Ad-hoc prerelease

• Source ref: mesh
• Source SHA: 18612b940ac326eb5de1757c95e6e77f11ad00f2
• Binary version: dev
• Stable channel: prerelease-mesh
• Expires at: 2026-12-13T15:53:58Z
• SDK mode: public

Validation

• VERSION=dev make build-ci
• go test -race -count=1 ./...
• GoReleaser snapshot cross-compile completed
• ZIP assets and checksums.txt generated

macOS signing

These arbitrary-ref preview builds are not Developer ID signed or Apple notarized.
Apple signing credentials are reserved for the trusted release workflow.

Install

Stable channel:

curl -fsSL https://raw.githubusercontent.com/Kong/kongctl/main/scripts/install.sh | sh -s -- --version prerelease-mesh

This immutable build:

curl -fsSL https://raw.githubusercontent.com/Kong/kongctl/main/scripts/install.sh | sh -s -- --version prerelease-mesh-20261014-1553-g18612b9

Ad-hoc prerelease

• Source ref: mesh
• Source SHA: 18612b940ac326eb5de1757c95e6e77f11ad00f2
• Binary version: dev
• Stable channel: prerelease-mesh
• Expires at: 2026-12-13T15:53:58Z
• SDK mode: public

Validation

• VERSION=dev make build-ci
• go test -race -count=1 ./...
• GoReleaser snapshot cross-compile completed
• ZIP assets and checksums.txt generated

macOS signing

These arbitrary-ref preview builds are not Developer ID signed or Apple notarized.
Apple signing credentials are reserved for the trusted release workflow.

Install

Stable channel:

curl -fsSL https://raw.githubusercontent.com/Kong/kongctl/main/scripts/install.sh | sh -s -- --version prerelease-mesh

This immutable build:

curl -fsSL https://raw.githubusercontent.com/Kong/kongctl/main/scripts/install.sh | sh -s -- --version prerelease-mesh-20261014-1553-g18612b9

Ad-hoc prerelease

• Source ref: gh-2469-federated-models
• Source SHA: 65c8d6978a9aa9cc7f3f55316df53a2ac1be2380
• Binary version: dev
• Stable channel: prerelease-aigw-federated-models
• Expires at: 2026-12-12T20:34:26Z
• SDK mode: public

Validation

• VERSION=dev make build-ci
• go test -race -count=1 ./...
• GoReleaser snapshot cross-compile completed
• ZIP assets and checksums.txt generated

macOS signing

These arbitrary-ref preview builds are not Developer ID signed or Apple notarized.
Apple signing credentials are reserved for the trusted release workflow.

Install

Stable channel:

curl -fsSL https://raw.githubusercontent.com/Kong/kongctl/main/scripts/install.sh | sh -s -- --version prerelease-aigw-federated-models

This immutable build:

curl -fsSL https://raw.githubusercontent.com/Kong/kongctl/main/scripts/install.sh | sh -s -- --version prerelease-gh-2469-federated-models-20261013-2034-g65c8d69

Ad-hoc prerelease

• Source ref: gh-2469-federated-models
• Source SHA: 65c8d6978a9aa9cc7f3f55316df53a2ac1be2380
• Binary version: dev
• Stable channel: prerelease-aigw-federated-models
• Expires at: 2026-12-12T20:34:26Z
• SDK mode: public

Validation

• VERSION=dev make build-ci
• go test -race -count=1 ./...
• GoReleaser snapshot cross-compile completed
• ZIP assets and checksums.txt generated

macOS signing

These arbitrary-ref preview builds are not Developer ID signed or Apple notarized.
Apple signing credentials are reserved for the trusted release workflow.

Install

Stable channel:

curl -fsSL https://raw.githubusercontent.com/Kong/kongctl/main/scripts/install.sh | sh -s -- --version prerelease-aigw-federated-models

This immutable build:

curl -fsSL https://raw.githubusercontent.com/Kong/kongctl/main/scripts/install.sh | sh -s -- --version prerelease-gh-2469-federated-models-20261013-2034-g65c8d69

kongctl Release Highlights

v1.20.2 is a patch release focused on declarative engine reliability and a major expansion of end-to-end test coverage.

🐛 Fixes & Improvements

• External team membership sync — kongctl apply now correctly synchronizes external team memberships, fixing cases where team membership changes could be skipped during declarative apply. (#2403)

• Event gateway update idempotency — Repeated apply runs against an unchanged event gateway configuration no longer produce spurious updates. (#2386)

• MCP source delete ordering — MCP source resources are now deleted after listener detachment, preventing dependency-order errors during teardown. (#2366)

• Dependency updates — Non-major dependency bumps across Go modules and site tooling for security and compatibility. (#2407, #2368)

✨ Internal Quality

This release includes significant code simplification across the declarative engine — listener policy config comparisons, reference/environment tag handling, sensitive field redaction, AI Gateway deletion dependencies, and planner/logging checks have all been streamlined. These refactors reduce maintenance surface and make future feature work easier, with no behavior changes for users.

🧪 Test Coverage

Over 20 new end-to-end scenarios were added, substantially expanding coverage for:

• Control plane groups, auth types, proxy URLs, and group member updates
• Listener policies (idempotency, destination ID references, dump round-trips)
• Schema registry, TLS trust bundles, and backend cluster configurations
• PAT/SPAT automation output formats and system account name resolution
• Team roles with control plane entity references
• Sync dry-run safety, diff text output, apply execution reports
• API region isolation, nested implementations, and DCR provider adoption

🔗 Commit References

Fixes

• 32b92d0 fix(declarative): sync external team memberships and add E2E coverage (#2403)
• 8fee417 fix(deps): update all non-major dependencies with stable versions (#2407)
• 8b375b7 fix(declarative): preserve event gateway update idempotency (#2386)
• 2655671 fix(declarative): order MCP source deletes after listener detachment (#2366)
• 27464f3 fix(deps): update module github.com/kong/kongctl to v1.20.1 (#2368)

Other Changes

• d35f2d9 refactor(simplify): remove redundant planner and logging checks (#2423)
• 02c5a23 refactor(declarative): simplify listener policy config comparisons (#2424)
• ecf0924 test(e2e): strengthen sync-groups checks and stabilize recovery coverage (#2421)
• 6bd8192 test(e2e): cover control plane groups dump round-trip idempotency (#2422)
• f480bcc test(e2e): cover nested text diffs across command modes (#2404)
• 3982cfa test(e2e): cover team role control plane entity references (#2402)
• 2773eaa chore(deps): update kong/ksai-public action to v3.105.1 (#2406)
• 17be80f test(e2e): verify TLS trust bundle idempotency and dump round-trip (#2401)
• 25941b5 test(e2e): add backend cluster complex auth and TLS dump round-trip (#2400)
• 34d321e test(e2e): cover SPAT system account name resolution (#2398)
• f95d93b chore(deps): update dependency jsdom to v30.1.1 (#2399)
• d8e5617 test(e2e): cover PAT and SPAT automation output formats (#2397)
• 99a9ed0 test(e2e): add listener policy idempotency and dump round-trips (#2392)
• efb3595 refactor(simplify): simplify sensitive key and MCP source checks (#2390)
• 92001a1 test(e2e): cover control plane group member updates via apply (#2393)
• bf4b222 test(e2e): cover control plane auth type and proxy URL updates (#2394)
• bc14ffa test(e2e): add schema registry idempotency and dump round-trip (#2391)
• e35cee9 test(e2e): cover apply execution report files (#2383)
• 0d66133 chore(deps): update github/gh-aw-actions action to v0.90.3 (#2387)
• 17cf69e test(e2e): cover diff text output and full content (#2384)
• 65c26fe test(e2e): cover listener policy destination ID references (#2385)
• 5391fa5 test(e2e): assert nested API implementations in dump output (#2382)
• 8eb1342 test(e2e): expand API region isolation and lifecycle coverage (#2381)
• 58965c0 test(e2e): verify sync dry-run safety with pending mutations (#2380)
• ef75ec1 test(e2e): cover DCR provider and dashboard adoption (#2377)
• f6382b9 refactor(simplify): simplify AI Gateway deletion dependencies (#2376)
• d0a574e refactor(declarative): simplify reference and environment tag handling (#2378)
• f7cfaf3 refactor(simplify): simplify declarative redaction and sensitive fields (#2379)
• 7d799ad chore(deps): update dependency @types/node to v24.13.6 (#2367)
• 06024c3 build(deps): bump devalue from 5.9.2 to 5.9.4 in /site (#2375)
• 1f9309c chore(deps): update zgosalvez/github-actions-ensure-sha-pinned-actions action to v5.0.9 (#2370)

