Kong Operator Changelog

Changelog for supported Kong Operator versions.

Release date: 2026-09-01

Breaking changes

• A cross-namespace reference from a KonnectAPIAuthConfiguration to a Secret (via spec.secretRef.namespace) now requires a KongReferenceGrant in the Secret’s namespace permitting it. Without the grant the configuration reports ResolvedRefs=False with reason RefNotPermitted and is marked invalid. Previously such references were allowed with a warning only. #2908

• EventGateway CRDs (Tech Preview) which allow referencing a Secret through secretRef, now require the key name to be provided.

  So:

  type: secretRef
  secretRef:
    name: my-backend-cluster-tls

  Copied!

  Becomes:

  type: secretRef
  secretRef:
    name: my-backend-cluster-tls
    key: tls.crt # Key name depends on the type of referenced Secret.

  Copied!
• All the CRDs generated from Konnect OpenAPISpec with a parent reference now have a CEL validation rule which ensures that the parent reference is immutable when a resource has Programmed condition set to True in its status, meaning that it is already configured in Konnect. This prevents the unsupported scenarios through breaking changes in the already released EventGateway CRDs (Tech Preview), including
  • EventGatewayVirtualCluster
  • EventGatewayVirtualClusterConsumePolicy
  • EventGatewayVirtualClusterPolicy
  • EventGatewayVirtualClusterProducePolicy #4824

Added

• Kong entities generated by Konnect-hybrid gateways now propagate the konghq.com/tags annotation to their spec.tags. Set it on the backend Service (KongService/KongUpstream/KongTarget), the HTTPRoute or TLSRoute (KongRoute), or the TLS Secret (KongCertificate/KongSNI). #4924
• Konnect: allow root Konnect entities to reference KonnectAPIAuthConfiguration resources across namespaces using authRef.namespace and KongReferenceGrant. #4839
• API: expose trafficDistribution and internalTrafficPolicy in DataPlane, GatewayConfiguration and KegDataPlane ServiceOptions. Both fields are propagated to the managed Kubernetes Service during reconciliation. #4610
• API: add PrintColumns for KongTarget upstream and target fields. #4576
• AIGateway:
  • introduce AIGatewayDataPlane CRD with reconciler #4690, #4797
  • introduce KonnectAIGateway CRD with reconciler #4760, #4792, #4848
  • introduce AIGatewayDataPlaneCertificate CRD with reconciler #4772
  • introduce AIGatewayPolicy CRD with reconciler. Configurations can be sourced from a key in a Kubernetes Secret. The value in secret should be valid JSON or YAML format. #4781 #4856
  • introduce AIGatewayAgent CRD with reconciler. #4776
  • introduce AIGatewayModelProvider CRD with reconciler. Credentials can be sourced from a Kubernetes Secrets. #4793 #4798
  • introduce AIGatewayConsumer and AIGatewayConsumerCredential CRDs with reconcilers. Credentials are modelled as a separate resource referencing the consumer, mirroring the Konnect API hierarchy. #4804
  • introduce AIGatewayConsumerGroup CRD with reconciler. #4822
  • allow AIGatewayConsumer resources to reference AIGatewayConsumerGroup resources. #4910
  • introduce AIGatewayIdentityProvider CRD with reconciler. #4852
  • introduce AIGatewayMCPServer CRD with reconciler. #4836
  • KonnectAIGateway now supports spec.source: Mirror, referencing an existing Konnect AI Gateway by ID (spec.mirror.konnect.id) instead of creating one. Origin (the default) is unchanged. #4928
• GRPCRoute: enable GRPCRoute for on-prem gateway #4364
• Support spec.deployment.labels and spec.deployment.annotations for metadata of underlying dataplane Deployment for:
  • DataPlane #5037
  • AIGatewayDataPlane #5081
  • KegDataPlane #5088
  • MCPServerDataPlane #5150 with safe managed-key removal so operator-managed keys are removed without clobbering external labels or annotations. This change causes a rolling restart of the underlying Pods when updating operator to this version, no matter whether the user has set any labels or annotations.
• EventGateway CRDs: added EventGatewaySchemaRegistry CRD and reconciliation logic. #5017
• Gateway: Support TCPRoute for on-prem gateways. #4207
• Gateway: Support UDPRoute for on-prem gateways. #4747 #5028 #5031 #5033
• HybridGateway: add controller and translator support for Gateway API TCPRoute resources. #4727 #5018
• Added option to disable DataPlane’s probes by specifying it as {}. Using {} previously caused the operator to use default values for the probes (no effect), which was not the intended behavior. Now, the operator will not set any probes on the DataPlane whenever {} is specified. #5117
• KongCertificate: spec.cert, spec.key, spec.cert_alt and spec.key_alt now explicitly support Kong vault references (e.g. {vault://certvault/my-service-key}) in addition to inline PEM material, so certificate material can be kept out of Kubernetes and resolved by Kong Gateway at runtime. Values that start with {vault: are validated against the vault reference format at admission time, valid references are passed to Konnect unchanged. #5159

• Added MCPServerDataPlane CRD to handle MCPServer’s data plane reconciliation. #5134

• HybridGateway: Support UDPRoute for hybrid #5160 #5163 #5164
• KongVault: added spec.configStoreRef, which references a KonnectConfigStore by Kubernetes name instead of requiring the Konnect-generated Config Store ID to be copied into spec.config.config_store_id by hand. The referenced store’s Konnect ID is resolved during reconciliation and sent to Konnect as the vault backend’s config_store_id. The field is only accepted when spec.backend is konnect and is mutually exclusive with config_store_id in spec.config; setting config_store_id directly keeps working unchanged. A new ConfigStoreRefValid status condition reports a missing, invalid, or not-yet-programmed reference, and the KongVault is reconciled automatically once the referenced KonnectConfigStore is programmed. #5208 #5211
• MCPServerDataPlane: added spec.deployment.podTemplateSpec.metadata.labels and .annotations, letting users set custom labels/annotations on the Pods of the owned Deployment (as opposed to the Deployment object itself). Keys managed by the operator (the app selector label, the operator’s own labels, and the MCP server version annotation) cannot be overridden.
• KongVault: spec.configStoreRef now requires the referenced namespace to permit the reference with a KongReferenceGrant. KongVault is cluster-scoped, so the grant’s from entry has to use namespace: "", and KonnectConfigStore is now accepted as a to kind. Without a matching grant the KongVault reports ConfigStoreRefValid=False with reason RefNotPermitted and is not pushed to Konnect. #5221
• HybridGateway: Support GRPCRoute for hybrid #5139 #5141
• AIGateway: Support referring to AIGatewayConsumerGroups in ACL allow/deny lists in AIGatewayAgent and AIGatewayModel. #5307
• AIGatewayDataPlane: added a ServiceReady status condition and a status.addresses field that expose the ingress Service’s readiness and reachable addresses. For LoadBalancer-type Services, ServiceReady stays False until an external address is allocated, which also blocks the overall Ready condition; ClusterIP and NodePort Services are always considered ready. The external hostname or IP is visible in status.addresses once allocated. #5391
• Added AIGatewayAuthStrategy CRD #5405
• AIGatewayDataPlane: reconcile a HorizontalPodAutoscaler from spec.deployment.scaling.horizontal. When horizontal scaling is configured the operator creates and keeps an HPA up to date; when the configuration is removed the HPA is deleted so it no longer conflicts with a static replica count. The operator’s RBAC now includes create;get;list;patch;watch;delete on horizontalpodautoscalers for the AIGatewayDataPlane controller. #5406
• KegDataPlane: reconcile a HorizontalPodAutoscaler from spec.deployment.scaling.horizontal. When horizontal scaling is configured the operator creates and keeps an HPA up to date; when the configuration is removed the HPA is deleted so it no longer conflicts with a static replica count. The operator’s RBAC now includes create;get;list;patch;watch;delete on horizontalpodautoscalers for the KegDataPlane controller. #5456
• KegDataPlane: added a ServiceReady status condition and a status.addresses field that expose the Kafka Service’s readiness and reachable addresses. For LoadBalancer-type Services, ServiceReady stays False until an external address is allocated, which also blocks the overall Ready condition; ClusterIP and NodePort Services are always considered ready. The external hostname or IP is visible in status.addresses once allocated. #5457
• MCPServerDataPlane exposes spec.deployment.podTemplateSpec.spec.containers[].resources matched by field name to adjust the resource requests and limits of the owned Deployment’s containers (e.g. mcp-server or init-mcp-server). Names that don’t match a container the operator manages are ignored.
• Support using tags field in KongPlugin and KongClusterPlugin to specify tags in generated Kong plugins in on-prem gateways and Konnect hybrid gateways. #5325 #5354
• AIGatewayDataPlane: made spec.controlPlaneRef optional. When omitted, the operator performs no KonnectAIGateway lookup or certificate registration automation, letting the AI Gateway be configured against a manually-managed control plane and certificate via spec.deployment.podTemplateSpec. controlPlaneRef is immutable once set: it can be added later, but not removed or changed to a different reference. #5470

