Run API7 Gateway in Production

What to settle before go-live, what to do on a recurring basis afterwards, and where the executable procedure for each task lives.

This page is the index for operating API7 Gateway: a go-live checklist, then the recurring work that keeps a deployment healthy. It deliberately does not restate sizing numbers, commands or thresholds that are maintained elsewhere — each item points at the page that owns it, so there is one place to change when the product changes.

If you are deploying on Kubernetes, Kubernetes Production Tuning is the companion runbook with the actual manifests and helm commands.

Before go-live

Work through these in order. Each one has a page that tells you how; this list only tells you that it is not optional.

Capacity and placement

Size the control plane and data plane against System Requirements. Size the control plane by the number of gateway instances and configuration churn; size the data plane by plugin mix, not just request rate.
Establish a throughput baseline with Performance Benchmark, using the plugins and route counts you actually plan to run. Sizing tables are a starting point; your plugin mix is what decides.
Size the shared dictionaries — see Shared Memory Sizing. Under-sized dictionaries make rate limiting fail silently rather than loudly.
Decide the failure domain. Multiple Availability Zones and Multi-Region Deployment Patterns cover placement.

Availability

Deploy for HA — Deploy for High Availability covers both planes.
Configure a fallback control plane so data planes keep serving when the control plane is unavailable: Data Plane Resilience.
Wire health probes into Kubernetes or your load balancer: Configure Readiness and Liveness Probes. Use /status/ready, not /status, for traffic decisions.
Plan PostgreSQL availability yourself. API7 does not configure replication, promotion or backups for its database — that is your deployment's responsibility, and it is the most common single point of failure.

Security

Change the default credentials. The Dashboard ships with admin / admin.
Terminate TLS everywhere — client to gateway, gateway to upstream, and control plane to data plane. Mutual TLS between Control Plane and Data Plane covers the last one. Its validity is chosen per data plane at install time as a number of days (the Admin API accepts any integer from 1 to 10950), defaulting to 3650 days (10 years) — and expiry breaks configuration distribution to that node. Record what you chose: rotation is manual, and a 10-year default means nothing will remind you.
Restrict the Admin API — IP Restrictions for Control Plane.
Move secrets out of configuration — Configure Secret Management.
Set up roles before handing out access — Role-Based Access Control and Create a Custom Role.
Review the rest of Security Hardening Reference.

Observability

Enable the prometheus plugin and confirm metrics are scraped: Monitor Metrics.
Ship logs off the node — Configure Centralized Logging, or Collect Gateway Logs on Kubernetes.
Instrument PostgreSQL separately. API7 exports no database metrics — see Observability overview.
Define SLIs and alert on burn rate — Alerts and SLOs.
Configure the Dashboard's own alerts for certificate expiry, instance offline and licence quota. Prometheus cannot see these: Configure Alerts.
Build the triage dashboard before you need it — Incident Dashboards.

Recoverability

Take a backup and restore it somewhere else. A backup that has never been restored is not a backup. Back Up API7 Gateway and Restore API7 Gateway.
Write down your RPO and RTO, then confirm your backup frequency and restore duration actually meet them.
Rehearse an upgrade on a non-production gateway group: Plan an API7 Gateway Upgrade.

Change management

Keep configuration in Git. Define routes, services and plugins declaratively with ADC, review changes like code, and apply them from CI rather than by hand in the Dashboard.
Use a non-production gateway group as the staging target — Manage Gateway Groups. Data planes in a non-production group are metered differently; see License Management.
Know the rollback path for each change type before the first production change.

One ADC pitfall worth knowing before you automate anything: request metrics depend on a prometheus global rule that every deployment starts with. If your declarative configuration does not include global_rules.prometheus, a sync deletes it — and --label-selector does not protect global rules. What stops is apisix_http_status, apisix_http_latency and apisix_bandwidth; node-level metrics keep reporting, so the deployment still looks healthy while traffic, error and latency data silently goes to zero. Manage Gateway Configuration with GitOps covers the safe pattern.

After go-live

Cadence	Task	Where
Continuous	Alerting on error-budget burn, control-plane reachability, dictionary saturation	Alerts and SLOs
Weekly	Check licence utilisation against entitlement	License Management
Monthly	Review role assignments and audit access	Audit Logs
Monthly	Apply patch releases	Plan an API7 Gateway Upgrade
Quarterly	Restore drill — restore a real backup into a scratch environment and time it	Restore API7 Gateway
Quarterly	Re-run capacity planning against observed growth	Performance Benchmark
Before expiry	Rotate the control-plane/data-plane mTLS certificates. Rotation is manual; the Dashboard alert is the only thing that tracks the date for you	Mutual TLS between Control Plane and Data Plane

Promoting a change

Apply to a non-production gateway group and verify there.
Confirm data planes actually received it. An instance that has lost its control-plane connection keeps serving its last known configuration and looks healthy — watch apisix_etcd_reachable.
Roll out to production incrementally, checking readiness between batches.
For data-plane version changes, use Data Plane Rolling Upgrade, which adds before it drains.

Scaling

Scale Data Plane — manual scaling and when to reach for it.
Autoscale Data Plane on Kubernetes — HPA, with the CPU-request precondition that makes it work.
Kubernetes Production Tuning — worker processes, requests and limits, PDB, anti-affinity, load-balancer exposure.