Kong/kongctl v1.27.0

on GitHub

kongctl Release Highlights

This release introduces Kong Identity administration — a comprehensive declarative configuration system for managing identity resources in Kong Konnect. It also brings environment-derived namespaces, a breaking removal of AI Cost Management, declarative engine fixes, improved documentation structure, and dependency updates.

⚠️ Breaking Changes

• AI Cost Management support removed — The ai-cost-management namespace, get/list ... tag-capture commands, and the ai_cost_management_tags declarative collection were mistakenly exposed in v1.23.0 and have been removed. Existing manifests or dump selectors referencing these resources will fail validation; saved plans targeting them will fail compatibility checks before any changes execute. (#2687)

✨ What's New

• Kong Identity administration — Manage identity resources entirely through declarative configuration: directories, principals, identity variants (including Gateway consumer linking), groups, memberships, auth servers, scopes, claims, OAuth clients, and Token Vault resources. Supports plan/diff/apply, saved plans, scoped sync/delete, dump/reload, adoption, external lookup, explain/scaffold, org-chart import, and secret-safe credential capture. (#2676)

  # Plan identity resource changes
  kongctl plan -f identity-manifest.yaml

  # Apply identity configuration
  kongctl apply -f identity-manifest.yaml

  # Import an organization chart
  kongctl import id org-chart --preview

• Environment-derived namespaces — Use !env tags in declarative manifests to resolve namespaces from environment variables at load time. Both scalar and mapping forms are supported, including extraction syntax. Namespaces are resolved before defaults, validation, and guardrails, and become concrete values in saved plans. (#2705)

  # In your manifest:
  #   namespace: !env KONNECT_NS
  # Then apply with different environments
  KONNECT_NS=production kongctl apply -f manifest.yaml

🐛 Fixes & Improvements

• Declarative model drift eliminated for AI Gateway datastores — Semantic models referencing a vectordb datastore now converge correctly after create and update. Previously, SDK decoding introduced inline connection defaults while Konnect expanded datastore settings, causing persistent drift. (#2713)
• Portal child read errors no longer block apply plans — Parent-only apply plans now skip undeclared children of managed portals, preventing unrelated 403 errors from blocking planning. (#2708)
• TUI theme compatibility preserved — Six renamed theme IDs from bubbletint v2.0.4 are accepted as silent aliases, and removed themes no longer block commands. (#2669)
• Lint engine errors now surface properly — Rule execution failures are reported instead of silently passing. (#2741)

📚 Docs & DX

• Declarative guide restructured — The 11,000-word monolithic guide has been replaced with a concise overview (~760 words) and thirteen focused topic pages, making it faster to find specific guidance. (#2729)
• Glamour v2 migration — TUI Markdown rendering upgraded to Glamour v2, preserving terminal background detection and non-terminal styling. (#2682)
• Konnect SDK updated to v0.83.0 — Includes Identity API support and AI Gateway datastore fixes. (#2724)

🔗 Commit References

Features

• 318f9d0 feat(konnect): add Kong Identity administration support (#2676)

Fixes

• 9c10a70 fix(lint): fail when rule execution encounters engine errors (#2741)
• f0964ea fix(deps): update all non-major dependencies with stable versions (#2742)
• 181f9fb fix(deps): update module charm.land/bubbletea/v2 to v2.1.1 (#2738)
• b75e1f5 fix(deps): update module golang.org/x/sync to v0.25.0 (#2739)
• 2882099 fix(deps): update dependency astro to v7.4.3 (#2740)

Other Changes

• a56d384 refactor(simplify): streamline auth strategy rendering and portal ID validation (#2730)
• 83d08fc task(docs): split declarative configuration guide by topic (#2729)
• 9537e52 test(e2e): expand publication, document, and execution report coverage (#2743)
• 58679d8 task(ci): upgrade gh-aw and simplify GitHub authentication (#2725)
• cd09000 ci(ksai): upgrade KSAI to v5.0.1 (#2728)
• e478b96 ci(ksai): upgrade KSAI to v5.0.2 (#2737)
• 1559480 chore(deps): update github/gh-aw-actions action to v1.2.1 (#2668)
• 96fa70b chore(deps): update node.js to v26 (#2734)
• 8692bbe chore(deps): update step-security/harden-runner action to v2.22.3 (#2733)

Full Changelog: v1.26.0...v1.27.0

Generated by Release · claude · opus46 · ~103 AIC · ⌖ ~29 AIC · ⊞ 3.3K