Cada plataforma aceita tem os próprios requisitos de permissão para criar um cluster. Como proprietário do cluster, é possível instalar no cluster os componentes específicos da Apigee (incluindo o cert-manager e o ambiente de execução da Apigee). No entanto, se quiser delegar a outro usuário a instalação dos componentes do ambiente de execução no cluster, gerencie as permissões necessárias com authn-authz do Kubernetes.
Para instalar os componentes do ambiente de execução híbrido no cluster, um usuário que não seja um proprietário precisa ter a permissão CRUD nestes recursos:
ClusterRole
Webhooks (ValidatingWebhookConfiguration e MutatingWebhookConfiguration)
PriorityClass
ClusterIssuer
CustomerResourceDefinitions
StorageClass (opcional, se a StorageClass padrão não for usada) Para mais informações sobre como alterar o padrão e criar uma classe de armazenamento personalizada, consulte Configuração do StorageClass.
Papéis do IAM
Papéis do IAM
Você precisa ter os seguintes papéis do IAM atribuídos à sua conta de usuário para realizar estas etapas. Se a conta não tiver esses papéis, solicite que um usuário com eles executem as etapas. Para mais informações sobre os papéis do IAM, consulte a referência dos papéis básicos e predefinidos do IAM.
Para criar contas de serviço e conceder a elas acesso ao seu projeto:
Criar contas de serviço (roles/iam.serviceAccountCreator)
Administrador de IAM do projeto (roles/resourcemanager.projectIamAdmin)
Para conceder acesso ao sincronizador ao seu projeto.
Administrador da organização da Apigee (roles/apigee.admin)
Pré-requisitos
Nesta seção, descrevemos as tarefas que você precisa realizar antes de iniciar a instalação do guia de início rápido
do plano do ambiente de execução.
Conclua as tarefas a seguir para garantir que você possa iniciar a instalação do ambiente de execução, conforme descrito
nesta seção:
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-08-21 UTC."],[[["\u003cp\u003eVersion 1.8 of the Apigee hybrid documentation is end-of-life, and users are advised to upgrade to a newer version for continued support and functionality.\u003c/p\u003e\n"],["\u003cp\u003eClusters must meet minimum configuration requirements, which are detailed in the "Minimum cluster configurations" section.\u003c/p\u003e\n"],["\u003cp\u003eInstalling the hybrid runtime components requires a user with CRUD permissions on specific resources like ClusterRole, Webhooks, PriorityClass, ClusterIssuer, CustomerResourceDefinitions, and StorageClass.\u003c/p\u003e\n"],["\u003cp\u003eSpecific IAM roles, such as Create Service Accounts, Project IAM Admin, and Apigee Organization Admin, are necessary for performing project setup and granting access to the project.\u003c/p\u003e\n"],["\u003cp\u003eBefore starting the runtime installation, users need to complete organization and environment setup and have a domain name for their Apigee hybrid installation.\u003c/p\u003e\n"]]],[],null,["# Part 2: Hybrid runtime setup\n\n| You are currently viewing version 1.8 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\nSupported platforms\n-------------------\n\n\nSee [Apigee hybrid: supported platforms](/apigee/docs/hybrid/supported-platforms).\n\nMinimum cluster configurations\n------------------------------\n\n\nYour cluster must meet minimum configuration requirements. For details, see\n[Minimum cluster configurations](/apigee/docs/hybrid/v1.8/cluster-overview).\n\nCluster permissions\n-------------------\n\n\nEach supported platform has its own permission requirements for creating a cluster. As cluster\nowner, you can proceed to install the Apigee-specific components (including cert-manager and the\nApigee runtime) into the cluster. However, if you want to delegate to another user the\ninstallation of the runtime components into the cluster, you can manage the necessary permissions\nthrough Kubernetes\n[authn-authz](https://kubernetes.io/docs/reference/access-authn-authz/rbac/).\n\n\nTo install the hybrid runtime components into the cluster, a non-cluster-owner user should\nhave CRUD permission on these resources:\n\n- ClusterRole\n- Webhooks (ValidatingWebhookConfiguration and MutatingWebhookConfiguration)\n- PriorityClass\n- ClusterIssuer\n- CustomerResourceDefinitions\n- StorageClass (Optional, if the default StorageClass is not used. For information on changing the default and creating a custom storage class, see [StorageClass configuration](./cassandra-config).)\n\nIAM Roles\n---------\n\nIAM Roles\n---------\n\n\nYou need to have the following IAM roles assigned to your user account in order to perform\nthese steps. If your account does not have these roles, have a user with the roles perform the\nsteps. For more information on IAM roles, see\n[IAM basic and predefined roles reference](/iam/docs/understanding-roles).\n\n\nTo create service accounts and grant them access to your project:\n\n- Create Service Accounts (`roles/iam.serviceAccountCreator`)\n- Project IAM Admin (`roles/resourcemanager.projectIamAdmin`)\n\n\nTo grant synchronizer access to your project.\n\n- Apigee Organization Admin (`roles/apigee.admin`)\n\nPrerequisites\n-------------\n\nThis section describes tasks you must accomplish before you begin the runtime plane quickstart\ninstall.\n\n| **Note about clusters:** You can create a new separate cluster for Apigee hybrid or you can install it in a cluster that is running other workloads. \n|\n| - **Shared cluster:** If you install Apigee hybrid in a cluster running other workloads, you need to upgrade and maintain your GKE/AKS cluster at the versions and features required in common for Apigee hybrid and for your other workloads. You may want to develop a plan to migrate one or more workloads if conflicts arise between supported versions and requirements.\n| - **Separate cluster:** Creating a dedicated cluster for Apigee hybrid adds isolation. It also adds the operational effort of maintaining the new cluster.\n| Both options are valid.\n| **Note about VPC Service Controls:** If you plan to enable Google Cloud [Virtual Private Cloud (VPC) Service\n| Controls](https://cloud.google.com/vpc-service-controls) with your Apigee hybrid installation, see [Using VPC Service Controls with Apigee and\n| Apigee hybrid](/apigee/docs/api-platform/security/vpc-sc) for instructions before you proceed."]]