Full Changelog: v1.20.1...v1.20.2> Generated by Release · opus46 · 68.2 AIC · ⌖ 29.7 AIC · ⊞ 4.4K

kongctl Release Highlights

This patch release fixes two declarative workflow defects in AI Gateway resource management and consolidates deletion ordering into a shared policy.

🐛 Fixes & Improvements

MCP server renames no longer delete before creating replacements — When a sync renamed an MCP server, the old server could be deleted before its replacement was created, breaking live routes. The planner now adds an explicit replacement-create dependency so saved plans order prerequisite creation → replacement creation → old server deletion → unused auth/policy cleanup. Failed replacement creation blocks deletion of the old server. (#2359, fixes #2356)

Auth strategy renames no longer cause foreign-key errors — Renaming an AI Gateway auth strategy during sync could delete the old strategy before its users (agents, models, MCP servers) detached, triggering a foreign-key error from the API. Deletion now waits for the relevant user updates or deletes to complete, and planning rejects deletion while retained or out-of-scope users still reference the strategy. Additionally, MCP servers now resolve auth-strategy references consistently with agents and models. (#2355, fixes #2354, #2338)

Shared observed-reference deletion ordering — AI Gateway target deletion (providers, policies, custom policies, auth strategies) now uses a unified policy: every current user must be deleted or demonstrably detached before its target can be removed, and conflicting planned references reject the plan at planning time rather than failing at execution. (#2358, closes #2357)

🔗 Commit References

Fixes

• 3432e37 fix(declarative): create MCP replacements before deleting old servers (#2359)
• f27de77 fix(declarative): handle AI Gateway auth strategy renames and references (#2355)
• 6762841 fix(deps): update module github.com/kong/kongctl to v1.20.0 (#2360)

Other Changes

• 4cc4c44 refactor(declarative): share AI Gateway observed-reference deletion ordering (#2358)

Full Changelog: v1.20.0...v1.20.1> Generated by Release · opus46 · 63.7 AIC · ⌖ 28.4 AIC · ⊞ 4.4K

kongctl Release Highlights

✨ What's New

AI Gateway 2.2 support — kongctl now fully manages AI Gateway 2.2 resources using the public Konnect SDK. (#2321)

• Custom policies — Declarative lifecycle for installed and streaming policy definitions and instances, including plan/apply/sync, dump, explain, get/list, and interactive child navigation. Definitions are created before instances and deletion is blocked while references exist.
• New model capabilities — Passthrough formats, skills, multiple selector values, and Typesafe/Jev provider and target configuration.
• Decisions support — Manage decision resources declaratively with alias replacement.
• Gateway root updates — PUT operations now preserve unchanged writable fields (proxy URLs, descriptions, runtime settings, user labels), with regression coverage for zero-change replans.

🐛 Fixes & Improvements

Vault default drift eliminated — Omitted AWS and HashiCorp Vault config fields (e.g., assume_role_arn, namespace, sts_endpoint_url) no longer produce perpetual plan drift. Konnect returns empty defaults for these fields; kongctl now normalizes them during comparison so plan and diff stay clean when nothing actually changed. (#2345)

Consistent value formatting — Diffs, summaries, and execution reports now apply the same display rules to nested values and saved plans. Previously, the same value could render differently depending on where it appeared. (#2346)

🔗 Commit References

Features

• b44d090 feat(konnect): support AI Gateway 2.2 features (#2321)

Fixes

• 902b4ac fix(declarative): normalize omitted AWS and HCV vault defaults (#2345)
• 57f6437 fix(declarative): align configuration value formatting (#2346)
• 2861811 fix(deps): update module github.com/kong/kongctl to v1.19.0 (#2348)

