Announcement

hybrid 1.16.0-hotfix.1

On February 6, 2026 we released Apigee hybrid 1.16.0-hotfix.1.

Apply this hotfix with the following steps:

1. In your overrides file, update the image.url and image.tag properties of ao and mart to version 1.16.0-hotfix.1:

   ao:
     image:
       url: "gcr.io/apigee-release/hybrid/apigee-operators"
       tag: "1.16.0-hotfix.1"
   
   mart:
     image:
       url: "gcr.io/apigee-release/hybrid/apigee-mart-server"
       tag: "1.16.0-hotfix.1"
   

2. Install the hotfix release for Apigee operators, beginning with a dry run:

   helm upgrade operator apigee-operator/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     -f overrides.yaml \
     --dry-run=server
   

3. If the dry run is successful, install the hotfix release for Apigee operators:

   helm upgrade operator apigee-operator/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     -f overrides.yaml
   

4. Install the hotfix release for your organization, beginning with a dry run:

   helm upgrade $ORG_NAME apigee-org/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     -f overrides.yaml \
     --dry-run=server
   

5. If the dry run is successful, install the hotfix release for your organization:

   helm upgrade $ORG_NAME apigee-org/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     -f overrides.yaml
   

6. Verify the organization chart by checking the state:

   kubectl -n APIGEE_NAMESPACE get apigeeorg
   

7. Install the hotfix release for your environment, beginning with a dry run:

   helm upgrade ENV_RELEASE_NAME apigee-env/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     --set env=$ENV_NAME \
     -f overrides.yaml \
     --dry-run=server
   

8. If the dry run is successful, install the hotfix release for your environment:

   helm upgrade ENV_RELEASE_NAME apigee-env/ \
     --install \
     --namespace APIGEE_NAMESPACE \
     --atomic \
     --set env=$ENV_NAME \
     -f overrides.yaml
   

9. Verify the environment chart by checking the state:

   kubectl -n APIGEE_NAMESPACE get apigeeenv
   

Fixed

Fixed in this release

Change

UDCA component removed

In Apigee hybrid v1.16, the Unified Data Collection Agent (UDCA) component has been removed. The responsibilities of sending analytics, trace, and deployment status data to the Apigee control plane are now handled using a Google Cloud Pub/Sub based data pipeline. Using the Pub/Sub based data pipeline has been the default data collection mechanism since Apigee hybrid v1.14.0.

Feature

apigee-guardrails service account

In v1.16.0, Apigee Hybrid introduces an apigee-guardrails Google IAM service account. This is used by the apigee-operator chart during initial installation to check that all needed APIs are enabled in your project.

See:

• Diagnosing issues with guardrails
• About service accounts: apigee-guardrails
• create-service-account
• Upgrading to Apigee hybrid to version 1.16
• Installation Part 2: Step 4: Create service accounts
• Installation Part 2: Step 5: Set up service account authentication

Change

Support for cert-manager release 1.18 and 1.19

Apigee hybrid v1.16 supports cert-manager release 1.18 and 1.19.

Fixed

Fixed in this release

Announcement

hybrid v1.16.0

On December 19, 2025 we released an updated version of the Apigee hybrid software, 1.16.0.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.16.
• For information on new installations, see The big picture.

Security

Fixed in this release

Feature

Seccomp Profiles

Apigee Hybrid now offers the capability to apply Seccomp Profiles to your runtime components, significantly enhancing the security posture of your deployment.

This feature allows Apigee administrators and security teams to restrict the system calls (syscalls) a containerized process can make to the host's kernel. By limiting a container to only the necessary syscalls, you can:

• Enhance Security: Mitigate the risk of container breakouts and privilege escalation.
• Enforce Least Privilege: Ensure components only have access to the exact system calls required for their operation.
• Meet Compliance: Provide a critical control for meeting stringent security compliance requirements.

Seccomp profiles are not enabled by default. To enable the feature, see Configure Seccomp profiles for pod security.

Security

Fixed since last minor release

Fixed

Fixed since last minor release

Feature

Recurring, top-up, and setup fees for Apigee hybrid monetization

Apigee hybrid now supports recurring, top-up, and setup fees for monetization. For information see Enabling monetization for Apigee hybrid.

Announcement

hybrid v1.15.1

On October 10, 2025 we released an updated version of the Apigee hybrid software, 1.15.1.

• For information on upgrading, see Upgrading Apigee hybrid to version 1.15.
• For information on new installations, see The big picture.

Feature

Apigee policies for LLM/GenAI workloads

Apigee hybrid now supports the following Apigee policies with support for LLM/GenAI workloads.

