
Before you begin
- Labs create a Google Cloud project and resources for a fixed time
- Labs have a time limit and no pause feature. If you end the lab, you'll have to restart from the beginning.
- On the top left of your screen, click Start lab to begin
Create a prod environment
/ 25
Create a prod-group environment group
/ 25
Attach the prod environment to the instance
/ 25
Create an API proxy
/ 25
In this lab, you learn how to add a new environment and environment group to an Apigee X org.
An environment is a runtime execution context for API proxies. An API proxy must be deployed to an environment before the API it exposes is accessible over the network.
An environment group is a logical grouping of environments. Hostnames are defined on an environment group, and Apigee routes requests to the environments within a group based on the hostname. The request will then be handled by an API proxy that is deployed to one of the environments in the environment group and also has a matching basepath.
The instructions in this lab are also appropriate for adding environments and environment groups to paid orgs.
In this lab, you learn how to perform the following tasks:
Read these instructions. Labs are timed and you cannot pause them. The timer, which starts when you click Start Lab, shows how long Google Cloud resources are made available to you.
This hands-on lab lets you do the lab activities in a real cloud environment, not in a simulation or demo environment. It does so by giving you new, temporary credentials you use to sign in and access Google Cloud for the duration of the lab.
To complete this lab, you need:
Click the Start Lab button. If you need to pay for the lab, a dialog opens for you to select your payment method. On the left is the Lab Details pane with the following:
Click Open Google Cloud console (or right-click and select Open Link in Incognito Window if you are running the Chrome browser).
The lab spins up resources, and then opens another tab that shows the Sign in page.
Tip: Arrange the tabs in separate windows, side-by-side.
If necessary, copy the Username below and paste it into the Sign in dialog.
You can also find the Username in the Lab Details pane.
Click Next.
Copy the Password below and paste it into the Welcome dialog.
You can also find the Password in the Lab Details pane.
Click Next.
Click through the subsequent pages:
After a few moments, the Google Cloud console opens in this tab.
Cloud Shell is a virtual machine that is loaded with development tools. It offers a persistent 5GB home directory and runs on the Google Cloud. Cloud Shell provides command-line access to your Google Cloud resources.
Click Activate Cloud Shell at the top of the Google Cloud console.
Click through the following windows:
When you are connected, you are already authenticated, and the project is set to your Project_ID,
gcloud
is the command-line tool for Google Cloud. It comes pre-installed on Cloud Shell and supports tab-completion.
Output:
Output:
gcloud
, in Google Cloud, refer to the gcloud CLI overview guide.
To open the Apigee console:
Apigee
, and then click Apigee API Management in the search results.The Apigee console opens, and the landing page shows quick links to commonly used locations.
Apigee is now pinned to the Navigation menu.
In this task, you explore environments and environment groups using the Apigee console.
An evaluation org for Apigee X initially contains a single environment named eval and a single environment group named eval-group. The eval environment is a member of the eval-group environment group.
The eval environment has been configured as a member of the eval-group environment group.
The eval environment is marked "Ready for deployment," indicating that API proxies may be deployed to the environment.
A single hostname (eval.example.com) is currently listed for the eval-group environment group, but more than one hostname may be used.
The eval-group environment group currently contains the eval environment as its only member, but more than one environment may be in an environment group.
In this task, you create a new environment.
You should get a message that the environment has been defined. The new prod environment is marked Pending Provisioning.
Shortly after, you should see the message that the environment is ready for use, and the environment will no longer be marked Pending Provisioning.
Click Check my progress to verify the objective.
In this task, you create a new environment group.
Click Check my progress to verify the objective.
In this task, you wait for the Apigee evaluation org provisioning to complete.
The Apigee organization provisioning takes quite a while to complete. The org provisioning progress can be monitored by using the Apigee API.
It takes a few moments to provision and connect to Cloud Shell. When you are connected, you are already authenticated, and the project is set to your PROJECT_ID.
The variable GOOGLE_CLOUD_PROJECT should contain the name of your project, which is the same as your Apigee organization name.
This series of commands uses the Apigee API to determine when the runtime instance has been created, and then waits for the eval environment to be attached to the instance.
When the text ***ORG IS READY TO USE***
is printed, proxies deployed to the eval environment can accept traffic.
Access to Apigee is granted by using users and roles. A user represents an authenticated account that can access an Apigee organization and the entities within the organization, such as environments and API proxies. The capabilities that you grant to the user depend on the type of *role *assigned to them.
To add a new user to your Apigee organization, you grant access to the user's account, first in the Cloud project, and then optionally in the Apigee UI. Permissions granted on a resource in the Google Cloud resource hierarchy are inherited by resources contained within the resource.
