Apigee Management and runtime plane

[arfiqbal]

Hi Guys

We are planning to install apigee hybrid

In our organization we have create k8s cluster in one project but that is managed by some other team so can we create management plane in one project and runtime on different project(where kubenetes is running)

Project A which is managed by us and we wanted to use it for management plane  so that we can use this project for apigee org

Project B which is managed by k8s team where we have installed runtime plane

any suggestion guys ? help needed to design

[Former Community Member · Accepted solution]

Yes, this is allowed/possible. Ensure the service accounts (for UDA, Sync etc.) are created in the project where the control plane is configured.

[arfiqbal]

@Former Community Member  when you say control plane you mean runtime or management plane ?

do we need to enable apigee related api in both the project ?

If you don't mind can you explain which service account we have to create in which project (like project A = mgmt and project B = runtime)

[dchiesa1]

control plane = management plane

When Nandan says "create the service accounts in the project where the controll plane is configured" he means in the project that you use for the mgmt UI.  In other words, the project you select when you visit apigee.google.com . 

The runtime project, in your case, happens to run in GKE in the cloud, but that just happens to be your choice.  In the Apigee hybrid model, the runtime could be hosted anywhere.  On your own datacenter, in Azure, and so on.  If it were to run in Azure, for example,  there would be no possibility to create a  "Google cloud service account" in the runtime, right?   You would need to specify the service account credentials from the mgmt plane, to the Azure-based runtime plane.   And so the same would apply  when your runtime plane runs somewhere other than Azure. Even if it is GKE! 

You need to enable the Apigee-related APIs in the control plane project. The same reasoning applies here, as it did for the service accounts. 

I hope this clears things up.

[arfiqbal]

@dchiesa1 @Former Community Member  thanks and appreciate your help