Other Changes

• 5534a82 task(skills): bundle PR planning and deployment for AI Gateway (#2351)
• 4618557 chore(deps): update dependency prettier to v3.9.8 (#2349)
• 4f9700d chore(deps): update dependency prettier-plugin-astro to v1.0.1 (#2342)
• 6891388 chore(deps): update dependency goreleaser/goreleaser to v2.18.2 (#2347)
• 15fb563 chore(deps): update dependency jsdom to v30.1.0 (#2341)

Full Changelog: v1.19.0...v1.20.0> Generated by Release · opus46 · 69.7 AIC · ⌖ 28.5 AIC · ⊞ 4.4K

kongctl Release Highlights

✨ What's New

Native AI Gateway deployment skill (#2150)

A new kongctl-ai-gateway skill is now bundled with kongctl install skills, giving you a guided path from declarative configuration to a working AI Gateway deployment. The skill includes:

• A local OpenAI-compatible manifest and data-plane helper
• macOS certificate generation and container/port preflight checks
• A minimal GitHub Actions workflow for CI-driven deployment with operator approval

kongctl install skills
# The new kongctl-ai-gateway skill is now available

Typed stored environment values in declarative config (#2312)

Environment values tagged with store: true are now resolved at load time and baked into saved plans as concrete, typed values. This means your plans stay stable even if the source environment variable changes or disappears after planning.

# Boolean resolved at plan time — the saved plan captures `true`, not a reference
auto_approve_developers: !env {var: ENABLED, store: true}

Type inference works automatically for unambiguous SDK fields (booleans, integers, etc.). For ambiguous cases, specify type: explicitly. Closes #1772.

🐛 Fixes & Improvements

• Resolve external control plane name for decK (#2323) — Fixed a bug where external control plane names were not correctly resolved when used with decK integration. Thanks to @jeffreyh-zillow for this contribution!
• Disable Apple signing for adhoc prereleases (#2336) — Prerelease builds no longer attempt macOS code signing, avoiding failures in ad-hoc release workflows.
• Dependency updates: undici 8.9.0 → 8.11.2 (#2339), astro → v7.3.3 (#2340), internal module bump (#2337).

🙏 Community

Thank you to @jeffreyh-zillow for contributing the decK control plane name fix!

🔗 Commit References

Features

• 630c1b6 feat(skills): add native AI Gateway deployment skill (#2150)
• 296385b feat(declarative): support typed stored environment values (#2312)

Fixes

• 24b1719 fix(deps): update dependency astro to v7.3.3 (#2340)
• e97af95 fix(deps): update module github.com/kong/kongctl to v1.18.0 (#2337)
• 073a743 fix(ci): disable Apple signing for adhoc prereleases (#2336)
• 53c07c9 fix(declarative): resolve external control plane name for deck (#2323)

Other Changes

• 2406526 build(deps): bump undici from 8.9.0 to 8.11.2 in /site (#2339)

Full Changelog: v1.18.0...v1.19.0> Generated by Release · opus46 · 98.1 AIC · ⌖ 28.2 AIC · ⊞ 4.4K

kongctl Release Highlights

✨ What's New

Resolve references and lookups in arbitrary payload values (#2309)

Declarative !ref, !lookup, and !external expressions now resolve inside nested maps, lists, and SDK structures — not just top-level fields. This means an AI Gateway policy can reference a gateway's ID with !ref and have it resolved in a single kongctl apply, eliminating the need for multi-pass workflows.

Highlights:

• !lookup and !external support explicit resource_type and scoped parent lookups for children of remote parents.
• Forward references within the same apply are deferred and resolved after creation, so a policy can reference a gateway declared in the same file.
• Plan format bumped to 1.1 (older executors will reject plans with deferred bindings; format 1.0 plans are still accepted).
• Unresolved expressions in mutation payloads are now caught and rejected before reaching Konnect.

