github Kong/kongctl v1.21.0
on GitHub

16 hours ago

Kong logo Kong logo kongctl Release Highlights

✨ What's New

Native Kong Mesh support (#2425) — kongctl now ships first-class commands for Kong Mesh. Discover control planes, browse resource types, read and write Mesh configuration, export entire control planes, generate zone/dataplane tokens, and inspect computed policies — all from the same CLI you already use for Konnect. 

# Discover Mesh control planes
kongctl get mesh control-planes

# Apply Mesh resources directly
kongctl apply mesh -f mesh-timeout.yaml

# Export a full control plane as YAML
kongctl dump mesh --export-profile migration

# Inspect computed policy relationships
kongctl inspect mesh ...

Hosted and self-managed targets use the same commands. Mesh resource operations use direct upserts rather than the declarative planner, with partial-failure reporting and support for text, JSON, and YAML output.

🐛 Fixes & Improvements

Declarative sync reliability — Six fixes strengthen the declarative engine for complex, multi-team environments:

  • Preserve mixed API documents during sync (#2537) — Sync no longer drops API documents when a mix of managed and unmanaged documents exists.
  • Preserve team memberships during sync (#2538) — Lookup-selected team memberships are retained instead of being pruned.
  • Honor protection labels (#2489) — Canonical protection labels are now respected during execution, preventing unintended modifications to protected resources.
  • Reconcile API versions with ACE enabled (#2512) — API version reconciliation now works correctly when ACE (API Compliance Engine) is active.
  • Preserve namespace defaults for external sources (#2503) — Namespace defaults are no longer lost when the source is external-only.
  • Reject duplicate resource registrations (#2523) — Duplicate resource definitions in manifests now produce a clear error instead of silent, unpredictable behavior.

Build & runtime — Go updated to 1.26.10 (#2558), Alpine base image refreshed with the runtime CA bundle (#2559), and Konnect SDK upgraded to v0.73.1 (#2493).

Security dependencies — kin-openapi updated to v0.149.0 (#2505) and golang.org/x/net to v0.60.0 (#2462) to address known vulnerabilities.

Declarative engine internals — 20+ refactors centralize field projections, lifecycle decisions, and reconciliation logic across APIs, Portals, Event Gateways, dashboards, control planes, and organization teams. These changes reduce code duplication and improve consistency without changing user-facing behavior.

🔗 Commit References

Features

  • e7c1d8c feat(mesh): integrate core commands, export, and inspection (#2425)

Fixes

  • 9d0b62b fix(declarative): honor canonical protection labels during execution (#2489)
  • fac4535 fix(declarative): preserve namespace defaults for external-only sources (#2503)
  • 13d995e fix(declarative): reconcile API versions with ACE enabled (#2512)
  • 5a24788 fix(declarative): reject duplicate resource registrations (#2523)
  • d082b43 fix(declarative): preserve mixed API documents during sync (#2537)
  • 05ab542 fix(declarative): preserve lookup-selected team memberships during sync (#2538)
  • f1f3b54 fix(build): update Go declarations to 1.26.10 (#2558)
  • 0791415 fix(build): refresh Alpine and install the runtime CA bundle (#2559)
  • a8cfd48 fix(ci): refresh packages during manual container publishing (#2560)
  • 1ed9863 fix(deps): update module github.com/kong/kongctl to v1.20.2 (#2427)
  • 642b4eb fix(deps): update dependency astro to v7.3.5 (#2428)
  • 737440f fix(deps): update module charm.land/bubbletea/v2 to v2.0.10 (#2429)
  • 8ed958c fix(deps): update module golang.org/x/sync to v0.24.0 (#2457)
  • a48b847 fix(deps): update dependency astro to v7.3.6 (#2528)
  • 3359967 fix(deps): update module golang.org/x/sys to v0.49.0 (#2529)
  • 8da9d01 fix(deps): update module github.com/mattn/go-runewidth to v0.0.31 (#2544)
  • 52626aa fix(deps): update all non-major dependencies with stable versions (#2546)
  • 3b048bd fix(deps): update all non-major dependencies with stable versions (#2552)
  • 6815b62 fix(deps): update module charm.land/bubbletea/v2 to v2.1.0 (#2555)
  • 47f00ab fix(deps): update module golang.org/x/term to v0.47.0 (#2562)
  • 0438b1e fix(deps): update module golang.org/x/text to v0.43.0 (#2563)

