Migration of Encrypted KVMs from APIGEE OPDK to APIGEE hybrid

[Suresh_Ambati]

Hi team, 

We have actually migrated Encrypted KVMs from APIGEE OPDK to APIGEE hybrid but our API proxies are failing in Servicecallout policy where the encrypted KVMs are referenced..I am suspecting it is because of migrated Encrypted KVMs.. I am not sure whether the encrypted KVMs were migrated with the same values... can you please help me understand this? 

[apickelsimer]

We need more information on what you've done so far, otherwise I'd only be guessing.

How did you migrate the KVMs? What process did you follow?

What debugging have you conducted so far?

Why do you suspect the KVMs are causing the Service Callouts to fail?

Have you checked the values of the new KVMs to see if they are correct?

If you are seeing the values of the new KVMs as ****** then the export/import you performed was not correct. In OPDK, you cannot access an encrypted KVM from the management API. The values will always be obsfucated. You will only be able to read the values via policy within a proxy. So if this is the case then you could create a utility proxy to extract the values. Otherwise, if you have the KVM data stored somewhere (e g. git repo) that would be much easier to re-import.

Here's a related community post https://www.googlecloudcommunity.com/gc/Apigee/Move-data-from-encrypted-KVM-store-between-orgs-and-e...

[yuriyl]

This is utility to migrate KVMs and entries, including encrypted, from OPDK to Hybrid:

https://github.com/apigee/ahr/blob/main/README-amu.md