# AI Gateway policy referencing a gateway declared in the same file
kongctl plan -f ai-gateway.yaml -o plan.json
kongctl apply --plan plan.json

🐛 Fixes & Improvements

Fix external control plane name resolution for decK (#2323)
A control_plane with both _external and _deck blocks failed to plan because decK received the declarative ref instead of the actual Konnect control plane name. The name lookup fallback chain now works correctly for external resources.

Fix Event Gateway child pruning order (#2319)
When sync pruned an Event Gateway backend cluster and its virtual clusters, both DELETE operations ran in the same execution group. Backend cascade could remove the virtual cluster first, causing the explicit virtual-cluster DELETE to fail with HTTP 404. Deletions are now dependency-ordered: virtual clusters delete before their backend.

Eliminate perpetual drift on AI Gateway vault defaults (#2318)
Omitting optional vault configuration fields (e.g., base64_decode, endpoint_url, sts_endpoint_url) no longer produces a diff on every plan. Konnect-returned defaults are now normalized during comparison while explicit overrides and request payloads remain unchanged.

Dependency updates

• OpenAPI linter (vacuum) updated to v0.30.6, picking up upstream fixes (#2320, #2325, #2330)

🙏 Community

Thanks to @jeffreyh-zillow for contributing the external control plane name resolution fix (#2323)!

🔗 Commit References

Features

• 6739fc8 feat(declarative): resolve refs and lookups in arbitrary payload values (#2309)

Fixes

• 53c07c9 fix(declarative): resolve external control plane name for deck (#2323)
• c69085b fix(deps): update module github.com/daveshanley/vacuum to v0.30.6 (#2330)
• 2a18e4c fix(deps): update module github.com/daveshanley/vacuum to v0.30.5 (#2325)
• c77ea77 fix(deps): update module github.com/daveshanley/vacuum to v0.30.4 (#2320)
• 44e602d fix(declarative): order Event Gateway child pruning (#2319)
• 56bd27d fix(declarative): normalize omitted AI Gateway vault defaults (#2318)
• b2649ab fix(deps): update module github.com/kong/kongctl to v1.17.1 (#2315)

Other Changes

• 33c86d6 chore(deps): update docker/setup-buildx-action action to v4.4.1 (#2335)
• 7028521 chore(deps): update dependency prettier to v3.9.7 (#2334)
• dbe897a chore(deps): update docker/build-push-action action to v7.4.0 (#2329)
• ce83944 chore(deps): update docker/setup-qemu-action action to v4.4.0 (#2332)
• 22b754b chore(deps): update docker/setup-buildx-action action to v4.4.0 (#2331)
• 453f2ed chore(deps): update all non-major dependencies with stable versions (#2328)
• 26f7e27 chore(deps): update github/gh-aw-actions action to v0.89.22 (#2327)
• cc4fe02 chore(deps): update github/gh-aw-actions action to v0.89.21 (#2324)
• 1044f67 test(smoke): expand installed-binary lifecycle coverage (#2311)

Full Changelog: v1.17.1...v1.18.0> Generated by Release · opus46 · 78.4 AIC · ⌖ 29.3 AIC · ⊞ 4.4K

Ad-hoc prerelease

• Source ref: aigw-2-2
• Source SHA: df49bbe40b912e283d1a595d0c112569f64b9311
• Binary version: dev
• Stable channel: prerelease-aigw-2-2
• Expires at: 2026-11-27T20:13:04Z
• SDK mode: internal
• Internal SDK version: v0.5.1-0.20260925165819-ae595d8c3fce
• Internal SDK commit: ae595d8c3fcea65864b67cfc76abe8970b2751fe

Validation

• VERSION=dev make build-ci
• go test -race -count=1 ./...
• GoReleaser snapshot cross-compile completed
• ZIP assets and checksums.txt generated

macOS signing

These arbitrary-ref preview builds are not Developer ID signed or Apple notarized.
Apple signing credentials are reserved for the trusted release workflow.

Install

Stable channel:

curl -fsSL https://raw.githubusercontent.com/Kong/kongctl/main/scripts/install.sh | sh -s -- --version prerelease-aigw-2-2

This immutable build:

curl -fsSL https://raw.githubusercontent.com/Kong/kongctl/main/scripts/install.sh | sh -s -- --version prerelease-aigw-2-2_1