For setup and upgrade the commands should be run with root or a user with dull sudo access, as described in this article
But for start, status, etc. commands apigee user should be enough. In 4.17.09 apigee-all or some apigee-service commands ask for sudo password. This is because there's a package called apigee-machinejey that is ran by a user called keyadmin in the apigee group.
To fix this:
Change the apigee-machinekey ownership:
> sudo apigee-service apigee-machinekey chown apigee apigee
Modify:
vi /opt/apigee/apigee-machinekey/lib/settings ... # Set the RUN_USER to apigee instead of keyadmin RUN_USER="apigee"