En este paso, se explica cómo crear las cuentas de servicio de Google Cloud y las credenciales TLS que se requieren para que Apigee Hybrid funcione.
Crea las cuentas de servicio
Apigee Hybrid usa cuentas de servicio de Google Cloud para permitir que los componentes híbridos se comuniquen mediante llamadas a la API autorizadas.
En este paso, usarás una herramienta de línea de comandos híbrida de Apigee para crear un conjunto de cuentas de servicio y descargar los archivos de claves privadas de la cuenta de servicio.
Apigee proporciona una herramienta, create-service-account, que crea las cuentas de servicio, les asigna funciones a las cuentas de servicio y crea y descarga los archivos de claves para la cuenta de servicio en un solo comando. Para obtener información sobre los conceptos relacionados de Google Cloud, consulta Crea y administra cuentas de servicio y Crea y administra claves de cuentas de servicio.
Ejecuta el siguiente comando desde el directorio hybrid-files: Con este comando, se crea una sola cuenta de servicio llamada apigee-non-prod para usarla en entornos que no son de producción y se coloca el archivo de claves descargado en el directorio ./service-accounts.
En el ejemplo anterior, PROJECT_ID es el ID del proyecto de Google Cloud en el que creas las cuentas de servicio. Consulta también la sintaxis create-service-account.
Cuando veas el siguiente mensaje, ingresa y:
[INFO]: gcloud configured project ID is project_id.
Enter: y to proceed with creating service account in project: project_id
Enter: n to abort.
Si es la primera vez que se crea una cuenta de servicio con el mismo nombre asignado por la herramienta, la herramienta solo la crea, y no tienes que realizar ninguna otra acción.
Sin embargo, si ves el siguiente mensaje e instrucción, ingresa y para generar claves nuevas:
[INFO]: Service account apigee-non-prod@project_id.iam.gserviceaccount.com already exists.
...
[INFO]: The service account might have keys associated with it. It is recommended to use existing keys.
Press: y to generate new keys.(this does not de-activate existing keys)
Press: n to skip generating new keys.
Verifica que la clave de la cuenta de servicio se haya creado con el siguiente comando. Eres responsable de almacenar estas claves privadas de forma segura. Los nombres de los archivos de la clave tienen el prefijo del nombre de tu proyecto de Google Cloud.
ls ./service-accounts
El resultado debería ser similar a lo siguiente:
project_id-apigee-non-prod.json
Ya creaste cuentas de servicio y asignaste las funciones que necesitan los componentes híbridos de Apigee. A continuación, se encuentran los certificados TLS que requiere la puerta de enlace de entrada híbrida.
[[["Fácil de comprender","easyToUnderstand","thumb-up"],["Resolvió mi problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Información o código de muestra incorrectos","incorrectInformationOrSampleCode","thumb-down"],["Faltan la información o los ejemplos que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-09-03 (UTC)"],[[["\u003cp\u003eThis documentation version (1.5) is end-of-life, and upgrading to a newer version is recommended for continued support and access to the latest features.\u003c/p\u003e\n"],["\u003cp\u003eApigee hybrid utilizes Google Cloud service accounts to facilitate communication between hybrid components through authorized API calls, and this section provides guidance on creating them.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003ecreate-service-account\u003c/code\u003e tool provided by Apigee simplifies the process of creating service accounts, assigning roles, and downloading the associated key files, with options for non-production or production environments.\u003c/p\u003e\n"],["\u003cp\u003eFor a non-production setup, a single service account named "apigee-non-prod" can be used, while separate service accounts for each component are recommended in a production setting.\u003c/p\u003e\n"],["\u003cp\u003eAfter creating the service accounts, it is important to securely store the downloaded private key files, which are essential for hybrid component communication and also to note that the next step involves creating the required TLS certificates for the hybrid ingress gateway.\u003c/p\u003e\n"]]],[],null,["# Step 5: Create service accounts and credentials\n\n| You are currently viewing version 1.5 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\nThis step explains how to create the Google Cloud service accounts and TLS credentials\nthat are required for Apigee hybrid to operate.\n\nCreate the service accounts\n---------------------------\n\n\nApigee hybrid uses Google Cloud [service accounts](/iam/docs/service-accounts) to\nallow hybrid components to communicate by making authorized API calls.