Para hacer las llamadas a la API de Apigee que se describen más adelante en este tema, debes obtener un token de autorización que tenga el rol de administrador de la organización de Apigee.
Si no eres el propietario del proyecto de Google Cloud asociado a tu organización de Apigee hybrid, asegúrate de que tu cuenta de usuario de Google Cloud tenga el rol roles/apigee.admin (administrador de la organización de Apigee). Puedes consultar los roles que tienes asignados con este comando:
Si no tienes roles/apigee.admin en tus roles, añade el rol Administrador de organización de Apigee a tu cuenta de usuario. Usa el siguiente comando para añadir el rol a tu cuenta de usuario:
Para habilitar el acceso del sincronizador, sigue estos pasos:
Obtén la dirección de correo de la cuenta de servicio a la que vas a conceder acceso de sincronizador.
En los entornos que no son de producción (como se sugiere en este tutorial), debería ser
apigee-non-prod. En los entornos de producción, debe ser
apigee-synchronizer. Usa el siguiente comando:
${ORG_NAME}: el nombre de tu organización híbrida.
apigee-non-prod${ORG_NAME}.iam.gserviceaccount.com o apigee-synchronizer${ORG_NAME}.iam.gserviceaccount.com: la dirección de correo de la cuenta de servicio.
Para verificar que se ha configurado la cuenta de servicio, usa el siguiente comando para llamar a la API y obtener una lista de cuentas de servicio:
Ahora, los planos de gestión y de tiempo de ejecución de Apigee hybrid pueden comunicarse. A continuación, vamos a aplicar la configuración al entorno de ejecución híbrido y a completar la instalación de Apigee hybrid.
[[["Es fácil de entender","easyToUnderstand","thumb-up"],["Me ofreció una solución al problema","solvedMyProblem","thumb-up"],["Otro","otherUp","thumb-up"]],[["Es difícil de entender","hardToUnderstand","thumb-down"],["La información o el código de muestra no son correctos","incorrectInformationOrSampleCode","thumb-down"],["Me faltan las muestras o la información que necesito","missingTheInformationSamplesINeed","thumb-down"],["Problema de traducción","translationIssue","thumb-down"],["Otro","otherDown","thumb-down"]],["Última actualización: 2025-09-03 (UTC)."],[[["\u003cp\u003eThis documentation is for Apigee hybrid version 1.8, which is end-of-life, and users should upgrade to a newer version.\u003c/p\u003e\n"],["\u003cp\u003eTo make Apigee API calls, you must acquire an authorization token, and your Google Cloud user account must have the \u003ccode\u003eroles/apigee.admin\u003c/code\u003e role, which can be verified and added using gcloud commands.\u003c/p\u003e\n"],["\u003cp\u003eTo enable synchronizer access, you will need to obtain the email address for the service account, which is either \u003ccode\u003eapigee-non-prod\u003c/code\u003e for non-production environments or \u003ccode\u003eapigee-synchronizer\u003c/code\u003e for production, and then use the \u003ccode\u003esetSyncAuthorization\u003c/code\u003e API.\u003c/p\u003e\n"],["\u003cp\u003eAfter setting synchronizer access, use the \u003ccode\u003egetSyncAuthorization\u003c/code\u003e API to verify the service account was set, which will display a list of service accounts.\u003c/p\u003e\n"],["\u003cp\u003eThe ORG_NAME variable used in the API call is typically the same as my_project_id in the service account mapping results, although this may differ in multi-org cluster situations.\u003c/p\u003e\n"]]],[],null,["# Step 7: Enable Synchronizer access\n\n| You are currently viewing version 1.8 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\nGet an authorization token\n--------------------------\n\n\nTo make the Apigee API calls described later in this topic, you need to get an authorization\ntoken that has the Apigee Organization Admin role.