[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[[["\u003cp\u003eApigee hybrid documentation version 1.8 is end of life and users should upgrade to a newer version.\u003c/p\u003e\n"],["\u003cp\u003eInstalling and managing Apigee hybrid requires specific permissions and roles, which can be distributed among different members of an organization.\u003c/p\u003e\n"],["\u003cp\u003eNon-cluster-owner users installing hybrid runtime components need CRUD permissions on resources such as ClusterRole, ClusterRoleBinding, Webhooks, and more.\u003c/p\u003e\n"],["\u003cp\u003eIAM roles like Service Account Creator and Project IAM Admin are necessary to create service accounts and grant them project access.\u003c/p\u003e\n"],["\u003cp\u003eSpecific IAM roles are also needed to grant synchronizer access to the project and configure workload identity.\u003c/p\u003e\n"]]],[],null,["# Permissions and roles for installing Apigee hybrid\n\n| You are currently viewing version 1.8 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\n\nThe procedures to install and manage Apigee hybrid require the following permissions and roles.\nIndividual tasks can be performed by different members of your organization who have the required\npermissions and roles.\n\nCluster permissions\n-------------------\n\n\nEach supported platform has its own permission requirements for creating a cluster. As cluster\nowner, you can proceed to install the Apigee-specific components (including cert-manager and the\nApigee runtime) into the cluster. However, if you want to delegate to another user the\ninstallation of the runtime components into the cluster, you can manage the necessary permissions\nthrough Kubernetes\n[authn-authz](https://kubernetes.io/docs/reference/access-authn-authz/rbac/).\n\n\nTo install the hybrid runtime components into the cluster, a non-cluster-owner user should\nhave CRUD permission on these resources:\n\n- [ClusterRole](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#role-and-clusterrole)\n- [ClusterRoleBinding](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#rolebinding-and-clusterrolebinding)\n- Webhooks ([ValidatingWebhookConfiguration](https://kubernetes.io/docs/reference/kubernetes-api/extend-resources/validating-webhook-configuration-v1/) and [MutatingWebhookConfiguration](https://kubernetes.io/docs/reference/kubernetes-api/extend-resources/mutating-webhook-configuration-v1/))\n- [PriorityClass](https://kubernetes.io/docs/reference/kubernetes-api/workload-resources/priority-class-v1/)\n- [ClusterIssuer](https://cert-manager.io/docs/concepts/issuer/)\n- [CustomerResourceDefinitions](https://kubernetes.io/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/)\n- [StorageClass](https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/storage-class-v1/) (Optional, if the default StorageClass is not used. For information on changing the default and creating a custom storage class, see [StorageClass configuration](./cassandra-config).)\n\nIAM Roles\n---------\n\n\nYou need to have the following IAM roles assigned to your user account in order to perform\nthese steps. If your account does not have these roles, have a user with the roles perform the\nsteps. For more information on IAM roles, see\n[IAM basic and predefined roles reference](/iam/docs/understanding-roles).\n\n\nTo create service accounts and grant them access to your project:\n\n- [Create Service Accounts](/iam/docs/understanding-roles#iam.serviceAccountCreator) (`roles/iam.serviceAccountCreator`)\n- [Project IAM Admin](/iam/docs/understanding-roles#resourcemanager.projectIamAdmin) (`roles/resourcemanager.projectIamAdmin`)\n\n\nTo grant synchronizer access to your project:\n\n- [Apigee Organization Admin](/iam/docs/understanding-roles#apigee.admin) (`roles/apigee.admin`)\n\n\nTo configure workload identity for installations on GKE (optional):\n\n- [Kubernetes Engine Admin](/iam/docs/understanding-roles#container.admin) (`roles/container.admin`)\n- [Service Account Admin](/iam/docs/understanding-roles#iam.serviceAccountAdmin) (`roles/iam.serviceAccountAdmin`)"]]