Changed

• Konnect related fields in GatewayConfiguration are immutable now, because for underlying KonnectGatewayControlPlane these fields have been always immutable. #4599
• Bump sigs.k8s.io/gateway-api from v1.5.1 to v1.6.0. #4639 #4713
• HybridGateway: treat malformed annotations as errors #4530
• Conformance: enable HTTPRouteBackendTimeout #4714
• Conformance: enable GRPCRoute conformance tests for on-prem. #4673
• Kong Event Gateway: update the default KEG DataPlane image to kong/kong-event-gateway:1.2.1. #5137
• AIGateway: Reference AIGatewayPolicy resources by AIGatewayPolicyRef in the nested fields of AIGatewayModel and AIGatewayMCPServer. #4990
• Security: harden container for AIGatewayDataPlane and KegDataPlane runtime Deployment with a tight security context:
  • disallows privilege escalation
  • drop all capabilities (except for NET_BIND_SERVICE to allow binding to ports < 1024)
  • run as non-root user
  • read-only root filesystem This change enforces patching of Deployments, which causes a rolling restart of the underlying Pods when updating operator to this version. For DataPlane, the same hardening is available but opt-in: set spec.deployment.hardened: Enabled (or for Gateway-managed DataPlanes, spec.dataPlaneOptions.deployment.hardened: Enabled on the GatewayConfiguration) to enable it. Note that, after operator upgrade, DataPlanes’ Deployments will be rolled out regardless and Pods will be recreated. #4953
• Add timeouts to ControlPlane’s health check server #5023
• HybridGateway: use the shared server-side apply TypeConverterProvider / ApplyIfChanged for state enforcement instead of a bespoke managed-fields diff/apply implementation, removing the now unused controller/hybridgateway/managedfields package. #5052
• Deprecate the legacy AIGateway CRD in gateway-operator.konghq.com/v1alpha1 and its controller. Use AIGateway* CRDs in konnect.konghq.com/v1alpha1 instead. #5114
• Gateway: update the default DataPlane image to kong/kong-gateway:3.15. #5095
• MCPServer CRD is split into MCPServer and MCPServerDataPlane CRD. The latter handles MCPServer’s data plane reconciliation. #5134
• Konnect entities whose parent reference is derived from the Konnect API path now reject changes to that reference once the entity is Programmed, matching the behavior that already applied to every other Konnect entity. #5207
• AIGateway: enable AIGatewayAgent and AIGatewayModel to reference IdentityProvider #5265
• Enable KONG_USE_STANDARD_GRPC_STATUS_CODES on dataplanes by default and run all core level GRPCRoute conformance tests. #5366
• Moved AIGatewayAgent, AIGatewayAuthStrategy, AIGatewayConsumer, AIGatewayConsumerCredential, AIGatewayConsumerGroup, AIGatewayIdentityProvider, AIGatewayMCPServer, AIGatewayModel, AIGatewayModelProvider and AIGatewayPolicy from the konnect.konghq.com API group to a new aiconfiguration.konghq.com API group. #5407
• AIGateway: update the default AI Gateway DataPlane image to kong/kong-ai-gateway-dev:2.0.3. #5459

Fixes

• HybridGateway: fix HTTPRoute and TLSRoute finalizer getting permanently stuck when the Konnect controller updated a child resource (KongRoute, KongService, KongUpstream) between Phase 4b’s GET and its optimistic-lock PATCH, causing a conflict error and requeue. If a route deletion event was processed before the requeue fired, HandleOrphanedResource found the hybrid-routes annotation absent and skipped cleanup, leaving the finalizer blocked indefinitely. The fix bakes the annotation into the SSA Apply in Phase 4, eliminating the separate Phase 4b PATCH and the race window it created. #4944
• AIGateway/EventGateway: fix AIGatewayDataPlane and KegDataPlane not setting Ready=False when a dependency condition is unmet. ensureReadyStatus was only called on the happy path, so early-return branches (e.g. referenced KonnectAIGateway not found) left the Ready condition unset. The call is now deferred so it always runs, and a fast-path scan sets Ready=False/DependenciesNotReady immediately when any other condition is already False. #4918
• DataPlane: fix false-positive warnings about operator-managed environment variables (KONG_CLUSTER_CERT, KONG_CLUSTER_CERT_KEY) being set by the user. The Konnect extension processor injects these variables into the in-memory DataPlane spec as a staging area for deployment generation; the check now runs before that mutation so it only inspects what the user actually wrote to the DataPlane object in Kubernetes. #4888
• Gateway: stop overwriting the user-configured KONG_STREAM_LISTEN for TLS listeners. The operator now enforces only the listen port and the ssl token, preserving the bind address (e.g. [::] for IPv6) and any listen options (reuseport, backlog=...) set on the GatewayConfiguration DataPlane pod template. Multiple bind addresses (dual-stack, e.g. 0.0.0.0:<port> ssl reuseport, [::]:<port> ssl reuseport) are preserved for each listener port. Defaults to 0.0.0.0 and reuseport when unset. #4755
• Konnect: prevent orphaned and duplicate Konnect entities when reconciliation races with the cached client. The cleanup finalizer is now added before the entity is created in Konnect, and the freshly created Konnect ID is kept in an in-memory store until the cached status reflects it. This lets deletion recover a missing Konnect ID (falling back to probing Konnect by Kubernetes UID, or by name for the tag-less Cloud Gateway types KonnectCloudGatewayNetwork and KonnectCloudGatewayTransitGateway) so an entity can still be cleaned up after an operator restart, and prevents creating a duplicate entity when a stale cached status has not yet caught up to the persisted Konnect ID. #4650
• HybridGateway: merge duplicate KongTargets when multiple backendRefs in an HTTPRoute or TLSRoute rule resolve to the same pod IP and port. Previously one target per backendRef per endpoint was created, causing Konnect 400 uniqueness-constraint rejections that left targets stuck in Programmed=False. The operator now creates one KongTarget per unique endpoint address, summing the weights of all contributing backendRefs. On upgrade, existing targets are looked up by address and reused to avoid duplicate conflicts. #4509
• Konnect: requeue HybridGateway managed resources on reference-only 400 errors with a fixed 5 s delay. ERROR_TYPE_REFERENCE uniqueness conflicts are transient (stale entity not yet cleaned up, or referenced entity not yet propagated); previously they fell through to exponential backoff or were silently dropped. For user-created resources the same error shape is still suppressed as it may indicate a permanent misconfiguration. #4509
• HybridGateway: prevent traffic drops when an HTTPRoute spec change rotates resource names. A cleanup-time gate defers orphan deletion until every desired KongRoute is confirmed bound to its new KongService in Konnect, and an enforce-time gate delays KongService creation until its KongUpstream and all desired KongTargets are Programmed. #4577
• HTTPRoute: traditional route translation now treats header match names case-insensitively and ignores later equivalent duplicates, aligning with Gateway API matching semantics. #4597
• Traditional router: Kong routes translated from HTTPRoute matches are now assigned a compact regex_priority derived from the match’s Gateway API precedence traits (hostname specificity, path type and length, method, header and query parameter counts) plus, within a single HTTPRoute, the rule and match order. This ensures overlapping matches of different specificity, and overlapping matches within one HTTPRoute, are evaluated in the order required by the Gateway API specification. Adding or removing HTTPRoutes whose match shapes already exist does not renumber unrelated routes; introducing a new precedence class may. Equally specific matches from different HTTPRoutes share the same priority and their relative order remains unspecified, as before. HTTPRoute matches with multiple header matches using equivalent, case-insensitive names no longer fail translation: only the first entry is used and the subsequent ones are ignored, as required by the Gateway API specification. #4563
• HybridGateway: release Gateway API route finalizers once generated Kong resource delete requests have been issued, so immediate same-name route re-creates are not blocked by child resource finalizers. #4465
• HybridGateway: deduplicate generated Kong resources within a single HTTPRoute/TLSRoute translation when multiple rules reference the same backend. #4567
• HybridGateway: reconcile shared hybrid-routes annotations with optimistic-lock updates so concurrent Routes do not clobber each other’s route references, and orphan cleanup does not delete resources that changed after the cleanup decision. If a shared Kong resource is concurrently deleted before a Route records itself, the Route re-queues to recreate it instead of stalling. #4567
• HybridGateway: use route-scoped KongService names for HTTPRoute rules whose backendRefs resolve to no valid targets. This avoids Konnect name conflicts with valid backend services while keeping normally generated service names unchanged. #4437
• Prevent recreating consumer credentials on every Konnect sync when running in “KIC in Konnect” mode with on-prem ControlPlane. #4622
• HybridGateway: merge HTTPRoute filters that map to the same Kong plugin type (for example a URLRewrite and a RequestHeaderModifier, both of which translate to request-transformer) into a single KongPlugin per rule. This avoids attaching two plugins of the same type to the same route, which Konnect rejects with a unique-plugin-per-entity constraint error. #4658
• Fix the issue that the ResolvedRef condition for cross-namespace reference is not removed when a resource is updated to remove the cross-namespace reference. #4663
• HybridGateway: order overlapping header-only HTTPRoute matches by Gateway API specificity. Header-only matches are translated to KongRoutes with a catch-all regex path so Kong’s regex_priority becomes effective, and a per-match priority derived from method and header specificity keeps more specific header matches ahead of less specific ones. This enables the HTTPRouteHeaderMatching Gateway API conformance test for the hybrid gateway. Generated header-only priorities stay below 1 << 20 (1048576), while generated path-based priorities start at that value. Use custom KongRoute priorities below or above that boundary depending on whether they should sort before or after generated path-based routes. #4640
• Fix routes become unaccepted and removed from DataPlane unexpectedly #4521
• EventGateway and MCPServer: fix Server-Side Apply (SSA) permanently failing with “no corresponding type” for operator-owned CRD kinds (KegDataPlane, etc.). The managedfields.TypeConverter was built once at startup from the API server’s /openapi/v3 endpoint, which publishes CRD schemas asynchronously (up to a ~60 s delay). CRDs that were not yet published were silently skipped, permanently breaking SSA, including status writes, until the next restart. The converter is now built in-process from the live CRD objects (apiserver-style, with no delay) and atomically refreshed by a dedicated CRD controller whenever a relevant CRD changes at runtime. #4795
• Dataplane: Fixed the method to compare whether dataplane options are deep equal to ensure that HorizontalPodAutoscaler is updated when it is changed in GatewayConfiguration. Also fixed the calculation of the spec hash in the Deployment to skip reconciliation of deployments if only deployment.scaling is changed in dataplane options. #5003
• Accept DataPlane image references whose registry host contains a port (e.g. registry.example.com:5000/kong/kong-gateway:3.10). The tag is now split at the last : instead of every :, so a host-port colon is no longer misread as the tag separator. Without this fix, DataPlane Deployment provisioning silently failed with expected "<image>:<tag>" format, got: <full-ref>. #5036
• Hybridgateway: an HTTPRoute rule with omitted or empty backendRefs now responds with 500 instead of Kong’s default 503 for an empty upstream, by binding a request-termination plugin to the generated Kong service. Rules that already produce a response via a RequestRedirect filter are excluded. This fixes the HTTPRouteNoBackendRefs Gateway API conformance test for the hybrid gateway. #5066
• Gateway: Support watching both v1 and v1beta1 versions of ReferenceGrant to ensure compatibility with gateway API 1.3 and 1.4. #5091
• Admission webhook maintains its semantic to provide best effort validation to not block potentially valid Ingress or HTTPRoute resources when the webhook is not able to reach Kong Gateway. #5095
• HybridGateway: fix KongRoute created without updating KongService’s hybrid-route annotation #5136
• HybridGateway: shared Kong resources now converge when referenced by Routes attached to multiple Gateways, and SSA no-op detection correctly handles preserve-unknown fields. This prevents repeated apply loops from blocking stale resource cleanup after workload rollout. #5410
• EventGatewayBackendCluster, EventGatewaySchemaRegistry, EventGatewayListenerPolicy, EventGatewayDataPlaneCertificate and AIGatewayDataPlaneCertificate now require a KongReferenceGrant for a cross-namespace secretRef, matching every other entity that references Secrets. Previously these five kinds were not recognized as using the generated sensitive-data Secret mechanism and skipped the grant check. An existing object with secretRef.namespace set and no matching KongReferenceGrant reports ResolvedRefs=False/RefNotPermitted on upgrade until a grant is added. #5407
• Konnect entities whose cross-namespace controlPlaneRef was permitted by a KongReferenceGrant no longer get stuck during deletion when that grant is removed first. The grant is now enforced only while the entity is not being deleted, allowing its Konnect counterpart and cleanup finalizer to be removed. #5229
• DataPlaneMetricsExtension: the reconciler now returns an error (and gets re-queued with backoff) when it fails to create, update or delete the Prometheus KongPlugin for a Service, instead of logging and giving up. Previously a single transient failure (e.g. a rejected admission webhook call) left the Service without its konghq.com/plugins annotation indefinitely, since nothing else would trigger another reconcile.
• Fix Gateway API routes becoming transiently unaccepted and removed from dataplane when listener is intermittently marked as Programmed=False. #5237
• Konnect entities: Fix truncating of tags to cut at 128 unicode runes (UTF8 code points). #5306
• Hybrid gateway: Propagate tags in the annotation konghq.com/tags in KongPlugins to the copies when attached to HTTPRoutes and GRPCRoutes to propagate the tags in KongPlugins’ annotation to plugins in Konnect. #5280 #5284
• AIGatewayDataPlane: fix the Ready condition to reflect a fully completed Deployment rollout instead of flipping True as soon as any pod (old or new) was ready. #5365
• KegDataPlane: the Ready condition no longer flips True mid-rollout. Previously it became True as soon as any replica was ready, even while an old pod was still being replaced. It now uses DeploymentRolloutComplete, which requires the controller to have observed the current generation and all desired replicas to be updated and available. #5425

