Kong/kongctl v1.28.1

on GitHub

kongctl Release Highlights

🐛 Fixes & Improvements

This patch release fixes two declarative workflow issues — one affecting AI Gateway OIDC credential hiding, and one correcting Event Gateway consume policy ordering — along with a security dependency update.

AI Gateway OIDC upstream token header is no longer auto-injected (#2766)

kongctl previously injected upstream_access_token_header: authorization:bearer into AI Gateway OIDC auth strategies even when the manifest omitted the field or set it to null. This defeated credential-hiding behavior (hide_credentials: true). The fix preserves the distinction between omitted, null, and explicit values.

Action required: If your upstreams rely on token forwarding, explicitly declare the header in your manifest:

config:
  upstream_access_token_header: authorization:bearer

Manifests produced by older kongctl dump may contain this field even when Konnect stored no header. Re-dump with the updated client or remove unintentionally injected fields. See release notes for details.

Event Gateway consume policy order is now reconciled (#2759)

YAML consume-policy ordering was lost during concurrent creation and was invisible to subsequent plan/diff runs. This fix:

• Observes the authoritative flattened policy chain from the API
• Serializes sibling creates to preserve declared order
• Schedules sibling-scoped moves after policy mutations
• Preserves ordering intent and dependencies in saved plans
• Keeps undeclared siblings after the declared prefix without deleting them

dump now exports policies in authoritative execution order with parent references that survive reload. See consume policy order docs for the full ordering model.

Security: golang.org/x/crypto updated to v0.59.0 (#2761)

Konnect SDK upgraded to v0.84.0 (#2760)

📚 Docs & DX

• Contributor guidelines now require explicit human approval for imperative write commands (#2763)
• Go extension example dependencies refreshed (#2769)

🔗 Commit References

Fixes

• 7f5ab66 fix(auth): preserve OIDC upstream access token header presence (#2766)
• 4d2e812 fix(declarative): reconcile Event Gateway consume policy order (#2759)
• aca1b38 fix(deps): refresh Go extension example dependencies (#2769)
• 49580bb fix(deps): update module github.com/kong/kongctl to v1.28.0 (#2762)

Other Changes

• 404fce5 chore(deps): update module golang.org/x/crypto to v0.59.0 [security] (#2761)
• 4278618 task(sdk): upgrade patched Konnect SDK to v0.84.0 (#2760)
• ae3f954 task(docs): require human approval for imperative write commands (#2763)
• bd87689 ci(ksai): upgrade KSAI to v5.0.3 (#2768)

Full Changelog: v1.28.0...v1.28.1

Generated by Release · claude · opus46 · ~70 AIC · ⌖ ~28 AIC · ⊞ 3.4K