/docs/hybrid/v1.8/install-enable-synchronizer-access) [8](/apigee/docs/hybrid/v1.8/install-hybrid-runtime) [9](/apigee/docs/hybrid/v1.8/install-expose-apigee-ingress) [10](/apigee/docs/hybrid/v1.8/install-deploy-proxy)\n\n\u003cbr /\u003e"]]
