Learn how to manage KVM in Apigee. Our KVM Support team is here to help you with your questions and concerns.

How to Manage KVM in Apigee

In Apigee, Key Value Maps (KVMs) are used to store configuration data such as credentials, settings, and other critical information in encrypted or unencrypted form.

KVM entries for API proxy, organization, and environment scopes are protected using a Cloud KMS key when an Apigee organization is provisioned.

Today, we will take a look at how to manage KVMs, including creating, retrieving, and deleting them, as well as how to set up key value maps for Apigee Edge and Apigee X.

An Overview:

• Retrieving Encrypted and Unencrypted KVMs
• Using the Management API for KVMs
• Creating a New KVM in Apigee
• Deleting a KVM
• Uploading a Proxy Bundle to Apigee
• Setting Up Key Value Maps for Apigee Edge
• Setting Up Key Value Maps for Apigee X
• Deploying the Proxy and Mapping Authentication Credentials

Retrieving Encrypted and Unencrypted KVMs

KVMs can be retrieved using the KeyValueMapOperations policy in Apigee. For both encrypted and unencrypted values, use the `<Ge>>` element.

When retrieving encrypted KVMs, prefix the variable name with `private.` to prevent the value from being visible during debugging and trace sessions. This method ensures the security of sensitive data.

• Policy Configuration:

  Use the `<Get>` element in the KeyValueMapOperations policy to fetch values.
• Private Prefix:

  For encrypted values, use the `private.` prefix to hide them during debugging.

Using the Management API for KVMs

For administrative purposes, such as backing up KVMs or managing key/value pairs, the Management API lets us retrieve JSON definitions of KVMs. However, note that encrypted values will appear as masked in the API response.

• Backup KVMs:

  Use the Management API to export and store KVM definitions.
• Encrypted Values:

  Be aware that encrypted KVM values are not visible in API responses.

Creating a New KVM in Apigee

To create a new KVM, follow these steps:

1. Open Apigee in Google Cloud Console at this link.
2. Then, go to Management > Environments in the left panel.
3. Select the desired environment.
4. Next, go to the Key Value Maps tab and click + Create Key Value Map.
5. Then, enter a name for the KVM (letters, numbers, and hyphens only, max 255 characters).
6. Finally, click Create. The new KVM will be listed on the page.

Deleting a KVM

To delete a KVM, follow these steps:

1. Open the Apigee Console and go to Management > Environments.
2. Select the appropriate environment and go to the Key Value Maps tab.
3. Then, find the KVM we want to delete and click Delete in the Actions column.
4. Confirm the deletion in the dialog box.

Uploading a Proxy Bundle to Apigee

To upload a proxy bundle in Apigee, follow these steps:

1. Download the proxy bundle from Settings > API Gateways.
2. Log in to Apigee and go to Develop > API Proxies.
3. Then, click + Proxy and choose Upload Proxy Bundle.
4. Drag and drop the bundle or upload it from the system.
5. Finally, click Create to finish uploading the proxy.

Setting Up Key Value Maps for Apigee Edge

After uploading the proxy bundle to Apigee Edge, create KVMs to store credentials:

1. Go to Admin > Environments > Key Value Maps.
2. Click + Key Value Map and provide a name for the KVM.
3. Then, select the Encrypted checkbox for sensitive data.
4. Add key-value pairs such as `username` and `password`.

Setting Up Key Value Maps for Apigee X

For Apigee X, the process is similar, but we will need to handle service user credentials using a service account JSON file:

1. Go to Admin > Environments > Key Value Maps.
2. Then, create a new KVM and set the service account credentials as the `serviceAccountCredentialsFile` parameter.
3. Use the KeyValueMapOperations policy to add or retrieve data from KVMs in Apigee X.

Deploying the Proxy and Mapping Authentication Credentials

Once the key value maps are set up, deploy the proxy and map the authentication credentials:

1. Go to Develop > API Proxies and open the API proxy.
2. Under Policies, select the appropriate policy.
3. Then, map the credentials by entering the KVM name.
4. Deploy the proxy to the desired environment and view the deployment URL in the Overview tab.

[Need assistance with a different issue? Our team is available 24/7.]

Conclusion

Managing KVMs in Apigee is a crucial part of maintaining secure and organized configurations. Whether we are working with encrypted credentials, creating new KVMs, or deploying proxies, the process involves various tools and policies within the Apigee ecosystem. By following these steps, we can ensure proper management of key-value pairs across Apigee environments, whether on Edge or X.

In brief, our Support Experts demonstrated how to manage KVM in Apigee.