Release date: 2026-08-27

Fixes

• Konnect entities whose cross-namespace controlPlaneRef was permitted by a KongReferenceGrant no longer get stuck during deletion when that grant is removed first. The grant is now enforced only while the entity is not being deleted, allowing its Konnect counterpart and cleanup finalizer to be removed. #5229 #5232
• DataPlaneMetricsExtension: the reconciler now returns an error (and gets re-queued with backoff) when it fails to create, update or delete the Prometheus KongPlugin for a Service, instead of logging and giving up. Previously a single transient failure (e.g. a rejected admission webhook call) left the Service without its konghq.com/plugins annotation indefinitely, since nothing else would trigger another reconcile. #5210 #5217
• Dataplane: Fixed the method to compare whether dataplane options are deep equal to ensure that HorizontalPodAutoscaler is updated when it is changed in GatewayConfiguration. Also fixed the calculation of the spec hash in the Deployment to skip reconciliation of deployments if only deployment.scaling is changed in dataplane options. #5003 #5104
• Hybrid gateway: Propagate tags in the annotation konghq.com/tags in KongPlugins to the copies when attached to HTTPRoutes and GRPCRoutes to propagate the tags in KongPlugins’ annotation to plugins in Konnect. #5280 #5284 #5334
• Konnect entities: Fix truncating of tags to cut at 128 unicode runes (UTF8 code points). #5306 #5370

Release date: 2026-07-14

Fixes

• Hybridgateway: Wait for cleanup of all child resources before removing the finalizers of the parent resource #4785 #4892
• Preserve only one CA certificate from secrets if there are multiple ones with the duplicate IDs. #4877

Release date: 2026-07-06

Fixes

• Gateway: stop overwriting the user-configured KONG_STREAM_LISTEN for TLS listeners. The operator now enforces only the listen port and the ssl token, preserving the bind address (e.g. [::] for IPv6) and any listen options (reuseport, backlog=...) set on the GatewayConfiguration DataPlane pod template. Multiple bind addresses (dual-stack, e.g. 0.0.0.0:<port> ssl reuseport, [::]:<port> ssl reuseport) are preserved for each listener port. Defaults to 0.0.0.0 and reuseport when unset. #4755 #4767

