What G8 is
G8 manages API gateways that run in your own infrastructure. You describe in a console which requests the gateway takes, where it sends them and what happens to them on the way. G8 writes that to the gateway cluster and watches the traffic that flows through it.
This is the first of six sessions. Read in order, they take you from an empty machine to the first API your clients call with a key. Each session says what it builds on, what to do, and what you should see at the end; from there the guides and the Operate pages take over, each in a reading order of its own.
Before this session
Nothing. This is where the path starts.
In this session
- Read the pieces below and the roles that work on them.
- Keep the example these pages share at hand; every later session uses the same names, and Words these pages use explains each one.
- Look at the road ahead at the end of this page to see where each phase takes you.
The pieces
The gateway is the cluster your clients call. Its gateway nodes take the requests, run the plugins you set and pass the requests on to your backends. The gateway runs on its own machines or in your Kubernetes cluster, installed as Plan the installation describes. Words these pages use explains the names the console gives it.
The gateway host is the host name of the gateway, the address your clients call, api.example.com in the examples. In the console it is the first part of the Address line on a route's Overview tab. HTTPS answers on the gateway's port 9443 until whoever runs the gateway publishes HTTPS on 443. Plain HTTP answers on the gateway's HTTP port.
The console is the web application where you work. Everything you save in it goes to the gateway through the gateway's administration interface.
The server sits behind the console. It keeps the users, roles and the audit log in its own database, talks to each gateway cluster, and reads the request records and the request counts from the stores you connect.
An environment is one gateway cluster that G8 manages: Development, Staging and Production, for example. One installation manages several. Everything you open in the console belongs to the environment chosen in the switcher at the top of the menu, and every change you save goes to that environment's cluster and no other. Environments explains what stays separate.
What you work with
| Object | What it is for | Where to start |
|---|---|---|
| Route | Says which requests the gateway takes and where it sends them. | Route requests to a backend |
| Upstream | The backend nodes, listed once, with a health check. | Share a backend between routes |
| Service | What several routes have in common: backend nodes and plugins. | Share plugins between routes |
| Plugin | What happens to a request: a key check, a limit, a rewrite, a record. | Require an API key |
| Consumer and credential | One client of your APIs and the credentials it signs in with. | Give a client its key |
| Consumer group | Consumers that share plugins. | Give a group of clients one limit |
| Global rule | Plugins that run on every request of the environment. | Apply a plugin to every request |
| Certificate | HTTPS for the host names your clients call. | Serve HTTPS with your certificate |
How G8 handles a request follows one request through these objects.
Who does what
Access is given by roles. Four are built in.
| Role | Scope | What it may do |
|---|---|---|
| Platform administrator | The whole installation | Everything, in every environment: the environments and their connections, the Gateway URL and the stores among them, users, roles, the directory connection and the platform audit log. |
| Environment administrator | One environment | Everything in that environment, including secrets, the request records, Analytics, Alerts and the audit log. |
| Editor | One environment | Create and change routes, services, upstreams, consumers with their credentials, consumer groups, global rules, plugin configs, the Environment-wide settings of plugins, protos and stream routes. View certificates and secrets without changing them. No audit log, request records, Analytics or Alerts. |
| Viewer | One environment | View what an Editor views, change nothing. |
The guides say which role each job needs. Users, roles and access explains how a person gets one, including through Active Directory groups.
The example these pages use
Every guide and every reference page draws from one example, so that what you learn on one page carries over to the next.
| Thing | In the examples |
|---|---|
| Gateway host | api.example.com, called as https://api.example.com |
| The orders backend | Two backend nodes, 10.0.1.10:8080 and 10.0.1.11:8080, each answering /health |
| The route | orders-api, for /orders and /orders/* |
| A second route | invoices-api, for /invoices and /invoices/*, set up the same way |
| An older route | orders-v1, for /api/v1/orders/*, rewritten before it reaches the backend |
| Clients | mobile-app, payments-app and partner-portal, each a consumer with a key |
| Credentials | mobile-app-key-2026, the key-auth credential of mobile-app, replaced later by mobile-app-key-2027 |
| A team | The payments team, labelled team with the value payments |
| A group | partners, with its own limit |
| Load balancers | Connecting from 10.0.0.21 and 10.0.0.22, writing X-Forwarded-For |
| A partner network | 203.0.113.0/24 |
| Kafka | Brokers kafka-1.internal and kafka-2.internal, topic gateway-access |
| Identity provider | Keycloak, with the client orders-api |
Nothing in the examples is real. Replace the names with your own as you go.
What you should see
You can say, in your own words, what the gateway, the console, the server and an environment each do, and which role you will need for the sessions ahead.
The road ahead
| Phase | Sessions | What you have at the end |
|---|---|---|
| Install | Plan the installation, Install G8 itself | A gateway cluster and a G8 server, both running. |
| Set up | First sign-in and the first environment, People and access | An administrator, an environment connected to the cluster, and people with roles in it. |
| Publish | Your first API, then the guides Protect an API, Control traffic, Shape requests and answers and Serve HTTPS | An API your clients call with a key, under a limit, over HTTPS. |
| Operate | The Operate pages in reading order: See what happens, Audit and governance, Under the hood, Run the server | Records, numbers and alerts for the traffic, an audit trail for the changes, and a server you can back up and upgrade. |
Where this leads
The next session, Plan the installation, lays out the two halves of an installation and picks the guide for your platform. If G8 is already installed and you were given a role, go straight to Your first API.