\n\n\nIn this step, you use an Apigee hybrid command-line tool to create a set of service accounts\nand download the service account private key files.\n| **Note:** In a production hybrid environment Apigee recommends using a separate service account for each component. For purposes of this tutorial, you can create a single service account named \"apigee-non-prod\" that you can use for all components.\n|\n|\n| To learn more about service accounts and read the full list of service accounts recommended for\n| production environments, see the following:\n|\n| - [About service accounts](/apigee/docs/hybrid/v1.5/sa-about)\n| - [Service accounts and roles used by hybrid components](/apigee/docs/hybrid/v1.5/sa-about#recommended-sas)\n\n\nApigee provides a tool, `create-service-account`, that creates the service accounts,\nassigns the roles to the service accounts, and creates and downloads the key files for the service\naccount in a single command. To learn about the related Google Cloud concepts, see\n[Creating\nand managing service accounts](https://cloud.google.com/iam/docs/creating-managing-service-accounts) and\n[Creating\nand managing service account keys](https://cloud.google.com/iam/docs/creating-managing-service-account-keys).\n\n1. Be sure that you are in the \u003cvar translate=\"no\"\u003ebase_directory\u003c/var\u003e`/hybrid-files` directory you configured in [Set up the project directory structure](#setup-directory).\n2. Execute the following command from inside the `hybrid-files` directory. This command creates a single service account named `apigee-non-prod` for use in a non-production environments and places the downloaded key file in the `./service-accounts` directory. \n\n ```\n ./tools/create-service-account --env non-prod --dir ./service-accounts --project-id PROJECT_ID\n ```\n\n\n Where \u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e is the Project ID of the Google Cloud project in which you are\n creating the service accounts. See also [create-service-account syntax](/apigee/docs/hybrid/v1.6/create-service-account#syntax).\n | **Note:** If you would prefer to create all the individual service accounts for a production environment, use the following command: \n |\n | ```\n | ./tools/create-service-account --env prod --dir ./service-accounts\n | ```\n\n\n When you see the following prompt, enter \u003ckbd\u003ey\u003c/kbd\u003e: \n\n ```\n [INFO]: gcloud configured project ID is project_id.\n Enter: y to proceed with creating service account in project: project_id\n Enter: n to abort.\n ```\n\n\n If this is the first time an SA with the same name assigned by the tool was created, then\n the tool just creates it, and you do not have to do anything further.\n\n\n If, however, you see the following message and prompt, enter \u003ckbd\u003ey\u003c/kbd\u003e to generate\n new keys: \n\n ```\n [INFO]: Service account apigee-non-prod@project_id.iam.gserviceaccount.com already exists.\n ...\n [INFO]: The service account might have keys associated with it. It is recommended to use existing keys.\n Press: y to generate new keys.(this does not de-activate existing keys)\n Press: n to skip generating new keys.\n ```\n | **Note:** The Cloud Pub/Sub API must be enabled in the Google Cloud project that owns the service account for Synchronizer. See [Enable APIs](/apigee/docs/hybrid/v1.5/precog-enableapi).\n3. Verify that the service account key was created using the following command. You are responsible for storing these private keys securely. The key filenames are prefixed with the name of your Google Cloud project. \n\n ```\n ls ./service-accounts\n ```\n\n\n The result should look something like the following: \n\n ```\n project_id-apigee-non-prod.json\n ```\n\n| **Tip:** Apigee hybrid includes a validator that checks your service accounts' key files and permissions when [apigeectl](/apigee/docs/hybrid/v1.5/cli-reference) applies the Apigee hybrid runtime components to your cluster. This validation is enabled by default. For more information, see [Service account\n| validation](/apigee/docs/hybrid/v1.5/sa-validation).\n\n\nYou now have created service accounts and assigned the roles needed by the Apigee hybrid\ncomponents. Next, the TLS certificates required by the hybrid ingress gateway..\n[1](/apigee/docs/hybrid/v1.5/install-create-cluster) [2](/apigee/docs/hybrid/v1.5/install-cert-manager) [3](/apigee/docs/hybrid/v1.5/install-asm) [4](/apigee/docs/hybrid/v1.5/install-apigeectl) [5](/apigee/docs/hybrid/v1.5/install-service-accounts) [(NEXT) Step 6: Create TLS certificates](/apigee/docs/hybrid/v1.5/install-create-tls-certificates) [7](/apigee/docs/hybrid/v1.5/install-configure-cluster) [8](/apigee/docs/hybrid/v1.5/install-enable-synchronizer-access) [9](/apigee/docs/hybrid/v1.5/install-hybrid-runtime)\n\n\u003cbr /\u003e"]]
