Skip to main content
Before Gateway 3.20.0, Gateway was configured with global GATEWAY_PORT_*, GATEWAY_ADVERTISED_HOST, GATEWAY_ROUTING_MECHANISM and GATEWAY_SECURITY_PROTOCOL environment variables. This legacy network configuration is deprecated and will be removed in Gateway 3.23. New deployments should use listener configuration. This page is for deployments still running on legacy network configuration. It documents how the deprecated mode behaves. To switch to listener configuration, see Migrate to listener configuration.
The legacy network configuration remains supported for now to give existing deployments time to migrate. Plan a migration; new functionality will not be backported to this mode.

​
Detect which mode you’re running

Gateway detects the configuration mode automatically at startup based on the environment variables you set: From Gateway 3.20.0, legacy network configuration logs a deprecation warning at startup. Its presence in the logs confirms the mode is active:
Internally, Gateway converts the legacy variables into a single listener named DEFAULT, so the Computed configuration block lists a DEFAULT listener in both legacy and listener configuration. The deprecation warning is what distinguishes the two.

​
How the legacy mode behaves

In legacy network configuration, Gateway infers missing security settings from the backing Kafka cluster.

​
Security mode and protocol inference

How Gateway determines default values for GATEWAY_SECURITY_PROTOCOL and GATEWAY_SECURITY_MODE depends on which of the two are explicitly set. Both GATEWAY_SECURITY_PROTOCOL and GATEWAY_SECURITY_MODE unset: Gateway infers both from the Kafka cluster’s security protocol. If no security protocol is configured on the backing Kafka cluster, Gateway defaults to PLAINTEXT with GATEWAY_MANAGED mode. Only GATEWAY_SECURITY_MODE set: Gateway infers the protocol from the combination. Only GATEWAY_SECURITY_PROTOCOL set: Gateway infers the mode from the protocol.
The DELEGATED_SASL_PLAINTEXT and DELEGATED_SASL_SSL values were deprecated in Gateway 3.10.0 in favor of GATEWAY_SECURITY_MODE. They remain supported but are no longer recommended. See the security mode migration guide.

​
ACL default

GATEWAY_ACL_ENABLED is inferred from the security mode:
  • GATEWAY_MANAGED → true
  • KAFKA_MANAGED → false
You can override the inferred value by setting GATEWAY_ACL_ENABLED explicitly.

​
Legacy environment variable reference

For reference, these are the environment variables that listener configuration replaces. Use them only on deployments that have not yet migrated. GATEWAY_MIN_BROKERID is unchanged and still applies to port routing under listener configuration. See Gateway environment variables.