• SemanticCacheLookup policy
• SemanticCachePopulate policy
• SanitizeUserPrompt
• SanitizeModelResponse

The Apigee semantic caching policies enable intelligent response reuse based on semantic similarity. Using these policies in your Apigee API proxies can minimize redundant backend API calls, reduce latency, and lower operational costs. With this release, the semantic caching policies support URL templating, enabling the use of variables for AI model endpoint values.

The Model Armor policies protect your AI applications by sanitizing user prompts to and responses from large language models (LLMs). Using these policies in your Apigee API proxies can mitigate the risks associated with LLM usage by leveraging Model Armor to detect prompt injection, prevent jailbreak attacks, apply responsible AI filters, filter malicious URLs, and protect sensitive data.

For more information on using these policies in your Apigee API proxies, see:

• Get started with semantic caching policies
• Get started with Apigee Model Armor policies

Fixed

Security

Change

Documentation change

The following documents have been changed or introduced to align the Apigee hybrid installation guides with the supported methods for service account authentication:

• Service account authentication methods in Apigee hybrid - A new overview topic for service account authentication.
• Storing service account keys in Kubernetes secrets - A new topic.
• Step 4: Create service accounts - Rewritten to accommodate all supported methods of service account authentication.
• Step 5: Set up service account authentication - A new topic on configuring authentication after creating service accounts.
• Step 7: Create the overrides and Step 11: Install Apigee hybrid Using Helm - Topics revised to provide templates, examples, and procedures for each supported type of service account authentication.
• Step 11(Optional): Configure Workload Identity - Topic removed. The procedures are included in Step 11: Install Apigee hybrid Using Helm: WIF for GKE

Announcement

hybrid v1.14.3

On October 7, 2025 we released an enhancement to Apigee hybrid version 1.14.3, recurring, top-up, and setup fees for Apigee hybrid monetization.

• For complete information on the contents of the v1.14.3 release, see Apigee hybrid v1.14.3 release notes.

Feature

Recurring, top-up, and setup fees for Apigee hybrid monetization

Apigee hybrid now supports recurring, top-up, and setup fees for monetization. For information see Enabling monetization for Apigee hybrid.

Fixed

Announcement

hybrid v1.14.3

On September 29, 2025 we released an updated version of the Apigee hybrid software, 1.14.3.

• For information on upgrading, see Upgrading Apigee hybrid to version 1.14.
• For information on new installations, see The big picture.

Fixed

Security

Announcement

Apigee Operator for Kubernetes for Apigee Hybrid (Preview)

On September 24, 2025 we released the Apigee Operator for Kubernetes for Apigee Hybrid 1.15.0 and newer.

The Apigee Operator for Kubernetes allows you to perform API management tasks, such as defining API products and operations, using Kubernetes tools. This preview release allows you to integrate this capability with your Apigee hybrid (v1.15.0 or newer) installation.

For more information, see:

• Apigee Operator for Kubernetes overview
• Install the Apigee Operator for Kubernetes for Apigee hybrid

Announcement

hybrid v1.13.4

On July 9, 2025 we released an updated version of the Apigee hybrid software, 1.13.4.

• For information on upgrading, see Upgrading Apigee hybrid to version 1.13.
• For information on new installations, see The big picture.

Fixed

Security

Announcement

hybrid v1.15.0

On June 4, 2025 we released an updated version of the Apigee hybrid software, 1.15.0.

• For information on upgrading, see Upgrading Apigee hybrid to version 1.15.
• For information on new installations, see The big picture.

Feature

Large message payload support in Apigee hybrid

Apigee now supports message payloads up to 30MB. You configure support for large message payloads in Apigee hybrid for individual environments or for your whole installation. See Configure large message payload support in Apigee hybrid.

Fixed

Security

Fixed in this release

Security

Fixed since last minor release

Announcement

On May 29, 2025 we announced the shutdown schedule for the Apigee Classic UI.

Deprecated

The Apigee Classic UI will be shutdown as of August 29, 2025.

This is the final phase of moving Apigee to the Google Cloud console. Apigee in the Google Cloud console gives you the ability to manage all of your Apigee functionality in one place.

To prepare for the shutdown of the Apigee Classic UI, familiarize yourself with the new Apigee UI in Google Cloud console by reviewing UI overview.

See Apigee Classic UI shutdown for details on shutdown dates and exception request.

Announcement

hybrid 1.14.2-hotfix.1

On May 16, 2025 we released an updated version of the Apigee hybrid software, 1.14.2-hotfix.1.

