Kong/kongctl v1.18.0 on GitHub

kongctl Release Highlights

✨ What's New

Resolve references and lookups in arbitrary payload values (#2309)

Declarative !ref, !lookup, and !external expressions now resolve inside nested maps, lists, and SDK structures — not just top-level fields. This means an AI Gateway policy can reference a gateway's ID with !ref and have it resolved in a single kongctl apply, eliminating the need for multi-pass workflows.

Highlights:

!lookup and !external support explicit resource_type and scoped parent lookups for children of remote parents.
Forward references within the same apply are deferred and resolved after creation, so a policy can reference a gateway declared in the same file.
Plan format bumped to 1.1 (older executors will reject plans with deferred bindings; format 1.0 plans are still accepted).
Unresolved expressions in mutation payloads are now caught and rejected before reaching Konnect.

# AI Gateway policy referencing a gateway declared in the same file
kongctl plan -f ai-gateway.yaml -o plan.json
kongctl apply --plan plan.json

🐛 Fixes & Improvements

Fix external control plane name resolution for decK (#2323)
A control_plane with both _external and _deck blocks failed to plan because decK received the declarative ref instead of the actual Konnect control plane name. The name lookup fallback chain now works correctly for external resources.

Fix Event Gateway child pruning order (#2319)
When sync pruned an Event Gateway backend cluster and its virtual clusters, both DELETE operations ran in the same execution group. Backend cascade could remove the virtual cluster first, causing the explicit virtual-cluster DELETE to fail with HTTP 404. Deletions are now dependency-ordered: virtual clusters delete before their backend.

Eliminate perpetual drift on AI Gateway vault defaults (#2318)
Omitting optional vault configuration fields (e.g., base64_decode, endpoint_url, sts_endpoint_url) no longer produces a diff on every plan. Konnect-returned defaults are now normalized during comparison while explicit overrides and request payloads remain unchanged.

Dependency updates

OpenAPI linter (vacuum) updated to v0.30.6, picking up upstream fixes (#2320, #2325, #2330)

🙏 Community

Thanks to @jeffreyh-zillow for contributing the external control plane name resolution fix (#2323)!

🔗 Commit References

Features

6739fc8 feat(declarative): resolve refs and lookups in arbitrary payload values (#2309)

Fixes

53c07c9 fix(declarative): resolve external control plane name for deck (#2323)
c69085b fix(deps): update module github.com/daveshanley/vacuum to v0.30.6 (#2330)
2a18e4c fix(deps): update module github.com/daveshanley/vacuum to v0.30.5 (#2325)
c77ea77 fix(deps): update module github.com/daveshanley/vacuum to v0.30.4 (#2320)
44e602d fix(declarative): order Event Gateway child pruning (#2319)
56bd27d fix(declarative): normalize omitted AI Gateway vault defaults (#2318)
b2649ab fix(deps): update module github.com/kong/kongctl to v1.17.1 (#2315)

Other Changes

33c86d6 chore(deps): update docker/setup-buildx-action action to v4.4.1 (#2335)
7028521 chore(deps): update dependency prettier to v3.9.7 (#2334)
dbe897a chore(deps): update docker/build-push-action action to v7.4.0 (#2329)
ce83944 chore(deps): update docker/setup-qemu-action action to v4.4.0 (#2332)
22b754b chore(deps): update docker/setup-buildx-action action to v4.4.0 (#2331)
453f2ed chore(deps): update all non-major dependencies with stable versions (#2328)
26f7e27 chore(deps): update github/gh-aw-actions action to v0.89.22 (#2327)
cc4fe02 chore(deps): update github/gh-aw-actions action to v0.89.21 (#2324)
1044f67 test(smoke): expand installed-binary lifecycle coverage (#2311)

Full Changelog: v1.17.1...v1.18.0> Generated by Release · opus46 · 78.4 AIC · ⌖ 29.3 AIC · ⊞ 4.4K