\n\n1. If you are not the owner of the Google Cloud project that is associated with your Apigee hybrid organization, be sure that your Google Cloud user account has the **roles/apigee.admin** (Apigee Organization Admin) role. You can check the roles assigned to you with this command: \n\n ```\n gcloud projects get-iam-policy ${PROJECT_ID} \\\n --flatten=\"bindings[].members\" \\\n --format='table(bindings.role)' \\\n --filter=\"bindings.members:your_account_email\"\n ```\n\n\n For example: \n\n ```transact-sql\n gcloud projects get-iam-policy my-project \\\n --flatten=\"bindings[].members\" \\\n --format='table(bindings.role)' \\\n --filter=\"bindings.members:myusername@example.com\"\n ```\n\n\n The output should look something like: \n\n ```text\n ROLE\n roles/apigee.admin\n roles/compute.admin\n roles/container.admin\n roles/gkehub.admin\n roles/iam.serviceAccountAdmin\n roles/iam.serviceAccountKeyAdmin\n roles/meshconfig.admin\n roles/owner\n roles/resourcemanager.projectIamAdmin\n roles/servicemanagement.admin\n roles/serviceusage.serviceUsageAdmin\n ```\n2. If you do not have `roles/apigee.admin` in your roles, add the **Apigee\n Organization Admin** role to your user account. Use the following command to add the role to your user account: \n\n ```\n gcloud projects add-iam-policy-binding ${PROJECT_ID} \\\n --member user:your_account_email \\\n --role roles/apigee.admin\n ```\n\n\n For example: \n\n ```\n gcloud projects add-iam-policy-binding my-project \\\n --member user:myusername@example.com \\\n --role roles/apigee.admin\n ```\n3. On the command line, get your `gcloud` authentication\n credentials using the following command:\n\n ### Linux / MacOS\n\n ```\n export TOKEN=$(gcloud auth print-access-token)\n ```\n\n To check that your token was populated, use `echo`, as the\n following example shows: \n\n ```\n echo $TOKEN\n ```\n\n This should display your token as an encoded string.\n\n ### Windows\n\n ```\n for /f \"tokens=*\" %a in ('gcloud auth print-access-token') do set TOKEN=%a\n ```\n\n To check that your token was populated, use `echo`, as the\n following example shows: \n\n ```\n echo %TOKEN%\n ```\n\n This should display your token as an encoded string.\n\nEnable synchronizer access\n--------------------------\n\n\nTo enable synchronizer access:\n\n1. Get the email address for the service account to which you are granting synchronizer access. For non-production environments (as suggested in this tutorial) it should be `apigee-non-prod`. For production environments, it should be `apigee-synchronizer`. Use the following command:\n\n ### Non-prod\n\n ```\n gcloud iam service-accounts list --filter \"apigee-non-prod\"\n ```\n\n\n If it matches the pattern `apigee-non-prod`**@${ORG_NAME}**`.iam.gserviceaccount.com`, you\n can use that pattern in the next step.\n\n ### Prod\n\n ```\n gcloud iam service-accounts list --filter \"apigee-synchronizer\"\n ```\n\n\n If it matches the pattern `apigee-synchronizer`**@${ORG_NAME}**`.iam.gserviceaccount.com`, you\n can use that pattern in the next step.\n2. Call the [setSyncAuthorization](/apigee/docs/reference/apis/apigee/rest/v1/organizations/setSyncAuthorization) API to enable the required permissions for Synchronizer using the following command:\n\n ### Non-prod\n\n ```\n curl -X POST -H \"Authorization: Bearer ${TOKEN}\" \\\n -H \"Content-Type:application/json\" \\\n \"https://apigee.googleapis.com/v1/organizations/${ORG_NAME}:setSyncAuthorization\" \\\n -d '{\"identities\":[\"'\"serviceAccount:apigee-non-prod@${ORG_NAME}.iam.gserviceaccount.com\"'\"]}'\n ```\n\n ### Prod\n\n ```\n curl -X POST -H \"Authorization: Bearer ${TOKEN}\" \\\n -H \"Content-Type:application/json\" \\\n \"https://apigee.googleapis.com/v1/organizations/${ORG_NAME}:setSyncAuthorization\" \\\n -d '{\"identities\":[\"'\"serviceAccount:apigee-synchronizer@${ORG_NAME}.iam.gserviceaccount.com\"'\"]}'\n ```\n\n\n Where:\n - **`${ORG_NAME}`**: The name of your hybrid organization.