Apply this hotfix with the following steps:

1. Download the apigee-org and apigee-env charts with the 1.14.2-hotfix.1 version tag:

   export CHART_REPO=oci://us-docker.pkg.dev/apigee-release/apigee-hybrid-helm-charts
   export CHART_VERSION=1.14.2-hotfix.1
   helm pull $CHART_REPO/apigee-env --version $CHART_VERSION --untar
   helm pull $CHART_REPO/apigee-org --version $CHART_VERSION --untar
   

2. Optional: Perform this step if you need to allow use of the allOf combinator along with setting additionalProperties: true in your OAS spec. See fixed bug 393615439.

   Add the following stanza to your overrides.yaml:

   runtime:
     cwcAppend:
       conf_message-processor-communication_oas.disable.resolve.combinator: true
   

3. Install the hotfix release:

   1. Update the apigee-env chart with the helm upgrade command and your current overrides file for each environment in your Apigee org:

      Dry run:

      helm upgrade ENV_RELEASE_NAME apigee-env/ \
      --namespace APIGEE_NAMESPACE \
      --set env=ENV_NAME \
      --atomic \
      -f OVERRIDES_FILE \
      --dry-run=server
      

      • ENV_RELEASE_NAME is a name used to keep track of installation and upgrades of the apigee-env chart. This name must be unique from the other Helm release names in your installation. Usually this is the same as ENV_NAME. However, if your environment has the same name as your environment group, you must use different release names for the environment and environment group, for example dev-env-release and dev-envgroup-release. For more information on releases in Helm, see Three big concepts in the Helm documentation.
      • APIGEE_NAMESPACE is your installation's namespace. The default is apigee.
      • ENV_NAME is the name of the environment you are upgrading.
      • OVERRIDES_FILE is your edited overrides file.

      Install the changes:

      helm upgrade ENV_RELEASE_NAME apigee-env/ \
      --namespace APIGEE_NAMESPACE \
      --set env=ENV_NAME \
      --atomic \
      -f OVERRIDES_FILE

   2. Update the apigee-org chart:

      Dry run:

      helm upgrade ORG_NAME apigee-org/ \
      --namespace APIGEE_NAMESPACE \
      -f OVERRIDES_FILE \
      --dry-run=server

      Install the changes:

      helm upgrade ORG_NAME apigee-org/ \
      --namespace APIGEE_NAMESPACE \
      -f OVERRIDES_FILE

4. Verify the installation:

   Ensure runtime and udca pods are up and running by checking their state:

   kubectl -n APIGEE_NAMESPACE get pods -l app=apigee-runtime

   kubectl -n APIGEE_NAMESPACE get pods -l app=apigee-udca

• For information on upgrading, see Upgrading Apigee hybrid to version 1.14.
• For information on new installations, see The big picture.

Fixed

conf_message-processor-communication_oas.disable.resolve.combinator = true

Security

Announcement

hybrid v1.14.2

On May 2, 2025 we released an updated version of the Apigee hybrid software, 1.14.2.

• For information on upgrading, see Upgrading Apigee hybrid to version 1.14.
• For information on new installations, see The big picture.

Feature

Large message payload support in Apigee hybrid

Apigee now supports message payloads up to 30MB. For information see:

• Message payload size
• runtime.resources.limits.memory in the Configuration property reference.
• runtime.resources.requests.memory in the Configuration property reference.

Change

Starting with v1.14.2, third-party container images will be labeled with a version tag that matches the Apigee hybrid image tag. This affects the image tags returned by the apigee-pull-push command line tool. For more information, see:

• Use a private image repository with Apigee hybrid
• apigee-pull-push
• hub

Fixed

Security

Announcement

On April 14, 2025 we released an updated version of Apigee.

Feature

Announcing data collectors data residency (DRZ) compliance for Apigee and Apigee hybrid.

Data collectors can be used with data residency for Subscription and Pay-as-you-go organizations and hybrid versions 1.14.0 and later.

See Data residency compatibility for information.

Announcement

hybrid 1.11.2-hotfix.3

On April 14, 2025 we released an updated version of the Apigee hybrid software, 1.11.2-hotfix.3.