Other Changes

  • 0da12c3 refactor(declarative): share API root lifecycle decisions (#2444)
  • 4647315 refactor(declarative): share Event Gateway root lifecycle decisions (#2445)
  • 8d2029f refactor(declarative): register ordered reference validation (#2446)
  • d3dc186 refactor(declarative): share catalog-service root lifecycle decisions (#2452)
  • de64df2 refactor(declarative): share dashboard root lifecycle decisions (#2453)
  • c4be878 refactor(declarative): share organization-team root lifecycle decisions (#2464)
  • 86ae061 refactor(declarative): centralize role-assignment reconciliation (#2465)
  • 9fbda10 refactor(declarative): share Portal boolean field contracts across stages (#2470)
  • 6afa667 refactor(declarative): share Portal string field contracts across stages (#2472)
  • 0485b8f refactor(declarative): consolidate Portal field projections and visibility contracts (#2476)
  • ac06f63 refactor(declarative): retire legacy Portal and API executor operations (#2490)
  • 0a150a9 refactor(declarative): remove unused child and auth executor implementations (#2499)
  • d2edfe3 refactor(declarative): simplify protection checks and dashboard creation (#2500)
  • 86ae451 refactor(declarative): centralize API field projections (#2501)
  • a889a52 refactor(declarative): centralize control-plane field projections (#2509)
  • 82bd650 refactor(declarative): centralize DCR config field policy (#2511)
  • e6f0be2 refactor(declarative): centralize application auth config projections (#2513)
  • 7cb1580 refactor(declarative): share organization team membership reconciliation (#2514)
  • 9c93da6 refactor(declarative): separate indexed reconciliation from identity binding (#2520)
  • 2b4dc55 refactor(declarative): share API child parent resolution (#2524)
  • fbe3122 refactor(declarative): centralize API child planning dispatch (#2535)
  • 280385d refactor(simplify): merge duplicate API lookups in extracted-child planner (#2553)
  • dc9cdae refactor(declarative): simplify listener helpers and team ID scoping (#2433)
  • a2b95e8 refactor(declarative): simplify listener policy field handling (#2442)
  • 5564cc5 task(sdk): upgrade to patched sdk-konnect-go v0.73.1 (#2493)
  • 9053922 task(ci): use GitHub token for ad-hoc prereleases (#2547)
  • abff90f task(ci): use GitHub token for prerelease cleanup (#2542)
  • 8dbabb5 test(e2e): cover port-mapping listener policy dump round-trip (#2443)
  • 9fdba15 test(e2e): cover org team role execution and apply convergence (#2522)
  • 3634163 test(e2e): verify portal custom domains through direct readback (#2548)
  • 2de19e3 chore: update Go version to 1.26.9 (#2475)
  • b5c3fa6 build(deps): bump sharp from 0.35.4 to 0.35.5 in /site (#2431)
  • f8a8d9f build(deps): bump smol-toml from 1.8.0 to 1.9.0 in /site (#2432)
  • e18bfe8 build(deps): bump source-map-js from 1.2.1 to 1.2.2 in /site (#2430)
  • 0508313 chore(deps): update all non-major dependencies with stable versions (#2438)
  • 730da75 chore(deps): update golangci-lint to v2.14.0 (#2434)
  • 8b099fe chore(deps): update dependency @types/node to v24.19.0 (#2447)
  • ee12167 ci(ksai): bump KSAI to v3.135.6 (#2456)
  • cd6e905 ci(ksai): start a KSAI run only for people who can write to the repository (#2450)
  • 9e00c42 chore(deps): update github/gh-aw-actions action to v0.91.7 (#2458)
  • ab2eb61 chore(deps): update dependency vitest to v5.0.3 (#2463)
  • abfac7c chore(deps): update module golang.org/x/net to v0.60.0 [security] (#2462)
  • 9dfa682 chore(deps): update dependency @types/node to v24.19.1 (#2473)
  • 4a7b632 chore(deps): update module github.com/getkin/kin-openapi to v0.149.0 [security] (#2505)
  • 7fe7af3 chore(deps): update zgosalvez/github-actions-ensure-sha-pinned-actions action to v5.0.10 (#2498)
  • dbb6d15 chore(deps): update dependency jsdom to v30.1.2 (#2508)
  • 6d3f415 chore(deps): update gh-aw toolchain (#2515)
  • 4691b4f chore(deps): update step-security/harden-runner action to v2.22.0 (#2527)
  • c4e0882 chore(deps): update actions/download-artifact action to v8.0.2 (#2532)
  • e65466c chore(deps): update actions/upload-artifact action to v7.0.2 (#2533)
  • fade37f chore(deps): update step-security/harden-runner action to v2.22.1 (#2543)
  • 78c8433 chore(deps): update actions/setup-node action to v7.1.0 (#2545)
  • f640506 chore(deps): update dependency macos to v26 (#2550)
  • 721ca66 chore(deps): update dependency ubuntu to v26 (#2551)
  • f617eea chore(deps): update dependency goreleaser/goreleaser to v2.18.3 (#2557)

Full Changelog: v1.20.2...v1.21.0> Generated by Release · opus46 · 143.5 AIC · ⌖ 31.7 AIC · ⊞ 4.4K

Check out latest releases or
releases around Kong/kongctl v1.21.0

Don't miss a new kongctl release

NewReleases is sending notifications on new releases.

Get notifications