Kong/kongctl v1.23.0

on GitHub

kongctl Release Highlights

Version note: v1.22.0 was not published because its release build failed. v1.23.0 includes all changes since v1.21.0, plus the release signing fix.

✨ What's New

AI Gateway 2.3 configuration support — kongctl adds configuration support for AI Gateway 2.3, including datastore-backed Token Vault credentials, new model and MCP server configuration, policy types, and outbound TLS settings. Declarative loading, planning, execution, and dump all preserve these new resource shapes. (#2624)

Federated ownership of AI Gateway children — Multiple teams can now manage children of a shared AI Gateway from separate declarative sources and namespaces without claiming the gateway or each other's children. This release ships federated ownership for 12 independently owned child families. Runtime certificate federation remains deferred; config stores, their secrets, and data plane certificates are excluded. (#2629)

Using ownership with existing resources — An existing child must belong to the intended kongctl namespace before kongctl can manage it. Unowned children require explicit adoption through the API. Transfer is needed only when changing an existing ownership assignment. New children receive ownership metadata when created. See the ownership setup guidance for details.

Event Gateway 1.3 policies — Declarative support for the Event Gateway 1.3 policy model, including the new union variants for request rule validation, mask-fields produce, and transcode consume policies. (#2620)

List organization PATs — A new kongctl get org pats command lists all Personal Access Tokens for the current organization, with text, JSON, and YAML output. Global-only API families are now correctly routed to the global host instead of the regional endpoint. (#2644)

🐛 Fixes & Improvements

• AI Gateway child ownership metadata — managed_by is reserved for Kong tools. This release fixes a validation bug that previously allowed managed_by field in declarative input. Configurations relying on that invalid input now fail validation: remove direct managed_by fields and use labels for user metadata. Regenerate saved plans that relied on the previous erroneous behavior. (#2629)
• !ref parent selectors for root-level children — Portal and API children using !ref on their parent selector were silently omitted from plans. In sync mode this could cause a declared live portal page to be scheduled for deletion. (#2639)
• Organization role error clarity — When a team role assignment fails, kongctl now identifies the manifest resource ref, the attempted role_name, and entity_type_name instead of reporting [unknown]. (#2641)
• Event Gateway dump round trips — Dumps now serialize virtual cluster destinations using the backend name instead of the backend ID, so recreating a gateway from a dump no longer leaves destinations pointing at deleted backends. (#2649)
• Conditional AI Gateway ACLs — Declarative support for conditional ACL rules on AI Gateways. (#2596)
• Organization child tables — Restored missing child tables in org views. (#2587)
• Create help text — Corrected examples and descriptions in kongctl create help output. (#2572)
• Security dependency update — Updated golang.org/x/net to v0.62.0 to address a security advisory. (#2625)

📚 Docs & DX

• Documented Spectral compatibility limits for OpenAPI linting. (#2582)
• Konnect SDK updated to public v0.79.0 with compatibility patches. (#2624)

🔗 Commit References

Features

• 3b822db feat(konnect): add AI Gateway 2.3 configuration support (#2624)
• b74ed13 feat(declarative): support federated ownership of AI Gateway children (#2629)
• a975ad5 feat(declarative): support Event Gateway 1.3 policies (#2620)

Fixes

• bf7c654 fix(declarative): honor !ref parent selectors for root-level children (#2639)
• 70cd2c4 fix(declarative): preserve refs and clarify organization role errors (#2641)
• c08a6e1 fix(konnect): route global APIs and list organization PATs (#2644)
• 29a3f0e fix(declarative): preserve Event Gateway destinations in dump round trips (#2649)
• 713bb80 fix(declarative): support conditional AI Gateway ACLs (#2596)
• 5439637 fix(cmd): restore org child tables and expand e2e coverage (#2587)
• 2039504 fix(cmd): correct create help examples and descriptions (#2572)
• 11d0349 fix(lint): document Spectral compatibility limits (#2582)
• e3e332e chore(deps): update module golang.org/x/net to v0.62.0 [security] (#2625)

Other Changes

• 698073c Fix: release signing fix
• 10bf1ff test(e2e): expand Event Gateway policy lifecycle coverage (#2650)
• 317af6c refactor(simplify): consolidate gateway and portal helpers (#2648)
• 29d0866 test(e2e): expand Event Gateway v1.3 diff assertions (#2651)
• 05af4ae test(e2e): cover policy chains on external Event Gateways (#2652)
• 146df32 task(sdk): update patched Konnect SDK to v0.77.0 (#2637)
• c724f75 task(deps): update golangci-lint to v2.15.0 (#2632)
• 1248cc6 fix(deps): update all non-major dependencies with stable versions (#2621)
• 0652217 task(sdk): update patched Konnect SDK to v0.76.0 (#2618)
• 9068505 chore(deps): update dependency node to v26 (#2626)
• 7861db8 refactor(simplify): share declarative membership and field comparison helpers (#2574)
• 9604f6e test(e2e): expand sync cleanup and portal security coverage (#2565)
• 3cb481c test(e2e): expand membership, Kafka, and API child coverage (#2573)
• 487aaa6 test(e2e): cover team role lookup by ID (#2609)
• e83c83f task(ci): isolate release builds from signing and publishing credentials (#2566)
• f82bd17 fix(deps): update module github.com/kong/kongctl to v1.21.0 (#2567)
• 19b8cbb chore(deps): update dependency jsdom to v30.1.3 (#2615)
• b50e101 chore(deps): update dependency @playwright/test to v1.64.1 (#2608)
• fdded07 build(deps-dev): bump fast-uri from 3.1.7 to 3.1.9 in /site (#2602)
• a7cd452 chore(deps): update node.js to v24.22.0 (#2606)
• 7096c69 chore(deps): update gh-aw toolchain to v0.93.5 (#2605)
• 879f28d build(deps): bump zod from 4.6.5 to 4.6.7 in /site (#2603)
• 087c7be build(deps): bump undici from 8.11.2 to 8.12.3 in /site (#2601)
• be69077 chore(deps): update gh-aw toolchain to v0.93.3 (#2598)
• 3f46943 chore(deps): update goreleaser/goreleaser-action action to v7.3.0 (#2600)
• ace0596 chore(deps): update dependency vitest to v5.0.4 (#2599)
• 4eb3fb7 chore(deps): update dependency goreleaser/goreleaser to v2.18.3 (#2575)
• 56258a2 chore(deps): update goreleaser/goreleaser-action action to v7 (#2576)
• 9bfc9c9 chore(deps): update all non-major dependencies with stable versions (#2564)

Full Changelog: v1.21.0...v1.23.0> Generated by Release · opus46 · 161.4 AIC · ⌖ 30.9 AIC · ⊞ 4.4K