Kong/kongctl v1.2.0

on GitHub

kongctl Release Highlights

kongctl v1.2.0

This GitHub release covers the full change set from v1.0.0 through v1.2.0.
The v1.1.0 tag remains in version history, but v1.2.0 is the published build
for this release span.

What's New

Imperative Konnect token management (#1157)

kongctl can now create, list, get, and delete Konnect personal access tokens
and system account access tokens directly from the CLI.

kongctl create pat --name ci --expires-in 30d -o token
kongctl create spat --system-account-name ci-bot --name ci --expires-in 30d -o env
kongctl get pat
kongctl delete spat ci --system-account-name ci-bot --auto-approve

Token creation supports --expires-in and --expires-at, token-focused output
formats including token and env, JSON/YAML/text output, and --jq
selection. Get/list output intentionally avoids exposing one-time token values.

Fixes and Improvements

• Token expiration validation (#1176):
  PAT and SPAT creation now validates --expires-in and --expires-at
  against the supported 1 day through 365 day lifetime window.
• Control plane group delete ordering (#1169):
  Declarative deletes now detach recorded control plane group members before
  deleting the group, avoiding stale membership references.
• Namespace validation coverage (#1153):
  Namespace validation and namespace requirement enforcement now cover catalog
  services, dashboards, event gateway control planes, organization teams,
  organization users, and organization system accounts.
• Role entity references (#1143):
  Declarative role assignment refs now resolve by entity_type_name, including
  APIs, portals, and control planes, instead of assuming API refs.
• Security dependency updates
  (#1144,
  #1145,
  #1130,
  #1129):
  golang.org/x/crypto, golang.org/x/net, golang.org/x/text, and
  golang.org/x/term were updated.

Docs and DX

• Organization role assignment examples now show API and portal !ref usage,
  and system account assignment docs clarify selector-only behavior and the
  requirement that referenced accounts already exist
  (#1143,
  #1159).
• E2E coverage was expanded for analytics dashboards, DCR providers,
  organization teams, organization users, portal IdP team group mappings,
  external API implementation sync-delete, nested API version content, and
  control plane group deletes.
• CI and contributor diagnostics were improved with queued E2E workflow runs,
  benchmark regression scheduling, and E2E failure diagnosis helpers.

Commit References

Features

• 5b7649b Feat: add imperative Konnect token commands (#1157)

Fixes

• 32ff983 Fix: validate token expiration bounds (#1176)
• 3ab6122 Fix: control plane group member detach on delete (#1169)
• 7ea30b9 Fix: namespace validation coverage for declarative resources (#1153)
• c85cbd9 Fix: Support role entity refs by entity type (#1143)

Security and Dependencies

• 2bdcf3b chore(deps): update module golang.org/x/net to v0.55.0 [security] (#1145)
• ef6b74a chore(deps): update module golang.org/x/crypto to v0.52.0 [security] (#1144)
• 1e6b5d4 fix(deps): update module golang.org/x/term to v0.43.0 (#1129)
• f5373d5 fix(deps): update module golang.org/x/text to v0.37.0 (#1130)

Other Changes

• b67c5b6 test(e2e): add sync-delete coverage for external API implementation lifecycle (#1175)
• d42ef10 chore(deps): update step-security/harden-runner action to v2.19.3 (#1171)
• 37a1240 test(e2e): add dump scenario for analytics.dashboards (#1165)
• 7e96c30 ci: schedule benchmark regression analysis (#1168)
• ffd3413 Dev Feat: Adds CI diagnosis helpers (#1167)
• 3fa2e3f test(e2e): add dump scenario for dcr_provider declarative resource type (#1164)
• 428f475 Simplify: namespace validator and dependency slice declarations (#1166)
• 20557e9 test(e2e): add portal entity ref coverage to user and system-account role assignment scenarios (#1151)
• 62a83ff chore(deps): update github/gh-aw-actions action to v0.74.2 (#1160)
• 656c47f docs: clarify system account assignment examples (#1159)
• 9915cca chore(deps): update step-security/harden-runner action to v2.19.2 (#1158)
• d314681 chore(deps): update github/gh-aw-actions action to v0.74.1 (#1150)
• f803da1 test(e2e): add org user get/list scenario coverage for list, email filter, and ID lookup (#1141)
• 0d38a51 test(e2e): assert spec.content in single-version get for nested-child-lifecycle (#1136)
• 9f35c9d test(e2e): add dump scenario coverage for organization.teams round-trip (#1142)
• 1e3bf82 chore(deps): update github/gh-aw-actions action to v0.74.0 (#1147)
• 7f8946b test(e2e): extend portal IdP team group mapping scenario (#1096)
• 0b4ef31 test(e2e): globally queue e2e workflow runs (#1137)

Full Changelog: v1.0.0...v1.2.0