Gateway Groups

A gateway group is a logical grouping of API7 Gateway data plane instances that share the same configuration. It isolates services, consumers, certificates, and global rules across environments, regions, or teams.

How gateway groups work

When you deploy API7 Gateway, you assign each data plane instance to a specific gateway group. The control plane then pushes the relevant configuration to all instances within that group.

A gateway group contains:

• Services: API configurations that are live on the group.
• Global rules: Plugins that apply to every request processed by the group (e.g., centralized logging or global rate limiting).
• SSL certificates: Certificates assigned to the group for TLS termination.
• Consumers: Identity and credentials authorized for the group.

Configuration fields

The following fields define a gateway group:

• Name: A descriptive name for the group (e.g., us-east-prod).
• Type:
  • api7_gateway: Standard API7 Gateway group.
  • api7_ingress_controller: Group managed from Kubernetes by API7 Ingress Controller (opens in Ingress Controller docs) through Ingress, Gateway API, and APISIX custom resources. APISIX Ingress Controller is the matching controller for Apache APISIX and does not connect to the API7 control plane.
• Control plane key prefix: The unique path the data plane uses to fetch configuration (e.g., /gateway_groups/us-west-1).
• Image Tag: The specific version of the API7 Gateway data plane used by this group.
• Environment: production or non_production. Set it in the API7 Dashboard when adding or editing a gateway group. It decides which licence quota the group's data-plane cores count against — see License Management. The default is production, which is also how groups created before 3.10.5 are counted.

API7 Gateway has no separate cluster object. A cluster is expressed as a gateway group, so naming and labels are what distinguish one cluster from another.

Use cases

Gateway groups carry multi-environment and multi-region deployments:

• Environment isolation: Create separate groups for development, staging, and production.
• Regional deployment: Deploy gateway groups in different geographic regions (e.g., aws-us-east-1 and aws-eu-central-1) while managing them from a single global control plane.
• Tenant isolation: Assign dedicated gateway groups to specific business units or high-priority customers to keep resources isolated and policy enforcement separate.

Related

Tasks that use this concept

• Multiple Availability Zones Deployment of API7 Gateway — deploy gateway groups across availability zones.
• Manage Gateway Groups

Related concepts

• Enterprise Features — explore additional enterprise capabilities.
• Services and Routes — understand how services, routes, and upstreams work together.