Each supported platform has its own permission requirements for creating a cluster. As cluster
owner, you can proceed to install the Apigee-specific components (including cert-manager and the
Apigee runtime) into the cluster. However, if you want to delegate to another user the
installation of the runtime components into the cluster, you can manage the necessary permissions
through Kubernetes
authn-authz.
To install the hybrid runtime components into the cluster, a non-cluster-owner user should
have CRUD permission on these resources:
ClusterRole
Webhooks (ValidatingWebhookConfiguration and MutatingWebhookConfiguration)
PriorityClass
ClusterIssuer
CustomerResourceDefinitions
StorageClass (Optional, if the default StorageClass is not used. For information on
changing the default and creating a custom storage class, see StorageClass configuration.)
IAM Roles
IAM Roles
You need to have the following IAM roles assigned to your user account in order to perform
these steps. If your account does not have these roles, have a user with the roles perform the
steps. For more information on IAM roles, see
IAM basic and predefined roles reference.
To create service accounts and grant them access to your project:
Create Service Accounts (roles/iam.serviceAccountCreator)
Project IAM Admin (roles/resourcemanager.projectIamAdmin)
To grant synchronizer access to your project.
Apigee Organization Admin (roles/apigee.admin)
Prerequisites
This section describes tasks you must accomplish before you begin the runtime plane quickstart
install.
Complete the following tasks to ensure that you can successfully begin the runtime installation (as described in
this section):
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-26 UTC."],[[["\u003cp\u003eVersion 1.8 of the Apigee hybrid documentation is end-of-life, and users are advised to upgrade to a newer version for continued support and functionality.\u003c/p\u003e\n"],["\u003cp\u003eClusters must meet minimum configuration requirements, which are detailed in the "Minimum cluster configurations" section.\u003c/p\u003e\n"],["\u003cp\u003eInstalling the hybrid runtime components requires a user with CRUD permissions on specific resources like ClusterRole, Webhooks, PriorityClass, ClusterIssuer, CustomerResourceDefinitions, and StorageClass.\u003c/p\u003e\n"],["\u003cp\u003eSpecific IAM roles, such as Create Service Accounts, Project IAM Admin, and Apigee Organization Admin, are necessary for performing project setup and granting access to the project.\u003c/p\u003e\n"],["\u003cp\u003eBefore starting the runtime installation, users need to complete organization and environment setup and have a domain name for their Apigee hybrid installation.\u003c/p\u003e\n"]]],[],null,["# Part 2: Hybrid runtime setup\n\n| You are currently viewing version 1.8 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\nSupported platforms\n-------------------\n\n\nSee [Apigee hybrid: supported platforms](/apigee/docs/hybrid/supported-platforms).\n\nMinimum cluster configurations\n------------------------------\n\n\nYour cluster must meet minimum configuration requirements. For details, see\n[Minimum cluster configurations](/apigee/docs/hybrid/v1.8/cluster-overview).\n\nCluster permissions\n-------------------\n\n\nEach supported platform has its own permission requirements for creating a cluster. As cluster\nowner, you can proceed to install the Apigee-specific components (including cert-manager and the\nApigee runtime) into the cluster. However, if you want to delegate to another user the\ninstallation of the runtime components into the cluster, you can manage the necessary permissions\nthrough Kubernetes\n[authn-authz](https://kubernetes.io/docs/reference/access-authn-authz/rbac/).\n\n\nTo install the hybrid runtime components into the cluster, a non-cluster-owner user should\nhave CRUD permission on these resources:\n\n- ClusterRole\n- Webhooks (ValidatingWebhookConfiguration and MutatingWebhookConfiguration)\n- PriorityClass\n- ClusterIssuer\n- CustomerResourceDefinitions\n- StorageClass (Optional, if the default StorageClass is not used. For information on changing the default and creating a custom storage class, see [StorageClass configuration](./cassandra-config).)\n\nIAM Roles\n---------\n\nIAM Roles\n---------\n\n\nYou need to have the following IAM roles assigned to your user account in order to perform\nthese steps. If your account does not have these roles, have a user with the roles perform the\nsteps. For more information on IAM roles, see\n[IAM basic and predefined roles reference](/iam/docs/understanding-roles).\n\n\nTo create service accounts and grant them access to your project:\n\n- Create Service Accounts (`roles/iam.serviceAccountCreator`)\n- Project IAM Admin (`roles/resourcemanager.projectIamAdmin`)\n\n\nTo grant synchronizer access to your project.\n\n- Apigee Organization Admin (`roles/apigee.admin`)\n\nPrerequisites\n-------------\n\nThis section describes tasks you must accomplish before you begin the runtime plane quickstart\ninstall.\n\n| **Note about clusters:** You can create a new separate cluster for Apigee hybrid or you can install it in a cluster that is running other workloads. \n|\n| - **Shared cluster:** If you install Apigee hybrid in a cluster running other workloads, you need to upgrade and maintain your GKE/AKS cluster at the versions and features required in common for Apigee hybrid and for your other workloads. You may want to develop a plan to migrate one or more workloads if conflicts arise between supported versions and requirements.\n| - **Separate cluster:** Creating a dedicated cluster for Apigee hybrid adds isolation. It also adds the operational effort of maintaining the new cluster.\n| Both options are valid.\n| **Note about VPC Service Controls:** If you plan to enable Google Cloud [Virtual Private Cloud (VPC) Service\n| Controls](https://cloud.google.com/vpc-service-controls) with your Apigee hybrid installation, see [Using VPC Service Controls with Apigee and\n| Apigee hybrid](/apigee/docs/api-platform/security/vpc-sc) for instructions before you proceed."]]