Release date: 2026-07-01

Fixes

• HTTPRoute: traditional route translation now treats header match names case-insensitively and ignores later equivalent duplicates, aligning with Gateway API matching semantics. #4597
• Hybridgateway: release Gateway API route finalizers once generated Kong resource delete requests have been issued, so immediate same-name route re-creates are not blocked by child resource finalizers. #4465 #4543
• Hybridgateway: use route-scoped KongService names for HTTPRoute rules whose backendRefs resolve to no valid targets. This avoids Konnect name conflicts with valid backend services while keeping normally generated service names unchanged. #4437 #4559
• Prevent recreating consumer credentials on every Konnect sync when running in “KIC in Konnect” mode with on-prem ControlPlane. #4622
• Hybridgateway: fix KongTarget stuck in Programmed=False when multiple backendRef Services in an HTTPRoute or TLSRoute rule resolve to the same pod IP and port. The operator now creates one KongTarget per unique endpoint address across all backendRefs in a rule, merging duplicate endpoints and summing their weights, instead of attempting to create one per backendRef per endpoint which violated Konnect’s upstream/target uniqueness constraint. Note: the KongTarget naming scheme has changed and the backendRef is no longer part of the name hash. All existing KongTarget resources will be orphaned and recreated on the first reconciliation after upgrading. During the transition, both old and new entries may be present in Konnect simultaneously as creation and orphan cleanup are not synchronized. #4509
• Hybridgateway: prevent traffic drops when an HTTPRoute spec change rotates resource names. A cleanup-time gate defers orphan deletion until every desired KongRoute is confirmed bound to its new KongService in Konnect, and an enforce-time gate delays KongService creation until its KongUpstream and all desired KongTargets are Programmed. #4577
• Konnect: prevent orphaned and duplicate Konnect entities when reconciliation races with the cached client. The cleanup finalizer is now added before the entity is created in Konnect, and the freshly created Konnect ID is kept in an in-memory store until the cached status reflects it. This lets deletion recover a missing Konnect ID (falling back to probing Konnect by Kubernetes UID, or by name for the tag-less Cloud Gateway types KonnectCloudGatewayNetwork and KonnectCloudGatewayTransitGateway) so an entity can still be cleaned up after an operator restart, and prevents creating a duplicate entity when a stale cached status has not yet caught up to the persisted Konnect ID. #4650
• Hybridgateway: merge HTTPRoute filters that map to the same Kong plugin type (for example a URLRewrite and a RequestHeaderModifier, both of which translate to request-transformer) into a single KongPlugin per rule. This avoids attaching two plugins of the same type to the same route, which Konnect rejects with a unique-plugin-per-entity constraint error. #4658
• Fix the issue that the ResolvedRef condition for cross-namespace reference is not removed when a resource is updated to remove the cross-namespace reference. #4663

Release date: 2026-06-05

Added

• Add --enable-controller-kegdataplane flag (env KONG_OPERATOR_ENABLE_CONTROLLER_KEGDATAPLANE, default false) to enable the KEG (Kong Event Gateway) DataPlane controller. #4391
• Support wildcard TLS SNI matching in Kong routes for Kong 3.7.0 and above in on-prem gateways. #4389
• DataPlane: extend Kong image validation to support sha256 digest #4356
• Konnect: support KongCertificate ref in KongUpstream #4305
• KongTarget: support cross-namespace spec.upstreamRef to reference a KongUpstream in a different namespace. A KongReferenceGrant in the upstream’s namespace is required to permit the reference. The KongTarget status reflects KongUpstreamRefValid=False/RefNotPermitted when no grant is present and clears once the grant is in place. #4263
• KongSNI: support cross-namespace spec.certificateRef to reference a KongCertificate in a different namespace. A KongReferenceGrant in the target namespace is required to permit the reference. The KongSNI status reflects ResolvedRefs=False/RefNotPermitted when no grant is present and ResolvedRefs=True once the grant is in place. #4235
• Hybridgateway: add support for konghq.com/path service annotation #4100
• Hybridgateway: add support for konghq.com/tls-verify service annotation #4105
• Hybridgateway: add support for konghq.com/tls-verify-depth service annotation #4099
• Hybridgateway: add support for konghq.com/connect-timeout service annotation #4101
• Hybridgateway: add support for konghq.com/read-timeout service annotation #4102
• Hybridgateway: add support for konghq.com/write-timeout service annotation #4103
• Hybridgateway: add support for konghq.com/retries service annotation #4104
• Hybridgateway: add support for konghq.com/host-header service annotation #4108
• Hybridgateway: add support for konghq.com/client-cert service annotation. #4352
• Konnect: support KongCertificate and KongCACertificate refs in KongService #4240
• Hybridgateway: add error logs when annotations are malformed #4143
• Add the following headers in requests of ingress-controller sent to Konnect for uploading configuration for tracing:
  • X-Kic-Konnect-Sync-Instance-Id for instance ID of Konnect config synchronizer. It is set to use the ControlPlane’s instance ID.
  • X-Kic-Konnect-Sync-Serial-Number for serial number of config sync round.
  • X-Kic-Konnect-Sync-Start-Timestamp for the timestamp of starting the config sync round.
  • X-Kic-Konnect-Sync-Round-Id for the ID to mark the config sync round. #4062
• Hybridgateway: support konghq.com/upstream-policy service annotation to set KongUpstream specs #4040
• Add spec.konnect.configUploadConcurrency to set the concurrency of uploading configuration to Konnect in the on-prem gateway integration wit Konnect and decrease the default concurrency to 4 to reduce the possibility of triggering rate limiting of Konnect API service. #3959
• KegDataplane: Implement the KegDataPlane reconciler (eventgateway.konghq.com/v1alpha1) which manages the full lifecycle of Kong Event Gateway (KEG) DataPlane workloads. #3914
• TLSRoute support: Move TLSRoute controller out of GatewayAlpha feature gate in controlplane controller managers and migrate the controller to reconcile TLSRoutes in gateway API v1 instead of v1alpha2. Note: This may be incompatible when migrating the management of TLSRoute from Kong ingress controller to Kong operator. #3812
• TLSRoute support: Add TLSRoute reconciler in hybrid gateway controllers and add translator of TLSRoute. #3763
• EventGatewayDataPlane: introduces the eventgateway.konghq.com/v1alpha1 API group with a new KegDataPlane kind that manages a keg binary Deployment connecting to Konnect via a referenced KonnectEventGateway resource. #3765
• TLSRoute support: Configure DataPlaneOption in created DataPlane to configure Kong DataPlane deployment and ingress service for listeners with TLS protocol. #3493
• Allow cross-namespace reference for KonnectAPIAuthConfiguration from GatewayConfiguration using KongReferenceGrant. When a user creates a KongReferenceGrant allowing GatewayConfiguration to reference a KonnectAPIAuthConfiguration in another namespace, the Gateway controller automatically creates a managed KongReferenceGrant for the corresponding KonnectGatewayControlPlane. This managed grant is removed when the user grant is deleted or the Gateway is deleted. #3258
• Added leader election configuration through the following flags:
  • --leader-election-lease-duration
  • --leader-election-renew-deadline
  • --leader-election-retry-period #3345
• Support Gateway.spec.infrastructure.labels and Gateway.spec.infrastructure.annotations. Labels and annotations set on a Gateway’s infrastructure are now propagated to the DataPlane’s ingress Service metadata and Deployment pod template metadata. When both a GatewayConfiguration and Gateway.spec.infrastructure specify the same key, the infrastructure value takes precedence. #3412
• Propagate the GEP-1762 gateway.networking.k8s.io/gateway-name label to all operator-level resources created by the Gateway controller: DataPlane’s Service and Pods, as well as DataPlane it self, ControlPlane, KonnectGatewayControlPlane, KonnectExtension, and NetworkPolicy. This changes enforces patching of the DataPlane deployment to add the label, which causes a rolling restart of the DataPlane Pods. #3531
• Added --konnect-request-timeout flag to control Konnect API calls timeout. Be default that is set to 10 seconds. #3513
• Added sticky_sessions_cookie and sticky_sessions_cookie_path fields to KongUpstream CRD, enabling sticky session configuration for Kong Gateway 3.11+ upstreams synced to Konnect. A CEL validation rule enforces that sticky_sessions_cookie is set when algorithm is sticky-sessions. #3555
• Fix license storage not being enabled for ControlPlanes, license decoding from Secrets and not setting the Secret label selector labels on license Secrets. #3610
• Added MCPServer CRD (konnect.konghq.com/v1alpha1) for declarative management of MCP (Managed Control Plane) servers in Konnect. Supports Mirror mode configuration to reference existing Konnect control planes by ID. #3612
• Added managed-by:kong-operator tag to all Konnect entities to allow filtering resources managed by Kong Operator in Konnect. #3609
• Added MCP ControlPlane signalling controller: a new MCPServerCPReconciler watches KonnectGatewayControlPlane resources and, via a SignalManager, maintains per-control-plane background goroutines that poll the Konnect MCP server signal API. This enables the operator to react in near-real-time to Konnect-side configuration changes affecting MCPServer objects linked to a control plane. The feature is gated behind the MCPController feature gate. #3677
• Added MCPServer entity controller that reconciles MCPServer custom resources against the Konnect API. The controller sets status conditions and the Konnect entity ID on the resource. The feature is gated behind the MCPController feature gate. #3739
• Added MCPServer reconciler that manages owned Kubernetes workloads (Deployments and Services) for MCPServer resources. The reconciler fetches MCP server configuration from Konnect via the signal manager and reconciles the corresponding local resources. The feature is gated behind the MCPController feature gate. #3755
• Added Kong entity reconciliation for MCPServer: the reconciler now fetches KongService and KongRoute definitions from the Konnect API and ensures matching Kubernetes CRs exist in the cluster. The KongService host is set to the in-cluster Service DNS name. Stale resources are garbage-collected. #3831
• Added per-version workload status reporting for MCPServer: after each reconcile the controller walks the Deployment’s ReplicaSets, classifies every Pod as ready, starting, or failing, and posts the aggregated MCPServerVersionStatus to the Konnect API. A Pod watch is added so that status is updated in near-real-time during rolling updates. #3850
• Hybridgateway: add support for konghq.com/protocol service annotation #3847
• Automatic rotation of certificates issued by the operator and used internally, configured via --cert-ttl and --cert-expiration-margin flags. The operator will automatically renew certificates before they expire, ensuring secure communication. Short downtime during rotation is expected. #3745
• Added support for using KonnectGatewayControlPlane of type group with KonnectExtensions. #3711
• MCPServer: set KongRoute and KongService Konnect IDs during reconciliation. #3904
• MCPServer: set MCPServer ID as the name identifier for the Kubernetes resource and store the Konnect name in the MCPServer CRD status. #3904
• MCPServer: reconcile the owned Deployment and Service via Server-Side Apply so the full spec is enforced on every reconcile, and set the init and runner container images (kong/mcp-server-init, kong/mcp-server-runner) to the versions returned by Konnect. #3943
• MCPServer: provision the ai-mcp-proxy KongPlugin and attach it to the owned KongService via a dedicated KongPluginBinding. #4188

