Environment settings

An environment's settings are the record G8 keeps for one gateway cluster. They say what the environment is called, where its Admin API answers and with which key, and where its request records and metrics are stored. Environments explains what an environment is, and Add an environment walks through the first save. This page describes what each setting means once the environment exists.

Who may open it

The settings belong to the Platform administrator. In the list under Environments, the row menu holds Edit, Test connection, Mark as protected and Delete environment. Anyone else who opens the form by its address sees a page that says Platform administrators manage it.

The server holds the same line. Changing, testing, protecting and deleting an environment each need the permission to manage environments (environments.manage). It is a platform permission, so no custom role can carry it; see Custom roles. The latest connection results of an environment can be read by every user with a role in it.

What the form holds

Section	Field	What it holds
General	Name	The name shown in the switcher and the list. Up to 64 characters, and no two environments share a name, whatever the case.
General	Slug	The short identifier set when the environment was created. Shown, and never editable.
General	Description	Optional text, up to 1000 characters.
Engine	Admin API URL	The address of the cluster's Admin API. G8 reads and writes the gateway objects there.
Engine	Admin key	The key G8 sends to the Admin API. Stored sealed and never shown again.
Engine	Gateway URL	Optional. The address your API clients call, shown on every route.
Engine	CA certificates	Optional. Up to 32 KB of PEM certificates, trusted on every HTTPS connection of the environment.
Observability	Elasticsearch URL, Username, Password	Optional. The log store that holds the request records. The password is stored sealed.
Observability	Prometheus URL	Optional. The Prometheus that holds the request counts and response times.
Protection	Protected	When on, the delete dialog of every object asks you to type the object's name first. It asks for the ID instead for an object without a name, and for global rules, plugin configs, consumer groups, credentials and cost decorations, the per-service objects of graphql-limit-count. Other changes are not affected. The environment itself cannot be removed until you unprotect it.

Saving the form writes to G8 only; the cluster is not changed. A saved change leaves an Environment updated row (environment.updated) that lists the fields that changed. The row says whether the admin key or the log store password was replaced, and never carries either value. Turning protection on or off leaves an Environment protection changed row (environment.protected_changed). Both rows belong to the environment, so they show in its own audit log and in the platform audit log.

The slug

The slug cannot change. The form shows it locked, with this hint: Cannot change: it is part of every address and audit row of this environment. The server's update of an environment takes no slug at all.

The slug is the environment's name everywhere G8 stores or reads something for it. It is part of every console address of the environment and of every audit row. It also names the environment's data in the shared stores, and those names are derived from it at every read, never stored.

Where	Name, for the slug dev
Request records of one UTC day	g8-dev-access-2026.10.01
Prometheus label	g8_environment="dev"

The form shows both names under Elasticsearch indices and Prometheus label, with this note: Log store names carry the environment and follow the slug; they are not edited here.

For the same reason two slugs may not collide. A new slug is refused when another environment already holds it, or when its daily indices would match an existing environment's index pattern. It is also refused the other way round, when its own index pattern would match an existing environment's daily indices, as stage and stage-access-eu would. Add an environment lists the messages.

The admin key and the other secrets

The hint under the Admin key field says: Sent as X-API-KEY. Stored sealed; not shown again after you save. Before it is written, the server seals the key with AES-256-GCM under its own key, G8_SECRETS_KEY. No answer of the API carries the key back. The environment's record holds the Admin API address, and for the log store only whether a password is stored.

When you edit the environment, the key field says Stored. Select Replace to type a new key, or Keep the stored key to go back to the stored one. Test connection tries a new key before anything is saved, and tries the stored key when you have not typed one. The log store password works the same way. Clearing the Elasticsearch URL clears its username and password with it.

The same seal holds the directory's bind password, the mail relay password of Alerts and the signing keys of webhooks. Two rules of the server keep them readable.

• Rotating the server key. Start the server with the new key in G8_SECRETS_KEY and the old one in G8_SECRETS_KEY_PREVIOUS. At startup it opens every sealed value held under the old key and seals it again under the new one.
• A key the server does not hold. When a stored value was sealed under a key that is neither of the two, the server refuses to start. It does not run with secrets it cannot open.

Both keys are environment variables of the G8 server, read when it starts. If the key is lost, the sealed values cannot be read, and the server refuses to start without it.

Log store and Prometheus

The Observability section tells G8 where this environment's request records and metrics live. Each connection has its own Test connection button. Each test of a saved environment leaves a Connection test row in the environment's audit log, which the platform audit log also shows. Saving an address does not test it. The CA certificates of the Engine section apply here too, on the HTTPS connections to the log store and to Prometheus.

The Elasticsearch URL field takes the address of an Elasticsearch or an OpenSearch cluster. The connection test names the product that answered.

The username and password here are the account G8 reads the records with. The gateway writes them with an account of its own, which is not on this form. That account belongs to Traffic Explorer, the page that shows the request records; see Request records. It is entered on that page's Settings tab, in the dialog that turns logging on, and changed there later with Change address. G8 refuses a writing account that can read records, and one that cannot write a record into today's index. The gateway's address for the log store may differ from G8's, but it has to reach the same store.

Several environments can point at the same log store or the same Prometheus. Each one reads only the names derived from its own slug, so none reads another's records or counts. Environments shows what each connection adds to the console and what is missing without it.

The Observability section of the environment form: the log store address with its account and the Prometheus address.

Retention of request records

How long request records are kept is not on this form. It sits on the Settings tab of Traffic Explorer, set per environment from 1 to 30 days. Changing it needs the manage permission of Traffic Explorer (traffic.manage). Request records describes the daily deletion.

The gateway card on the Overview

The Overview of every environment carries a card titled Engine. The console calls the gateway the engine, as in that title and in the Engine section of the form. Every user with a role in the environment sees it, whatever the role.

Row	What it shows
Engine	The gateway's version, marked Verified when it is the version this release of G8 was verified against and Unverified otherwise. A gateway that hides its version shows as unverified.
Admin API	Reachable, with the time the check took, or Unreachable since the first failed check.
Gateway	The Gateway URL and how it answered the last connection check. Shown only when the environment has one.
Plugins available	How many plugins the gateway offers. A pill says when the gateway offers plugins G8's copy of its schema does not know, or lacks plugins that copy holds.
Stream mode	On when the gateway runs stream proxy listeners, Off when it does not.
Last checked	When the server last read the gateway.
One row per kind	How many objects of each kind the gateway holds, each linked to its list. Only the kinds your role may view are counted.

When the gateway did not answer for some kinds, a note under the card names them. When the version is unverified, a banner above the cards says so. Reading and writing continue, and the forms check what you type against the schema of the verified version.

Check again reads the gateway again; the button says Try again while the gateway is unreachable. Between reads, the server checks every environment's Admin API every 30 seconds. The list of environments and the switcher show the result of that same check.

Related

• Environments: what an environment is and what stays separate.
• Add an environment: the first save and the connection tests.
• Request records: what the log store connection is for, and the retention.
• Alerts: the system alert that fires when the gateway stops answering.
• Audit log: the rows that every change and test of an environment leaves.