Environments
An environment is one gateway cluster that G8 manages: Development, Staging or Production, for example. One G8 installation manages many environments and keeps what happens in each one apart.
Who may open it
Everyone sees the list of environments under Environments. To open one you need a role in it, or in All environments, and the Platform administrator opens every environment. In the switcher, an environment you have no role in shows a lock and No access.
Adding, changing, protecting and removing an environment needs the permission to manage environments (environments.manage). It is a platform permission, and only the Platform administrator holds it.
How it works
Each environment holds the address and the admin key of its cluster. G8 checks every cluster every 30 seconds and shows whether it answers, in the list of environments, in the switcher and on the Overview.
Every page of the console that shows gateway objects belongs to one environment. The switcher at the top of the menu shows which one, and the address of the page carries the environment's slug, as in /e/dev/routes. Every change you save goes to that environment's cluster and to no other. When you pick another environment in the switcher, the console asks before it switches.
What stays separate
- Gateway objects. A route, a service or any other object of one environment does not appear in another.
- Request records and metrics. Several environments can share one Elasticsearch, OpenSearch or Prometheus. G8 reads each environment's data under names built from its slug, so one environment never reads another's.
- Access. A role is given in one environment, or in All environments, which also covers environments added later.
| Where | Name, for the slug dev |
|---|---|
| Request records, one index per UTC day | g8-dev-access-* |
| Prometheus label | g8_environment="dev" |
G8 derives these names from the slug and never lets a person edit them in the console. They follow the slug, which is why the slug cannot change. The installation guide uses the same slug when it prepares Prometheus and the log store, so choose the slug before the cluster is prepared; see Plan the installation.
What each connection adds
| Connection | Needed | What it adds | Without it |
|---|---|---|---|
| Admin API | Required | G8 reads and writes the gateway objects of the cluster. | You cannot add the environment. |
| Gateway URL | Optional | The address shown on the Overview of every route, and a check of that address in the connection test. | Routes show no address. |
| Elasticsearch or OpenSearch | Optional | Request records in Traffic Explorer. | That page says the log store is not connected. |
| Prometheus | Optional | Analytics, the Requests and Gateway nodes cards on the Overview, and alert rules on traffic. | Analytics says Prometheus is not connected, the Overview shows neither card, and only system alerts can fire. |
| CA certificates | Optional | Trust in a private CA on every HTTPS connection above. | Only the system's trusted roots are used. |
Copy between environments
To bring an object from one environment into another, open its Raw JSON and select Copy to environment…. G8 shows what will change before anything is written. Secrets are copied unless you clear Copy secrets too. A value the gateway never returns is left out and named. References the target does not have are named. An object with the same ID shows as a difference and is replaced when you save. Nothing is written until you save in the target environment, and the audit record there says where the object came from. Certificates cannot be copied, because the gateway never returns their private key.
What G8 does not do
- Adding an environment does not install or change the cluster. G8 manages a cluster that is already running.
- Removing an environment removes its role assignments and its alert rules. The roles themselves stay. Its audit records stay, and the gateway objects, request records and metrics are not touched; G8 also stops deleting its old request records.
- In a protected environment, the delete dialog of every object asks you to type the object's name first. It asks for the ID instead for an object without a name, and for global rules, plugin configs, consumer groups, credentials and cost decorations, the per-service objects of graphql-limit-count. Other changes are not affected. The environment itself cannot be removed until you unprotect it.