Changed

• HybridGateway: Changed the annotation on generate Kubernetes resources (Konnect entities) to mark the parent route. Now the format of the annotation key is changed to konghq.com/hybrid-route-<routeKind> to support multiple kinds of routes. If the route kind is HTTPRoute, the key format remains unchanged. #3905
• Increase default interval of uploading configuration and node status to the read-only Konnect control plane (The legacy KIC type CP) to 3 minutes to decrease the API calls to Konnect. #3969
• HybridGateway: generate one KongRoute per HTTPRouteMatch to honor Gateway API OR semantics across matches within a rule. This enables the HTTPRouteMatching conformance test for Hybrid mode. Note: routes count per rule may increase. #3577
• Upgrade Gateway API to v1.5.1, it requires manual step of installing new CRDs before the upgrade, see UPGRADE. #3596 #3599
• Bump Kong Gateway to 3.14 and double the default CPU (now 2000m) and memory limits (now 2000Mi) for the DataPlane deployment. #3995

Fixes

• Hybridgateway: fix KongRoute name collisions when an HTTPRoute attaches to multiple listener-scoped ParentRefs on the same Gateway, enabling the HTTPRouteListenerHostnameMatching Gateway API conformance test for Hybrid Gateway. Only affected multi-parent translated routes are renamed. #4423
• Hybridgateway: fix KongCertificate name collisions when a Gateway has multiple listeners using the same port by including listener identity in generated certificate names. Attention: This will re-create CA certificates in Konnect, as it changes the names of the generated KongCertificates. #4382
• Gateway: Pick the intersection of spec’s hostnames and parent listener’s hostname as the hostnames in TLSRoute for translation in on-prem gateways. #4369
• Gateway: conflicting listeners (port/protocol or hostname conflict) now have Accepted=False with the conflict reason, per Gateway API spec rule that “ALL indistinct Listeners must not be accepted for processing”. Additionally, TLS listeners that share a port with another listener are now marked Conflicted=True/ProtocolConflict (and therefore not accepted). #4309
• Add ResolvedRefs condition update for TLSRoutes and enable ReferenceGrant to control the cross-namespace reference from TLSRoutes to their backendRefs in on-prem TLSRoute controller. #4292
• KongRoute: when a cross-namespace serviceRef has no KongReferenceGrant, the Programmed condition now transitions to False in the same reconcile pass that sets ResolvedRefs=False/RefNotPermitted. Previously Programmed remained Unknown because the reconciler returned early before calling patchWithProgrammedStatusConditionBasedOnOtherConditions. #4318
• KongPluginBinding: the PluginRefValid status condition is now set promptly when the referenced KongPlugin does not exist (same-namespace or cross-namespace) or when a cross-namespace KongReferenceGrant is deleted. Previously the binding could take up to the full sync period (~60 s) to reflect these changes because the check lived in the Konnect SDK ops layer. The check is now a pre-ops handler that runs early in the reconcile loop and reacts immediately to watch-triggered enqueues. #4312
• Add KongReferenceGrant watch to KongVault and KongConsumerGroup reconcilers. Previously, creating or deleting a grant would not trigger re-reconciliation of these resources until the next full resync cycle. Grant changes now immediately re-queue affected objects. #4219
• Fix cross-namespace KongRoute → KongService reference resolution: handleKongServiceRef and GetAPIAuthRefNN (serviceRef branch) now derive the KongService namespace from serviceRef.namespace instead of always using the route’s namespace, so a cross-namespace serviceRef with a valid KongReferenceGrant correctly reaches Programmed=True. The kongRouteRefersToKongService index key and enqueueKongRouteForKongService watch handler are also fixed to use the service’s namespace, ensuring cross-namespace routes are re-queued immediately when the referenced service changes rather than waiting for a full resync. #4212
• Use the ControlPlane’s own namespace when resolving its KonnectAPIAuthConfiguration reference and when checking the KongReferenceGrant. Previously the namespace of the requesting entity was used, which caused resources that resolve their CP through a parent ref (KongRoute via serviceRef, KongCredential* via consumerRef) to silently fail when the parent’s controlPlaneRef was cross-namespace. #4210
• More robust validation for HTTPRoute, when an unsupported feature is used, and the route refers to existing and non-existing Gateway, it will be rejected. #4131
• Sanitize the plugin configuration when ControlPlane’s configDump.dumpSensitive isn’t enabled. #4045
• More robust validation for GatewayConfiguration - fields konnect and extensions are mutually exclusive. #4213
• Deletion of obsolete KonnectControlPlane in version v1alpha1 (available only when conversion webhook is enabled) does not leave orphaned KonnectGatewayControlPlane in Konnect. #4267
• Fixed KonnectExtension changes won’t trigger ControlPlane reconciliations. #4361
• Revert plugin config sanitization when ControlPlane’s configDump.dumpSensitive isn’t enabled. Due to plugin configuration being dependent on plugin type controller is not able to make an informed decision whether a field is sensitive or not and more importantly whether it has a constrained set of allowed values like e.g. HTTP methods. Users are suggested to block network access to debug endpoints (which are disabled by default) if plugin configuration can contain sensitive information. #4467
• Hybridgateway: fix KongTarget stuck in Programmed=False when multiple backendRef Services in an HTTPRoute or TLSRoute rule resolve to the same pod IP and port. The operator now creates one KongTarget per unique endpoint address across all backendRefs in a rule, merging duplicate endpoints and summing their weights, instead of attempting to create one per backendRef per endpoint which violated Konnect’s upstream/target uniqueness constraint. Note: the KongTarget naming scheme has changed and the backendRef is no longer part of the name hash. All existing KongTarget resources will be orphaned and recreated on the first reconciliation after upgrading. During the transition, both old and new entries may be present in Konnect simultaneously as creation and orphan cleanup are not synchronized. #4509

Release date: 2026-08-27

Fixes

• Dataplane: Fixed the method to compare whether dataplane options are deep equal to ensure that HorizontalPodAutoscaler is updated when it is changed in GatewayConfiguration. Also fixed the calculation of the spec hash in the Deployment to skip reconciliation of deployments if only deployment.scaling is changed in dataplane options. #5003 #5105
• Konnect entities: Fix truncating of tags to cut at 128 unicode runes (UTF8 code points). #5306 #5371
• Hybrid gateway: Propagate tags in the annotation konghq.com/tags in KongPlugins to the copies when attached to HTTPRoutes and GRPCRoutes to propagate the tags in KongPlugins’ annotation to plugins in Konnect. #5280 #5284 #5400

Release date: 2026-07-14

Fixes

• Preserve only one CA certificate from secrets if there are multiple ones with the duplicate IDs. #4876

Release date: 2026-07-01

Fixes

• Prevent recreating consumer credentials on every Konnect sync when running in “KIC in Konnect” mode with on-prem ControlPlane. #4623 #4624
• Hybridgateway: merge HTTPRoute filters that map to the same Kong plugin type (for example a URLRewrite and a RequestHeaderModifier, both of which translate to request-transformer) into a single KongPlugin per rule. This avoids attaching two plugins of the same type to the same route, which Konnect rejects with a unique-plugin-per-entity constraint error. #4658
• Hybridgateway: fix KongTarget stuck in Programmed=False when multiple backendRef Services in an HTTPRoute or TLSRoute rule resolve to the same pod IP and port. The operator now creates one KongTarget per unique endpoint address across all backendRefs in a rule, merging duplicate endpoints and summing their weights, instead of attempting to create one per backendRef per endpoint which violated Konnect’s upstream/target uniqueness constraint. Note: the KongTarget naming scheme has changed and the backendRef is no longer part of the name hash. All existing KongTarget resources will be orphaned and recreated on the first reconciliation after upgrading. During the transition, both old and new entries may be present in Konnect simultaneously as creation and orphan cleanup are not synchronized. #4509
• Hybridgateway: prevent traffic drops when an HTTPRoute spec change rotates resource names. A cleanup-time gate defers orphan deletion until every desired KongRoute is confirmed bound to its new KongService in Konnect, and an enforce-time gate delays KongService creation until its KongUpstream and all desired KongTargets are Programmed. #4577