Apply this hotfix with the following steps:

1. In your overrides file, update the image.url and image.tag properties of ao and runtime:

   runtime:
     image:
       url: "gcr.io/apigee-release/hybrid/apigee-runtime"
       tag: "1.11.2-hotfix.3"
   

2. Install the hotfix release:

   • For Helm-managed releases, update the apigee-env chart with the helm upgrade command and your current overrides files:

     For each environment in your Apigee org:

     helm upgrade ENV_RELEASE_NAME apigee-env/ \
       --namespace APIGEE_NAMESPACE \
       --set env=ENV_NAME \
       --atomic \
       -f OVERRIDES_FILE
     

     • ENV_RELEASE_NAME is a name used to keep track of installation and upgrades of the apigee-env chart. This name must be unique from the other Helm release names in your installation. Usually this is the same as ENV_NAME. However, if your environment has the same name as your environment group, you must use different release names for the environment and environment group, for example dev-env-release and dev-envgroup-release. For more information on releases in Helm, see Three big concepts in the Helm documentation.
     • APIGEE_NAMESPACE is your installation's namespace. The default is apigee.
     • ENV_NAME is the name of the environment you are upgrading.
     • OVERRIDES_FILE is your edited overrides file.

   • For apigeectl-managed releases:

     1. Install the hotfix release with apigeectl init using your updated overrides file:

        ${APIGEECTL_HOME}/apigeectl init -f OVERRIDES_FILE --dry-run=client
        

        Followed by:

        ${APIGEECTL_HOME}/apigeectl init -f OVERRIDES_FILE
        

     2. Apply the hotfix release with apigeectl apply:

        ${APIGEECTL_HOME}/apigeectl apply -f OVERRIDES_FILE --all-envs --dry-run=client
        

        Followed by:

        ${APIGEECTL_HOME}/apigeectl apply -f OVERRIDES_FILE --all-envs
        

• For information on upgrading, see Upgrading Apigee hybrid to version 1.11.
• For information on new installations, see The big picture.
• For recommended actions after upgrading, see Validate policies after upgrade to 1.12-hotfix.3.

Security

Stricter class instantiation checks included in this release.

JavaCallout policy now includes additional security during Java class instantiation. The enhanced security measure prevents the deployment of policies that directly or indirectly attempt actions that require permissions that are not allowed.

In most cases, existing policies will continue to function as expected without any issues. However, there is a possibility that policies relying on third-party libraries, or those with custom code that indirectly triggers operations requiring elevated permissions, could be affected.

To test your installation, follow the procedure in Validate policies after upgrade to 1.11.2-hotfix.3 to validate policy behavior.

Announcement

On March 27, 2025, we released an updated version of Apigee.

Feature

Availability of client IP resolution functionality with Apigee hybrid.

Client IP resolution functonality is now available with Apigee hybrid versions 1.14.0 and later.

See Client IP resolution for information.

Announcement

On March 25, 2025 we released an updated version of Advanced API Security.

Change

New Advanced API Security support when using data residency (DRZ) with Apigee hybrid

Advanced API Security is now available for Apigee hybrid orgs using DRZ, for hybrid versions 1.14.0 and later. See Using data residency with Apigee hybrid.

See Introduction to data residency for information on DRZ and Advanced API Security support across organization types.

Issue

v1.13.3 , v1.14.1, v1.12.4

The Nimbus JOSE + JWT library may cause a java.lang.ClassCircularityError when using a JavaCallout policy.

For more information, see Apigee known issues.

Fixed

Announcement

Manage process ID limits

The procedure to manage the process ID limits in your clusters has been added to the documentation.

A Process ID limit is a Kubernetes resource constraint on nodes and pods to prevent excessive process creation, which can impact node stability. Setting process ID limits in Kubernetes can improve system stability, security, and resource management. This is also consistent with Kubernetes best practices. Apigee Hybrid supports the Kubernetes feature to set process ID limits.

See: Manage process ID limits.

Announcement

hybrid v1.14.1

On March 1, 2025 we released an updated version of the Apigee hybrid software, 1.14.1.

This release enhances the security posture within the JavaCallout and PythonScript policies. This release does not include any new features or general bug fixes.

• For information on upgrading, see Upgrading Apigee hybrid to version 1.14.
• For information on new installations, see The big picture.
• For recommended actions after upgrading, see Validate policies after upgrade to 1.14.1.

Security

Stricter class instantiation checks included in this release.

JavaCallout policy now includes additional security during Java class instantiation. The enhanced security measure prevents the deployment of policies that directly or indirectly attempt actions that require permissions that are not allowed.

In most cases, existing policies will continue to function as expected without any issues. However, there is a possibility that policies relying on third-party libraries, or those with custom code that indirectly triggers operations requiring elevated permissions, could be affected.

To test your installation, follow the procedure in Validate policies after upgrade to 1.14.1 to validate policy behavior.

Security

Stricter class instantiation checks included in this release.