\n - **`apigee-non-prod${ORG_NAME}.iam.gserviceaccount.com`** or \n **`apigee-synchronizer${ORG_NAME}.iam.gserviceaccount.com`**: The email address of the service account.\n\n | **Tip:** Some shells may return an error like `bad substitution`. In this case, replace \u003cvar translate=\"no\"\u003e$ORG_NAME\u003c/var\u003e with the name of your organization and replace the `\"'\"` with `\"` as follows:\n |\n | ### Non-prod\n |\n | ```\n | curl -X POST -H \"Authorization: Bearer $TOKEN\" \\\n | -H \"Content-Type:application/json\" \\\n | \"https://apigee.googleapis.com/v1/organizations/YOUR_ORG_NAME:setSyncAuthorization\" \\\n | -d '{\"identities\":[\"serviceAccount:apigee-non-prod@YOUR_ORG_NAME.iam.gserviceaccount.com\"]}'\n | ```\n |\n | ### Prod\n |\n | ```\n | curl -X POST -H \"Authorization: Bearer $TOKEN\" \\\n | -H \"Content-Type:application/json\" \\\n | \"https://apigee.googleapis.com/v1/organizations/YOUR_ORG_NAME:setSyncAuthorization\" \\\n | -d '{\"identities\":[\"serviceAccount:apigee-synchronizer@YOUR_ORG_NAME.iam.gserviceaccount.com\"]}'\n | ```\n3. To verify that the service account was set, use the following command to call the API to get a list of service accounts: \n\n ```\n curl -X GET -H \"Authorization: Bearer $TOKEN\" \\\n -H \"Content-Type:application/json\" \\\n \"https://apigee.googleapis.com/v1/organizations/${ORG_NAME}:getSyncAuthorization\"\n ```\n\n\n The output looks similar to the following:\n\n ### Non-prod\n\n ```transact-sql\n {\n \"identities\":[\n \"serviceAccount:apigee-non-prod@\u003cvar translate=\"no\"\u003emy_project_id\u003c/var\u003e.iam.gserviceaccount.com\"\n ],\n \"etag\":\"BwWJgyS8I4w=\"\n }\n ```\n\n ### Prod\n\n ```transact-sql\n {\n \"identities\":[\n \"serviceAccount:apigee-synchronizer@\u003cvar translate=\"no\"\u003emy_project_id\u003c/var\u003e.iam.gserviceaccount.com\"\n ],\n \"etag\":\"BwWJgyS8I4w=\"\n }\n ```\n | **Note:** The call to the Apigee API uses \u003cvar translate=\"no\"\u003e${ORG_NAME}\u003c/var\u003e, and the results from the IAM service account mappings use \u003cvar translate=\"no\"\u003emy_project_id\u003c/var\u003e. In most cases, the values are the same. One uncommon exception is when using a [multi-org cluster](/apigee/docs/hybrid/latest/multi-org), where there would be more than one org name, and the service accounts could be different per org.\n\nYou have now made it possible for your Apigee hybrid runtime and management planes to\ncommunicate. Next, let's apply your configuration to the hybrid runtime and complete your\ninstallation of Apigee hybrid.\n[1](/apigee/docs/hybrid/v1.8/install-create-cluster) [2](/apigee/docs/hybrid/v1.8/install-cert-manager) [3](/apigee/docs/hybrid/v1.8/install-apigeectl) [4](/apigee/docs/hybrid/v1.8/install-service-accounts) [5](/apigee/docs/hybrid/v1.8/install-create-tls-certificates) [6](/apigee/docs/hybrid/v1.8/install-configure-cluster) [7](/apigee/docs/hybrid/v1.8/install-enable-synchronizer-access) [(NEXT) Step 8: Install the hybrid runtime](/apigee/docs/hybrid/v1.8/install-hybrid-runtime) [9](/apigee/docs/hybrid/v1.8/install-expose-apigee-ingress) [10](/apigee/docs/hybrid/v1.8/install-deploy-proxy)\n\n\u003cbr /\u003e"]]