Release date: 2026-06-04

Fixes

• Hybridgateway: fix KongCertificate name collisions when a Gateway has multiple listeners using the same port by including listener identity in generated certificate names. Attention: This will re-create CA certificates in Konnect, as it changes the names of the generated KongCertificates. #4382 #4394
• Fixed KonnectExtension changes won’t trigger ControlPlane reconciliations. #4361 #4371
• Revert plugin config sanitization when ControlPlane’s configDump.dumpSensitive isn’t enabled. Due to plugin configuration being dependent on plugin type controller is not able to make an informed decision whether a field is sensitive or not and more importantly whether it has a constrained set of allowed values like e.g. HTTP methods. Users are suggested to block network access to debug endpoints (which are disabled by default) if plugin configuration can contain sensitive information. #4499
• Use the ControlPlane’s own namespace when resolving its KonnectAPIAuthConfiguration reference and when checking the KongReferenceGrant. Previously the namespace of the requesting entity was used, which caused resources that resolve their CP through a parent ref (KongRoute via serviceRef, KongCredential* via consumerRef) to silently fail when the parent’s controlPlaneRef was cross-namespace. #4210
• Fix cross-namespace KongRoute → KongService reference resolution: handleKongServiceRef and GetAPIAuthRefNN (serviceRef branch) now derive the KongService namespace from serviceRef.namespace instead of always using the route’s namespace, so a cross-namespace serviceRef with a valid KongReferenceGrant correctly reaches Programmed=True. The kongRouteRefersToKongService index key and enqueueKongRouteForKongService watch handler are also fixed to use the service’s namespace, ensuring cross-namespace routes are re-queued immediately when the referenced service changes rather than waiting for a full resync. #4212
• Add KongReferenceGrant watch to KongVault and KongConsumerGroup reconcilers. Previously, creating or deleting a grant would not trigger re-reconciliation of these resources until the next full resync cycle. Grant changes now immediately re-queue affected objects. #4219
• KongRoute: when a cross-namespace serviceRef has no KongReferenceGrant, the Programmed condition now transitions to False in the same reconcile pass that sets ResolvedRefs=False/RefNotPermitted. Previously Programmed remained Unknown because the reconciler returned early before calling patchWithProgrammedStatusConditionBasedOnOtherConditions. #4318

Release date: 2026-05-12

Fixes

• TLSRoute readiness by preserving TLSServerName when a ready Admin API client is demoted back to pending #4024 #4028
• Fix endless reconciliation in Konnect controllers when referenced parent objects are not marked as Ready yet. #4048 #4060
• Sanitize the plugin configuration when ControlPlane’s configDump.dumpSensitive isn’t enabled. #4119 #4194
• Changed (potentially breaking): As part of our secure-by-default initiative, everything out of the box relies on defaults from Kong Gateway. It may break existing configurations that relied on previous implicit protocol behavior (access via http will result 426 status code.), when version of Kong Gateway changes.
  • For HTTPRoute, protocol now matches the attached Gateway listener protocol (and when parentRef.sectionName is set, it must match that specific listener). When parentRef.sectionName is not specified it binds to all Gateways listeners.
  • For Ingress, default protocol relies on Kong Gateway, can be set explicitly via konghq.com/protocols: "http" (or https) annotation on particular Ingress. #4067 #4245

Release date: 2026-04-24

Fixes

• Fix Gateway reconcile storm on topologies with multiple listeners sharing the same port and HTTPRoutes with multiple sectionName-scoped parentRefs. The HTTPRoute watch on the Gateway controller now uses GenerationChangedPredicate to ignore status-only updates. #4005 #4017
• Fix counting of route attached to a listener by taking into account hostname intersection between the listener and the route. #3490 4020

Release date: 2026-04-23

Fixes

• Fix a hot loop in the KonnectExtension reconciler when two KonnectExtensions share the same client-certificate Secret: the KongDataPlaneClientCertificate CR is now named after the KonnectExtension instead of the Secret, so each extension gets its own CR in its own Konnect ControlPlane and the reconciler no longer retries Create on every loop or falls back to Konnect’s dp-client-certificates List API. #3961 #3973
• Fix the hybrid gateway translator to set protocols in translated KongRoutes to http,https to avoid 426 errors from Konnect hybrid gateways. #3753 3759
• Revert change in configuring SNIs in ingress-controller when running with local controlplane. #3761 3764
• Fix KongPlugin admission validation when multiple Kong Gateway Admin API clients are discovered: probe plugin schema on every gateway (order-independent), validate only on gateways that expose the plugin, and fall back to the previous single-client behavior when none match. Partial probe failures on one gateway do not reject admission if another gateway exposes the plugin. Avoids false rejections when plugin bundles differ across gateways. #3754 #3835
• Fix ResolvedRefs status condition on HTTPRoute not being updated when a referenced KongPlugin is deleted in self-managed ControlPlane mode. #3206 #3836
• Fix incorrect Konnect API used for target lookup #3910 #3938
• HybridGateway: fix HTTPRoute hostname intersection with Gateway listeners to follow Gateway API semantics. Routes that specify no hostnames now inherit the matching listeners’ hostnames instead of being dropped, wildcard hostnames (* and *.example.com) are supported and intersected with listener hostnames, and wildcards no longer match the bare apex domain. This enables the HTTPRouteHostnameIntersection Gateway API conformance test for Hybrid mode. #4077

Release date: 2026-03-25

Fixes

• Admission webhook now validates HTTPRoute regex patterns before sending configuration to the Admin API. #3213 #3666
• Do not try to list Gateways for namespaces that are not being watched by controller #3625 #3629
• Fix ensureGatewayReferenceStatusRemoved and routeHasKongParentStatus not scoping to the specific Gateway when GatewayNN is set. This could cause one ingress-controller instance to erroneously remove route parent statuses set by another instance managing a different Gateway, breaking cross-namespace HTTPRoute backend references via ReferenceGrant. #3524 #3561
• Fix KonnectGatewayControlPlane not setting Programmed=False when its KonnectAPIAuthConfiguration reference cannot be resolved (e.g. the auth config does not exist, or a cross-namespace reference lacks a KongReferenceGrant). Both APIAuthResolvedRef and Programmed conditions are now set to False atomically. #3526 #3640
• Fix configuring SNIs in ingress-controller when running with local controlplane. #3554 #3667
• Fix reducing Secrets with in use finalizers. #3506#3670
• Fix KongUpstream and KongService names in hybrid mode not taking into account backendless rules. When a rule has no BackendRefs, the generated KongUpsteam and KongService names now include a hash of rule’s other field to avoid naming collisions with other rules that also have no BackendRefs. #3576 #3675
• Fix the on-prem translator to set protocols in translated Kong routes to http,https. #3587 #3681

Release date: 2026-03-05

Fixes

• Fix handling removal of annotations for DataPlane’s Services #3402 #3420
• Fix Gateway controller deleting all DataPlanes when KonnectExtension’s ControlPlaneRefValid condition is temporarily False due to transient Konnect API failures. DataPlanes now continue serving traffic during Konnect connectivity issues. Added NotProgrammed condition reason to differentiate transient failures from permanent reference errors. #3463 #3495

Release date: 2026-02-19

Fixes

• Fix setting up indices for HTTPRoute and Gateway when Konnect controllers are disabled. #3229 #3234
• Fix v2 module #3346 #3353
• Bump Go to 1.25.7 #3230 #3235
• Name of Konnect Gateway Control Plane resource created in Konnect matches the name of the corresponding KonnectGatewayControlPlane resource in Kubernetes (the same random suffix is added). It prevents collisions in Konnect. #3357 #3368
• Use the same defaults for preserve_host and strip_path in for Konnect Gateway Control Plane as in self-managed. #3366 #3377
• Fix not resetting resource errors in ControlPlane’s DB mode from previous Update() calls to prevent stale errors from leaking into subsequent calls. #3315 #3369

Release date: 2026-02-05

Added

• Gateway: Added support for static naming of Gateway resources via the konghq.com/operator-static-naming annotation. When set to true, the DataPlane, ControlPlane, and KonnectGatewayControlPlane resources will be named exactly as the Gateway resource instead of using auto-generated names. #3015
• HybridGateway: Added support to PathPrefixMatch for the URLRewrite HTTPRoute filter. #3039
• HybridGateway: Added comprehensive HTTPRoute converter tests to improve translation stability. #3111
• Support cross namespace references from KongPluginBinding to KongPlugin. For this reference to be allowed, a KongReferenceGrant resource must be created in the namespace of the KongPlugin, allowing access for the KongPluginBinding. #3108
• HybridGateway: Added support to PathPrefixMatch for the RequestRedirect HTTPRoute filter. #3065
• Support cross namespace references from KongRoute to KongService. For this reference to be allowed, a KongReferenceGrant resource must be created in the namespace of the KongService, allowing access for the KongRoute. #3125
• Gracefully handle network errors when communicating with Konnect API. When a network error occurs during Konnect API operations, the operator will patch the resource status conditions to indicate the failure and requeue the reconciliation for a later retry. #3184
• DataPlane: Enable incremental config sync by default when using Konnect as control plane. This improves performance of config syncs for large configurations. #2759
• KongCertificate: Add support for sourcing certificates from Kubernetes Secrets. This allows users to define KongCertificates that reference existing Kubernetes Secrets containing TLS certificate and key data, instead of embedding them inline. #2802
• KongCACertificate: Add support for sourcing CA certificates from Kubernetes Secrets. This allows users to define KongCACertificates that references existing Kubernetes Secrets containing TLS CA certificate instead of embedding them inline #2482
• KongReferenceGrant CRD has been added to allow cross-namespace references among Konnect entities API. This new resource is to be intended as the Kong version of the original Gateway API ReferenceGrant CRD. #2855
• Hybrid Gateway: specify the protocol field of the generated KongService resources #2872
• Hybrid Gateway: the creation and deletion of the Kong resources derived from HTTPRoutes is now performed in multiple steps that account for dependencies among the generated resources. #2857

• Added support for cross namespace references between the following Konnect entities and KonnectGatewayControlPlane

  • KongService
  • KongRoute
  • KongUpstream
  • KongCertificate
  • KongCACertificate
  • KongConsumer
  • KongConsumerGroup
  • KongKey
  • KongKeySet
  • KongVault
  • KongDataPlaneClientCertificate

  To allow these references, users need to define a KongReferenceGrant resource in the namespace of the referenced resource, allowing access to the KonnectGatewayControlPlane. #2892 #2913 #3033 #3040 #3044 #3064 #3069 #3052 #3082 #3086

• Added support for cross namespace references between the following Konnect entities and core Secret

  • KongCertificate
  • KongCACertificate

  To allow these references, users need to define a KongReferenceGrant resource in the namespace of the referenced resource, allowing access to the Secret. #2904

• Hybrid Gateway: The operator now supports configuring TLS termination on Gateway listeners in hybrid mode.When you define a TLS listener on a Gateway resource, the operator will automatically create the necessary KongCertificate and KongSNI resources to configure the data plane. This allows for managing TLS certificates for Gateways in a Kubernetes-native way. #2915
• Cross-namespace references from KonnectGatewayControlPlane to KonnectAPIAuthConfiguration are allowed now and require KongReferenceGrant. Similarly cross-namespace references from HTTPRoute to Service are also supported and require ReferenceGrant in place. #2483
• Hybrid Gateway support: Gateway API objects bound to Gateways programmed in Konnect are converted into Konnect entities and used to configure the hybrid DataPlane. #2134 #2143 #2177 #2260
• Add comprehensive HTTPRoute reconciliation that translates Gateway API HTTPRoutes into Kong-specific resources for hybrid gateway deployments. #2308
• Hybrid Gateway: add support to HTTPRoute hostnames translation #2346
  • Enforce state and cleanup for Kong entities
  • Introduced managedfields package for structured merge diff, including compare, extract, prune, and schema utilities with comprehensive tests.
  • Refactored builder and converter logic for KongRoute, KongService, KongTarget, KongUpstream, and HTTPRoute.
  • Enhanced metadata labeling and reconciliation logic for HTTPRoute; added resource ownership tracking via watches.
  • Added generated schema in zz_generated_schema.go for resource types.
  • Improved and extended unit tests for hybridgateway components. 2355
• Hybrid Gateway: add Konnect specific fields to GatewayConfiguration CRD. #2390 #2405
• Hybrid Gateway: implement granular accepted and programmed conditions for HTTPRoute status This commit introduces comprehensive support for “Accepted” and “Programmed” status conditions on HTTPRoute resources in the hybridgateway controller. The new logic evaluates each ParentReference for controller ownership, Gateway/GatewayClass support, listener matching, and resource programming status. For every relevant Kong resource (KongRoute, KongService, KongTarget, KongUpstream, KongPlugin, KongPluginBinding), the controller sets detailed programmed conditions, providing clear feedback on which resources are operational and which are not. The update also refactors builder and metadata logic to ensure labels and annotations are correctly set for all managed resources, and improves test coverage for label, annotation, and hostname intersection handling. Legacy status controller code is removed, and the reconciliation flow is streamlined to use the new status enforcement and translation logic. This enables more robust troubleshooting and visibility for users, ensuring HTTPRoute status accurately reflects the readiness and configuration of all associated Kong resources. #2400
• ManagedFields: improve pruning of empty fields in unstructured objects
  • Enhance pruneEmptyFields to recursively remove empty maps from slices and maps, including those that become empty after nested pruning.
  • Update logic to remove empty slices and zero-value fields more robustly.
  • Expand and refine unit tests in prune_test.go to cover all edge cases, including:
    • Nested empty maps and slices
    • Removal of empty maps from slices
    • Handling of mixed-type slices
    • Deeply nested pruning scenarios
    • Preservation of non-map elements in slices #2413
• Entity Adoption support: support adopting an existing entity from Konnect to a Kubernetes custom resource for managing the existing entity by KO.
  • Add adoption options to the CRDs supporting adopting entities from Konnect. #2336
  • Add adopt.mode field to the CRDs that support adopting existing entities. Supported modes:
    • match: read-only adoption. The operator adopts the referenced remote entity only when this CR’s spec matches the remote configuration (no writes to the remote system). If they differ, adoption fails and the operator does not take ownership until the spec is aligned.
    • override: The operator overrides the remote entity with the spec in the CR. #2421 #2424
  • Implement the general handling process of adopting an existing entity and adoption procedure for KongServices in match and override mode. #2424
  • Implement the Match mode for adoption for Konnect cloud gateway entities #2429
  • Implement adoption support for KongCertificate, KongCACertificate and KongSNI #2484
  • Implement adoption support for KongVault. #2490
  • Implement adoption for KongKey and KongKeySet resources #2487
  • Implement adoption support for KongConsumer and KongConsumerGroup #2493
  • Implement adoption for KongPluginBinding. #2492
  • Implement adoption support for KongCredentialAPIKey, KongCredentialBasicAuth, KongCredentialACL, KongCredentialJWT, and KongCredentialHMAC #2494
  • Implement adoption support for KongDataPlaneClientCertificate. #2678
• HybridGateway:
  • Added controller-runtime watches for Gateway and GatewayClass resources to the hybridgateway controller.
  • HTTPRoutes are now reconciled when related Gateway or GatewayClass resources change.
  • Improved event mapping and indexing logic for efficient reconciliation.
  • Added unit tests for new watch and index logic. #2419
• Provision hybrid Gateway: implement support for provisioning hybrid Gateways with gateway api Gateway and GatewayConfiguration resources. #2457
• Add support to HTTPRoute RequestRedirect filter #2470
• Add CLI flag --enable-fqdn-mode to enable Fully Qualified Domain Name (FQDN) mode for service discovery. When enabled, Kong targets are configured to use service FQDNs (e.g., service.namespace.svc.cluster.local) instead of individual pod endpoint IPs. #2607
• Gateway: support per-Gateway infrastructure configuration GEP-1867 via GatewayConfiguration CRD. #2653
• HybridGateway: reworked generated resources lifecycle management. HTTPRoute ownership on the resources is now tracked through the gateway-operator.konghq.com/hybrid-routes annotation. The same generated resource can now be shared among different HTTPRoutes. #2656
• HybridGateway: implemented ExtensionRef filters to allow reference of self-managed plugins from HTTPRoutes’ filters. #2715
• KonnectAPIAuthConfiguration resources now have automatic finalizer management to prevent deletion when they are actively referenced by other Konnect resources (KonnectGatewayControlPlane, KonnectCloudGatewayNetwork, KonnectExtension). The finalizer konnect.konghq.com/konnectapiauth-in-use is automatically added when references exist and removed when all referencing resources are deleted. #2726
• Add the following configuration flags for setting the maximum number of concurrent reconciliation requests that can be processed by each controller group:
  • --max-concurrent-reconciles-dataplane-controller for DataPlane controllers.
  • --max-concurrent-reconciles-controlplane-controller for ControlPlane controllers.
  • --max-concurrent-reconciles-gateway-controller for Gateway controllers.