JavaCallout policy now includes additional security during Java class instantiation. The enhanced security measure prevents the deployment of policies that directly or indirectly attempt actions that require permissions that are not allowed.

In most cases, existing policies will continue to function as expected without any issues. However, there is a possibility that policies relying on third-party libraries, or those with custom code that indirectly triggers operations requiring elevated permissions, could be affected.

To test your installation, follow the procedure in Validate policies after upgrade to 1.13.3 to validate policy behavior.

Announcement

hybrid v1.13.3

On March 1, 2025 we released an updated version of the Apigee hybrid software, 1.13.3.

This release enhances the security posture within the JavaCallout and PythonScript policies. This release does not include any new features or general bug fixes.

• For information on upgrading, see Upgrading Apigee hybrid to version 1.13.
• For information on new installations, see The big picture.
• For recommended actions after upgrading, see Validate policies after upgrade to 1.13.3.

Announcement

Manage process ID limits

The procedure to manage the process ID limits in your clusters has been added to the documentation.

A Process ID limit is a Kubernetes resource constraint on nodes and pods to prevent excessive process creation, which can impact node stability. Setting process ID limits in Kubernetes can improve system stability, security, and resource management. This is also consistent with Kubernetes best practices. Apigee Hybrid supports the Kubernetes feature to set process ID limits.

See: Manage process ID limits.

Fixed

Announcement

hybrid v1.12.4

On March 1, 2025 we released an updated version of the Apigee hybrid software, 1.12.4.

This release enhances the security posture within the JavaCallout and PythonScript policies. This release does not include any new features or general bug fixes.

• For information on upgrading, see Upgrading Apigee hybrid to version 1.12.
• For information on new installations, see The big picture.
• For recommended actions after upgrading, see Validate policies after upgrade to 1.12.4.

Security

Stricter class instantiation checks included in this release.

JavaCallout policy now includes additional security during Java class instantiation. The enhanced security measure prevents the deployment of policies that directly or indirectly attempt actions that require permissions that are not allowed.

In most cases, existing policies will continue to function as expected without any issues. However, there is a possibility that policies relying on third-party libraries, or those with custom code that indirectly triggers operations requiring elevated permissions, could be affected.

To test your installation, follow the procedure in Validate policies after upgrade to 1.12.4 to validate policy behavior.

Fixed

Announcement

hybrid 1.14.0-hotfix.1

On January 9, 2025 we released an updated version of the Apigee hybrid software, 1.14.0-hotfix.1.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.14.
• For information on new installations, see The big picture.

Instructions:

To install 1.14.0-hotfix.1:

1. In your overrides.yaml file update the value of metrics.sdSidecar.image.tag to 0.10.0. Add the following stanza:

   metrics:
     sdSidecar:
       image:
         url: "gcr.io/apigee-release/hybrid/apigee-stackdriver-prometheus-sidecar"
         tag: "0.10.0"
   

2. Apply the changes to the apigee-telemetry chart:

   1. Dry run:

      helm upgrade telemetry apigee-telemetry/ \
        --install \
        --namespace APIGEE_NAMESPACE \
        --atomic \
        -f overrides.yaml \
        --dry-run=server
      

   2. Install the chart:

      helm upgrade telemetry apigee-telemetry/ \
        --install \
        --namespace APIGEE_NAMESPACE \
        --atomic \
        -f overrides.yaml
      

   3. Verify the change by checking its state:

      kubectl -n APIGEE_NAMESPACE get apigeetelemetry apigee-telemetry
      

Fixed

Announcement

hybrid v1.14.0

On December 16, 2024 we released an updated version of the Apigee hybrid software, v1.14.0.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.14.
• For information on new installations, see The big picture.

Feature

Enhanced Per-environment Proxy Limits in Apigee Hybrid

Starting in version v1.14, new Apigee hybrid organizations can be provisioned with the ability to deploy more than 50 proxies per environment enabled. This feature is already available for Apigee X.

Starting with Apigee hybrid version 1.14, the limits for Apigee hybrid organizations have increased:

• The maximum number of deployed API proxies and shared flows per organization is 6000.
• The maximum number of proxy deployment units per Apigee instance is 6000.
• The maximum number of API base paths per Apigee organization is 3000.

When more than 50 proxies are deployed in an environment, Apigee will automatically partition the environment into several distinct replica sets, each containing a subset of proxies deployed in the environment. These replica subsets are equivalent in behavior and infrastructure resource usage to a single environment in the way it loads and runs a set of proxies and other environment resources. This will be transparent to the user, and you can continue to use the environment as you would a single environment.

See:

• Enhanced per-environment proxy limits
• Subscription 2024

Feature

Forward Proxy allowlist access

Starting in version v1.14, forward proxies pass through access to allowlisted URLs. Therefore you only need to configure allowlists to googleapis.com URLs on the server on which the forward proxy is configured. See:

• Google Cloud URLs to allow for Hybrid
• Using Data Residency with Apigee hybrid: URL allowlisting
• Configure forward proxying for API proxies

Feature

Guardrails checks to ensure backups before upgrade

Starting in version 1.14 new guardrails checks have been added to ensure a backup is enabled and has been made before proceeding with an upgrade. See:

• Upgrading Apigee hybrid to version v1.14
• Diagnosing issues with guardrails

Feature

Enable and disable metrics-based scaling with customAutoscaling.enabled

Starting in version v1.14, you can enable and disable metrics-based auto-scaling with the customAutoscaling.enabled configuration property. See:

• Scale and autoscale runtime services: Metrics-based scaling
• customAutoscaling.enabled

Feature

Cassandra credential rotation

Starting in version v1.14, you can rotate Cassandra credentials in Kubernetes secrets. In addition, you can now roll back credential rotation before the cleanup job is initiated in both Vault and Kubernetes secrets. See:

• Rotating Cassandra credentials in Kubernetes secrets
• Rotating Cassandra credentials in Vault: Rolling back a rotation
• Rotating Cassandra credentials in Kubernetes secrets: Rolling back a rotation

Feature

New analytics and debug data pipeline for hybrid orgs

Starting with version 1.14, Apigee hybrid orgs can use a new data pipeline to collect analytics and debug data and allow various runtime components to write data directly to our control plane. Control plane access is required to enable the new data pipeline.

See:

• Enable Control Plane access
• Configure hybrid to use the new data pipeline (v1.14.0 only)

Fixed

Security

Announcement

hybrid v1.13.2

On November 12, 2024 we released an updated version of the Apigee hybrid software, 1.13.2.

• For information on upgrading, see Upgrading Apigee hybrid to version 1.13.2.
• For information on new installations, see The big picture.

Security

Fixed

Announcement

hybrid v1.12.3

On November 1, 2024 we released an updated version of the Apigee hybrid software, 1.12.3.

• For information on upgrading, see Upgrading Apigee hybrid to version 1.12.3.
• For information on new installations, see The big picture.

Fixed

Security

Announcement

hybrid v1.13.1

On October 4, 2024 we released an updated version of the Apigee hybrid software, 1.13.1.

• For information on upgrading, see Upgrading Apigee hybrid to version 1.13.1.
• For information on new installations, see The big picture.

Feature

New analytics and debug data pipeline for data residency-enabled orgs

Starting in v1.13.1 hybrid organizations created with data residency enabled must use the new data pipeline to collect analytics and debug data and allow various runtime components to write data directly to our control plane. Changes to overrides file and control plane access are required to enable the new data pipeline.

For details, see:

• Enabling the new data pipeline.
• Configure hybrid to use the new data pipeline

Feature

Cassandra credential rotation in Vault

Starting in version v1.3.1, You can set up automatic Cassandra credential rotation when your credentials are stored in Hashicorp Vault. See Rotating Cassandra credentials in Hashicorp Vault.

Fixed

Security

Announcement

hybrid v1.12.2

On September 13, 2024 we released an updated version of the Apigee hybrid software, 1.12.2.

• For information on upgrading, see Upgrading Apigee hybrid to version 1.12.2.
• For information on new installations, see The big picture.

Fixed

Security

Announcement

hybrid 1.13.0-hotfix.1

On September 5, 2024 we released an updated version of the Apigee hybrid software, 1.13.0-hotfix.1.

Apply this hotfix following the steps in Upgrading Apigee hybrid to version 1.13:

1. Prepare for the Helm charts upgrade
2. Install the Apigee hybrid Helm charts

• For information on upgrading, see Upgrading Apigee hybrid to version 1.13.
• For information on new installations, see The big picture.

Fixed

Announcement

hybrid v1.13.0

On August 23, 2024 we released an updated version of the Apigee hybrid software, v1.13.0.

• For information on upgrading, see Upgrading Apigee hybrid to version v1.13.0.
• For information on new installations, see The big picture.

Feature

Storing additional secrets in an external secret store

Starting in version v1.13, You can now store AX Hash Salt, Redis password, and Encryption keys in an external secret store like Hashicorp Vault. See Storing Secrets in Vault.

