Control Plane Groups

A Control Plane Group is a read-only Control Plane that combines configuration from its members, which are standard Control Planes. All of the standard Control Planes within a Control Plane Group share the same cluster of Data Plane nodes.

The following diagram illustrates using a Control Plane Group for a federated platform administrator model:

 
flowchart LR
  A(Team Blue)
  B(Team Green)
  C(Control Plane Blue)
  D(Control Plane Purple
    global config)
  E(Control Plane Green)
  F(Data Plane nodes)
  G(Data Plane nodes)

  A -- deck gateway sync --> C
  B -- deck gateway sync --> E

  subgraph id1 ["`**KONNECT ORG**`"]
    subgraph id2 [
Control Plane Group Steel]
    C
    D
    E
    end
  end

  id2 -- Get config from 
  Control Plane Group
  Steel--> F & G

  subgraph id3 [Data centers]
  F
  G
  end
  

In this diagram:

• Team Blue configures Control Plane Blue, which is then combined with the configuration from Team Green.
• The Control Plane Group also contains Control Plane Purple, which is managed by a central platform team.
• The central platform team manages global plugin configuration in Control Plane Purple, which is added to any configuration that teams Blue and Green provide.

In Konnect, Control Plane Groups can be created using the Control Planes API.

curl -X POST "$KONNECT_CONTROL_PLANE_URL/v2/control-planes" \
     -H "Authorization: Bearer $KONNECT_TOKEN"\
     -H "Content-Type: application/json" \
     --json '{
       "name": "CPG",
       "cluster_type": "CLUSTER_TYPE_CONTROL_PLANE_GROUP"
     }'

Once you have a Control Plane Group, you can add Control Planes to the Group using the Konnect UI or API.

curl -X POST "$KONNECT_CONTROL_PLANE_URL/v2/control-planes/$CONTROL_PLANE_GROUP_ID/group-memberships/add" \
     -H "Authorization: Bearer $KONNECT_TOKEN"\
     -H "Content-Type: application/json" \
     --json '{
       "members": [
         {
           "id": "062e2f2c-0f42-4938-91b4-f73f399260f5"
         }
       ]
     }'

There are some special cases and behaviors to note for Gateway entities in a Control Plane Group.

All entities in a Control Plane Group must have unique names and IDs. For example, if two members of a Control Plane Group both have a Service named example_service, it will cause a conflict which must be resolved to restore function.

A number of Kong Gateway entities can be associated with each other. Based on the type of association, the behavior of these associated entities in a Control Plane Group follows one of these patterns:

• If the entity relationship is referenced by ID, associations remain constrained to the behavior of the individual Control Plane.
• If the entity relationship is referenced by a string, then associations across one or more member Control Planes are possible.

The Kong Gateway resource associated with an entity must be part of the same standard Control Plane as the entity.

Entity-specific behavior exceptions

The following are exceptions to the entity behavior:

When combining configurations from individual Control Planes into a Control Plane Group you may receive conflict errors in Konnect, for example:

Conflicts have been detected between these Control Planes: 
CONTROL-PLANE-EXAMPLE
CONTROL-PLANE-ANOTHER-EXAMPLE

The Control Plane won’t update a Data Plane configuration until the conflict is resolved. Review the following table of common issues and potential fixes: