Gateway configuration

Platform 6.4.0+

Use Gateway Configuration in Admin Essentials to configure how Platform features execute through your customer-hosted Itential Gateway 5 deployment. Outbound API calls and runCode task execution originate from your Gateway 5 environment rather than from Itential’s cloud, so they pass through your existing network controls.

If your network requires outbound traffic to pass through a proxy server, you can configure it here once and all integrations inherit it by default.

Before you begin

At least one gateway cluster running Gateway version 5.4 or later must be registered in Gateway Manager. For information, see Gateway Manager overview and Create a gateway cluster.

Set the Platform default cluster

Use the Platform Default section to designate the default gateway cluster that all Gateway 5-dependent features inherit when no feature-specific cluster is set.

Setting the Platform default cluster does not guarantee availability. If the cluster configured for a specific feature becomes unavailable, Platform returns an error — it does not fall back to the default.

To set the Platform default cluster:

In Admin Essentials, go to Gateway Configuration.

In the Platform Default section, select a Default Cluster from clusters registered in Gateway Manager.

Click Save.

Some considerations:

If the designated cluster is disconnected or becomes unavailable after you save, Gateway 5-dependent features become inaccessible and you must reconfigure this setting.

Configure integration settings

Feature-Specific Execution Defaults lets you choose a different gateway cluster for a specific feature, such as integrations, and configure additional settings for it. These settings apply to all integrations by default. Individual integrations can override the cluster and proxy settings configured here. For more information, see Manage integrations.

Override the cluster for integration

By default, integrations use the Platform default cluster. To route integrations through a different cluster:

Under Integrations, select a cluster from the Default cluster dropdown.

Click Save. Integrations use this cluster instead of the Platform default.

Select a default execution mode

The Default Execution Mode setting controls how integration requests are routed. Each integration can override this setting from its own configuration page.

Select an execution mode

Under Integrations, select one of the following from the Default Execution Mode dropdown:

Execution mode	Description
Direct connection	Requests are executed from Platform without a cluster or proxy server. Use this for internal services that don’t require gateway routing.
Default cluster, no proxy	Requests are executed from the feature-level default cluster without a proxy server. Use this when gateway execution is required but your network doesn’t use a proxy.
Default cluster with proxy	Requests are executed from the feature-level default cluster and an outbound proxy server. Selecting this mode reveals proxy configuration fields.

Configure proxy settings (Default cluster with proxy only)

If you selected Default cluster with proxy, configure the following fields:

Platform supports HTTPS proxies only.

Field	Description
Hostname or IP address	The hostname or IP address of the proxy server.
Port	The port used to connect to the proxy server.
Proxy authentication type	The authentication method for the proxy server. Options: No authentication, Basic authentication, or Secrets manager.

For Proxy authentication type, configure one of the following:

Basic authentication: Enter a username and password.
Secrets manager: Enter the keys used to look up the proxy credentials. Platform retrieves the credentials at runtime. For supported systems and setup, see Secrets management overview.

Save

Click Save. Changes take effect immediately, without a Platform restart.

Restrict runCode task execution to designated clusters

Platform 6.6.0+

The Run Code Task section under Feature-Specific Execution Defaults lets you restrict runCode task execution to one or more approved gateway clusters. Use this to keep Python code execution off clusters with competing workloads or security risk.

This setting is a restriction, not a default. Unlike the Integrations override pattern, no one can select a cluster outside the approved set once you configure this setting—every runCode task must use an approved cluster. There’s no separate toggle: selecting a Default Cluster activates the restriction immediately.

To restrict runCode task execution:

In Admin Essentials, go to Gateway Configuration.

Under Feature-Specific Execution Defaults, expand Run Code Task.

Select a Default Cluster from clusters registered in Gateway Manager. Platform uses this cluster automatically for new runCode tasks, but not for existing tasks whose assigned cluster is no longer approved—those require manual correction. See Effect on runCode task configuration and Find workflows that use a gateway cluster.

Optional: Click + Add Cluster to designate additional Allowed Cluster entries. Any cluster in the combined list of the Default Cluster and Allowed Clusters is available for runCode tasks.

Click Save Changes.

Effect on runCode task configuration

Once a restriction is active, the cluster field on a runCode task remains a dropdown, but the list of options is limited to the approved clusters—even if you approve only one cluster, the field still shows as a dropdown, filtered to that single option.

The field also displays the following note:

Your administrator has restricted Run Code Task execution to designated cluster(s).

For the runCode task configuration experience, see Cluster restrictions in the runCode task reference.

Find workflows that use a gateway cluster

Before you remove a cluster from the approved list, check whether any runCode tasks still target it, so you can update those workflows ahead of time instead of waiting for them to fail at run time.

In Gateway Manager, go to Gateways and open the cluster you’re planning to remove.

Select the Workflows tab. This lists every workflow with a task that targets the cluster.

Filter the Task column for runCode to narrow the list to Run Code tasks.

Update any listed workflow to use an approved cluster before you remove this cluster from the approved list.

Once you remove the cluster and repeat this check, no workflows should appear for runCode in the filtered list.