If an Apigee role is assigned to a user on the Cloud project, then the user can access all Apigee resources within the organization (including all environments) in that role. Within the Apigee UI, an Apigee role can also be assigned to a user for a specific environment. This permission is in addition to the role set at the project level.
To adhere to the principle of least privilege, the minimum permissions for a given user should be specified at the project level, with expanded permissions given at the environment level.
This image shows how inheritance works for this access model:
This table summarizes the pre-defined Apigee roles.
Apigee role | Description |
---|---|
Apigee Org Admin | Full access to all Apigee resources in an Apigee organization. |
Apigee Read Only Admin | Read-only access to all Apigee resources in an Apigee organization. |
Apigee Analytics Editor | Creates and analyzes reports on API proxy traffic for an Apigee organization. Can edit queries and reports. |
Apigee Analytics Viewer | User of Apigee Analytics. Cannot edit queries or reports. |
Apigee API Admin | A developer who creates and tests API proxies. |
Apigee Environment Admin | Deploys and undeploys API proxies in environments. |
Apigee Developer Admin | Manages developer access to APIs. |
Learn more about API permissions for each Apigee role from the Apigee roles guide.
In this task, you add the prod environment to the runtime instance, allowing proxies deployed to prod to be run.
***ORG IS READY TO USE***
.If you get an error message, look at the details of the message:
When you have successfully begun the process of attaching the prod environment to the runtime, you should see a return message with a state of IN_PROGRESS looking similar to this:
This series of commands uses the Apigee API to determine when the prod environment is attached to the instance and proxies deployed to prod are ready to take traffic.
When the text ***prod ENVIRONMENT ATTACHED***
is printed, proxies deployed to the prod environment can accept traffic.
Leave the command running and continue with the next task.
Click Check my progress to verify the objective.
In this task, you create an API proxy that uses flow variables to return the hostname and environment for the API call.
OpenAPI Spec template
.
Specify the following properties:
Property | Value |
---|---|
Proxy name | test-env |
Base path | /test-env |
Click Next.
Leave the other setting as default, and click Create.
Your API proxy will be generated. You will deploy your proxy later.
This tab is used to edit the API proxy. The Proxy Endpoint PreFlow is selected.
In the Navigate menu, click Proxy endpoints > Preflow.
In Flow pane, click + icon beside PreFlow in Response section.
You will add a policy step to the PreFlow response. A policy implements a specific, limited management function.
Mediation
section, then specify AM-SetResponse as the Name and Display Name, and then click Add.This policy creates a response returning the environment name and hostname. The proxy flow variable environment.name contains the environment of the deployed proxy that has received the traffic, and the variable request.header.Host contains the Host header, which indicates the hostname used for the API call.
Click Save.
Click Deploy, then for Environment select eval then click Deploy and Confirm.
This deploys the proxy to the eval environment.
This deploys the proxy to the prod environment.
When the proxy is deployed to both environments, the Deployments section of the Overview tab should look like this:
Click Check my progress to verify the objective.
In this task, you make calls to the test and prod environments.
A virtual machine named apigeex-test-vm was automatically created. Use this virtual machine to call the Apigee runtime using a private IP address.
Your logged in identity is the owner of the project, so SSH to this machine is allowed.
Your Cloud Shell session is now running inside the VM.
The PROD_ENVGROUP_HOSTNAME was retrieved from the prod-group environment group you created in a previous task.
The --resolve setting forces commands sent to the environment group hostname to resolve to the internal load balancer IP address instead of using DNS to resolve the IP address. The -k option skips verification of the TLS certificate of the internal load balancer, since the internal load balancer does not host a TLS certificate with the hostnames you are using.
Your curl
command should return the response generated by the test-env proxy, which should look similar to this:
This time, the environment and hostname should both return prod instead of eval.
In this lab, you created a new environment and environment group for your org, and attached the environment to your runtime instance. You then created and deployed an API proxy. Finally, you called the proxy using the eval and prod hostnames and the API proxy was able to detect the environment that was being called.
...helps you make the most of Google Cloud technologies. Our classes include technical skills and best practices to help you get up to speed quickly and continue your learning journey. We offer fundamental to advanced level training, with on-demand, live, and virtual options to suit your busy schedule. Certifications help you validate and prove your skill and expertise in Google Cloud technologies.
Manual Last Updated January 29, 2025
Lab Last Tested January 29, 2025
Copyright 2025 Google LLC All rights reserved. Google and the Google logo are trademarks of Google LLC. All other company and product names may be trademarks of the respective companies with which they are associated.