Feature

Apigee Operator now runs in the Apigee Kubernetes namespace

Starting in version v1.13, apigee-operator runs in the same name space as the other Apigee hybrid components instead of the apigee-system namespace. You can use apigee or your own custom Apigee namespace. See Upgrading Apigee hybrid to version v1.13.0 and Step 3: Create the apigee namespace.

Feature

Leader election enabled for apigee-watcher component

Starting in version v1.13.0, leader election is enabled for the apigee-watcher component. For proper functioning of the leader election, make sure that the apigee-watcher component uses only one replica set.

Feature

Improved backup and restore

Starting in version v1.13.0, Apigee hybrid introduces a new backup and restore system. The new system removes the need for pod exec permission and use of a Kubernetes ClusterRole, and requires fewer Kubernetes Service Accounts when using Workload Identity. The new system replaces use of the apigee-cassandra-backup-utility image by using the apigee-hybrid-cassandra-client image. The apigee-cassandra-backup-utility image will no longer be provided starting with this release.

To use the new functionality if you are overriding the image used, update your overrides.yaml file.

Replace:

• repo.sample.com/gcr-docker/apigee-release/hybrid/apigee-cassandra-backup-utility

with

• repo.sample.com/gcr-docker/apigee-release/hybrid/apigee-hybrid-cassandra-client

under cassandra.backup.image.url and cassandra.restore.image.url.

See Scheduling backups in a remote server for more information.

Fixed

Security

Announcement

hybrid 1.11.2-hotfix.2

On July 31, 2024 we released an updated version of the Apigee hybrid software, 1.11.2-hotfix.2.

Note: This release reflects a change to the component images and not the Helm chart templates. If your hybrid installation is currently on Apigee hybrid v1.11.2, Apply this hotfix with the following steps:

1. In your overrides file, update the image.url and image.tag properties of ao and runtime:

   ao:
     image:
       url: "gcr.io/apigee-release/hybrid/apigee-operators"
       tag: "1.11.2-hotfix.2"
   
   runtime:
     image:
       url: "gcr.io/apigee-release/hybrid/apigee-runtime"
       tag: "1.11.2-hotfix.2"
   

2. Install the hotfix release:

   • For Helm-managed releases, update the apigee-operator with the helm upgrade command and your current overrides files:

     helm upgrade operator apigee-operator/ \
       --namespace apigee-system \
       --atomic \
       -f overrides.yaml 
     

     For each environment in your Apigee org:

     helm upgrade ENV_RELEASE_NAME apigee-env/ \
       --namespace APIGEE_NAMESPACE \
       --set env=ENV_NAME \
       --atomic \
       -f overrides.yaml 
     

     • ENV_RELEASE_NAME is a name used to keep track of installation and upgrades of the apigee-env chart. This name must be unique from the other Helm release names in your installation. Usually this is the same as ENV_NAME. However, if your environment has the same name as your environment group, you must use different release names for the environment and environment group, for example dev-env-release and dev-envgroup-release. For more information on releases in Helm, see Three big concepts in the Helm documentation.
     • APIGEE_NAMESPACE is your installation's namespace. The default is apigee.
     • ENV_NAME is the name of the environment you are upgrading.

   • For apigeectl-managed releases:

     1. install the hotfix release with apigeectl init using your updated overrides file:

        ${APIGEECTL_HOME}/apigeectl init -f OVERRIDES_FILE --dry-run=client 
        

        Followed by:

        ${APIGEECTL_HOME}/apigeectl init -f OVERRIDES_FILE 
        

     2. Apply the hotfix release with apigeectl apply:

        ${APIGEECTL_HOME}/apigeectl apply -f OVERRIDES_FILE --all-envs --dry-run=client 
        

        Followed by:

        ${APIGEECTL_HOME}/apigeectl apply -f OVERRIDES_FILE --all-envs
        

• For information on upgrading, see Upgrading Apigee hybrid to version 1.11.
• For information on new installations, see The big picture.

Fixed

Announcement

hybrid 1.12.1-hotfix.1

On July 30, 2024 we released an updated version of the Apigee hybrid software, 1.12.1-hotfix.1.

Note: This release reflects a change to the component images and not the Helm chart templates. If your hybrid installation is currently on Apigee hybrid v1.12.1, Apply this hotfix with the following steps:

1. In your overrides file, update the ao.image.url and ao.image.tag properties:

   ao:
     image:
       url: "gcr.io/apigee-release/hybrid/apigee-operators"
       tag: "1.12.1-hotfix.1"
   

2. Install the hotfix release. Update the apigee-operator component with the helm upgrade command and your current overrides files:

      helm upgrade operator apigee-operator/ \
        --namespace apigee-system \
        --atomic \
        -f overrides.yaml 
   

• For information on upgrading, see Upgrading Apigee hybrid to version 1.12.
• For information on new installations, see The big picture.

Fixed

Announcement

hybrid v1.12.1

On June 28, 2024 we released an updated version of the Apigee hybrid software, 1.12.1.

• For information on upgrading, see Upgrading Apigee hybrid to version 1.12.1.
• For information on new installations, see The big picture.

Fixed

Security

Announcement

hybrid 1.10.5-hotfix.1

On June 28, 2024 we released an updated version of the Apigee hybrid software, 1.10.5-hotfix.1.

Note: This release reflects a change to the Helm chart templates and not a change to the images. If your hybrid installation is currently on Apigee hybrid v1.10.5, Apply this hotfix with the following steps:

1. In your overrides file, update the ao.image url and tag:

   ao:
     image:
       url: "gcr.io/apigee-release/hybrid/apigee-operators"
       tag: "1.10.5-hotfix.1"
   

2. Install the hotfix release with apigeectl init using your updated overrides files:

   ${APIGEECTL_HOME}/apigeectl init -f OVERRIDES_FILE --dry-run=client 
   

   Followed by:

   ${APIGEECTL_HOME}/apigeectl init -f OVERRIDES_FILE 
   

• For information on upgrading, see Upgrading Apigee hybrid to version 1.10.5-hotfix.1.
• For information on new installations, see The big picture.

Fixed

Announcement

hybrid 1.11.2-hotfix.1

On June 28, 2024 we released an updated version of the Apigee hybrid software, 1.11.2-hotfix.1.

Note: This release reflects a change to the Helm chart templates and not a change to the images. If your hybrid installation is currently on Apigee hybrid v1.11.2, Apply this hotfix with the following steps:

1. In your overrides file, update the ao.image url and tag:

   ao:
     image:
       url: "gcr.io/apigee-release/hybrid/apigee-operators"
       tag: "1.11.2-hotfix.1"
   

2. Install the hotfix release:

   • For Helm-managed releases, update the apigee-operator with the helm upgrade command and your current overrides files:

     helm upgrade operator apigee-operator/ \
       --namespace apigee-system \
       --atomic \
       -f overrides.yaml 
     

   • For apigeectl-managed releases, install the hotfix release with apigeectl init using your updated overrides files:

     ${APIGEECTL_HOME}/apigeectl init -f OVERRIDES_FILE --dry-run=client 
     

     Followed by:

     ${APIGEECTL_HOME}/apigeectl init -f OVERRIDES_FILE 
     

• For information on upgrading, see Upgrading Apigee hybrid to version 1.11.2-hotfix.1.
• For information on new installations, see The big picture.

Announcement

hybrid v1.10.5

On June 17, 2024 we released an updated version of the Apigee hybrid software, 1.10.5.

• For information on upgrading, see Upgrading Apigee hybrid to version 1.10.5.
• For information on new installations, see The big picture.

Security

Announcement

hybrid v1.11.2

On June 10, 2024 we released an updated version of the Apigee hybrid software, 1.11.2.

• For information on upgrading, see Upgrading Apigee hybrid to version 1.11.2.
• For information on new installations, see The big picture.

Fixed

Security

Announcement

ANNOUNCEMENT

hybrid 1.12.0-hotfix.1

On May 28, 2024 we released an updated version of the Apigee hybrid software, 1.12.0-hotfix.1.

Note: This release reflects a change to the Helm chart templates and not a change to the images. If your hybrid installation is currently on Apigee hybrid v1.12.0, you can install this hotfix release by downloading the charts with the version tag 1.12.0-hotfix.1 and updating the apigee-operator and apigee-datastore charts with the helm upgrade command and your current overrides files.

For example:

export CHART_REPO=oci://us-docker.pkg.dev/apigee-release/apigee-hybrid-helm-charts
export CHART_VERSION=1.12.0-hotfix.1
helm pull $CHART_REPO/apigee-operator --version $CHART_VERSION --untar
helm pull $CHART_REPO/apigee-datastore --version $CHART_VERSION --untar

helm upgrade operator apigee-operator/ \
  --namespace apigee-system \
  --atomic \
  -f overrides.yaml 

helm upgrade datastore apigee-datastore/ \
  --namespace apigee \
  --atomic \
  -f overrides.yaml

• For information on upgrading, see Upgrading Apigee hybrid to version 1.12.0-hotfix.1.
• For information on new installations, see The big picture.

Fixed