  NOTE: Konnect entities controllers still respect the --konnect-controller-max-concurrent-reconciles flag. #2652

Changed

• Removed the KonnectID type of control plane reference in CRDs for Konnect entities as it is not supported. #2966
• Move management of bootstrapping CA certificate (that is used for signing certificates for ControlPlane - DataPlane communication) to Helm Chart, deprecate flags --cluster-ca-key-type and --cluster-ca-key-size now those values are inferred automatically based on the CA certificate Secret. Read more in Helm Chart release notes. #3084
• HybridGateway: Include readable backend context in generated KongService and KongUpstream names (with stable hashes) to improve UX in Konnect. #3121
• kong/kong-gateway v3.12 is the default proxy image. #2391
• For Hybrid Gateways the operator does not run the ControlPlane anymore, as the DataPlane is configured to use Koko as Konnect control plane. #2253
• HybridGateway auto-generated resource names has been revised. #2566
• Update Gateway API to 1.4.0 and k8s libraries to 1.34. #2451
• DataPlane’s spec.network.services.ingress.ports now allows up to 64 ports to be specified. This aligns DataPlane with Gateway APIs’ Gateway. #2722
• In Konnect controllers, ignore NotFound errors when removing the finalizer from the resource. #2911

Fixes

• Fix validation logic for dataplane ports in admission policy. #3031
• Add maxLength and pattern validations for KongConsumer and KongConsumerGroup fields. #3109
• Gateway: Sort Gateway/DataPlane status addresses deterministically with hostname-first priority. #3110
• HybridGateway: Fixed the logic of translating HTTPRoute path matches to paths in the generated KongRoute. #2996
• HybridGateway: Add the ~* prefix to mark the header should be matched by regular expression in the translated KongRoute when the HTTPRoute’s header match has the RegularExpression type. #2995
• Fixes a panic in KonnectExtension controller when Control Plane is not found. #3054
• Fixed an issue where users could set the secret of configmap label selectors to empty when the other one was left non-empty. #2810
• Handle Konnect API 429 rate limit responses by requeuing resources with the appropriate retry-after duration from the response header. #2856
• Hybrid Gateway: generate a single KongRoute for each HTTPRoute Rule #2417
• Fix issue with deletion of KonnectExtension when the referenced KonnectGatewayControlPlane is deleted (it used to hang indefinitely). #2423
• Hybrid Gateway: add watchers for KongPlugin and KongPluginBinding #2427
• Hybrid Gateway: attach KongService generation to BackendRefs and fix filter/plugin conversion. #2456
• Translate healthchecks.threshold in KongUpstreamPolicy to the healthchecks.threshold field in Kong upstreams. #2662
• Reject CA Secrets with multiple PEM certs. #2671
• Fix the default values of combinedServicesFromDifferentHTTPRoutes and drainSupport in ControlPlaneTranslationOptions not being set correctly. #2589
• Fix random, unexpected and invalid validation error during validation of HTTPRoutes for Gateways configured in different namespaces with GatewayConfiguration that has field spec.controlPlaneOptions.watchNamespaces.type set to own. #2717
• Gateway controllers now watch changes on Secrets referenced by spec.listeners.tls.certificateRef, ensuring Gateway status conditions are updated when referenced certificates change. #2661

Release date: 2026-08-27

Fixes

• Konnect entities: Fix truncating of tags to cut at 128 unicode runes (UTF8 code points). #5306 #5372
• Dataplane: Fixed the method to compare whether dataplane options are deep equal to ensure that HorizontalPodAutoscaler is updated when it is changed in GatewayConfiguration. Also fixed the calculation of the spec hash in the Deployment to skip reconciliation of deployments if only deployment.scaling is changed in dataplane options. #5003 #5373

Release date: 2026-07-21

Fixes

• Preserve only one CA certificate from secrets if there are multiple ones with the duplicate IDs. #4875

Release date: 2026-06-04

Fixes

• Fixed KonnectExtension changes won’t trigger ControlPlane reconciliations. #4361 #4370

Release date: 2026-04-23

Fixed

• Fix a hot loop in the KonnectExtension reconciler when two KonnectExtensions share the same client-certificate Secret: the KongDataPlaneClientCertificate CR is now named after the KonnectExtension instead of the Secret, so each extension gets its own CR in its own Konnect ControlPlane and the reconciler no longer retries Create on every loop or falls back to Konnect’s dp-client-certificates List API. #3961 #3978
• Fix incorrect Konnect API used for target lookup #3910 #3939

Release date: 2026-03-24

Fixed

• Do not try to list Gateways for namespaces that are not being watched by controller #3625
• Fix the on-prem translator to set protocols in translated Kong routes to http,https. #3587

Release date: 2026-02-19

Fixed

• Fixed an issue where users could set the secret of configmap label selectors to empty when the other one was left non-empty. #2815
• Bump Go to 1.25.7 and fix v2 module #3355

Release date: 2025-12-01

Fixes

• Translate healtchchecks.thershold in KongUpstreamPolicy to the healthchecks.thershold field in Kong upstreams. #2662
• Fix random, unexpected and invalid validation error during validation of HTTPRoutes for Gateways configured in different namespaces with GatewayConfiguration that has field spec.controlPlaneOptions.watchNamespaces.type set to own. #2717
• Reject CA Secrets with multiple PEM certs. #2671
• Gateway controllers now watch changes on Secrets referenced by spec.listeners.tls.certificateRef, ensuring Gateway status conditions are updated when referenced certificates change. #2661
• Trigger reconciliation events on KongPlugins upon changes on KongPluginBinding. #2637

Release date: 2025-10-17

Fixes

• Fix DataPlane’s volumes and volume mounts patching when specified by user #2425
• Do not cleanup nulls in the configuration of plugins with Kong running in DBLess mode in the translator of ingress-controller. This enables user to use explicit nulls in plugins. #2459

Release date: 2025-10-03

Fixes

• Fix problem with starting operator when Konnect is enabled and conversion webhook disabled. #2392

Release date: 2025-09-30

Fixes

• Do not validate Secrets and ConfigMaps that are used internally by the operator. This prevents issues when those resources are created during bootstrapping of the operator, before the validating webhook is ready. #2356
• Add the status.clusterType in KonnectGatewayControlPlane and set it when KO attached the KonnectGatewayControlPlane with the control plane in Konnect. The KonnectExtension now get the cluster type to fill its status.konnect.clusterType from the statusType of KonnectGatewayControlPlane to fix the incorrect cluster type filled in the status when the control plane is mirrored from an existing control plane in Konnect. #2343

Release date: 2025-09-22

Fixes

• Cleanup old objects when new ControlPlane is ready. Remove old finalizers from ControlPlane when cleanup is done. #2317
• Mark Gateway’s listeners as Programmed when DataPlane and its Services are ready. This prevents downtime during KGO -> KO upgrades and in upgrades between KO versions. #2317

Release date: 2025-09-17

Fixes

• Fix incorrect error handling during cluster CA secret creation. #2250
• DataPlane is now marked as ready when status.AvailableReplicas is at least equal to status.Replicas. #2291

Release date: 2025-09-09

KGO becomes KO, which stands for Kong Operator. Kubernetes Gateway Operator and Kubernetes Ingress Controller become a single product. Furthermore, Kong Operator provides all features that used to be reserved for the Enterprise flavor of Kong Gateway Operator.

Breaking Changes

• KonnectExtension has been bumped to v1alpha2 and the Control plane reference via plain KonnectID has been removed. Mirror GatewayControlPlane resource is now the only way to reference remote control planes in read-only. #1711
• Rename product from Kong Gateway Operator to Kong Operator. #1767
• Add --cluster-domain flag and set default to 'cluster.local' This commit introduces a new --cluster-domain flag to the KO binary, which is now propagated to the ingress-controller. The default value for the cluster domain is set to 'cluster.local', whereas previously it was an empty string (''). This is a breaking change, as any code or configuration relying on the previous default will now use 'cluster.local' unless explicitly overridden. #1870
• Introduce ControlPlane in version v2alpha1
  • Usage of the last valid config for fallback configuration is enabled by default, can be adjusted in the spec.translation.fallbackConfiguration.useLastValidConfig field. #1939
• ControlPlane v2alpha1 has been replaced by ControlPlane v2beta1. GatewayConfiguration v2alpha1 has been replaced by GatewayConfiguration v2beta1. #2008
• Add flags --secret-label-selector and --config-map-label-selector to filter watched Secrets and ConfigMaps. Only secrets or configMaps with the given label to true are reconciled by the controllers. For example, if --secret-label-selector is set to konghq.com/secret, only Secrets with the label konghq.com/secret=true are reconciled. The default value of the two labels are set to konghq.com/secret and konghq.com/configmap. #1922
• GatewayConfiguration v1beta1 has been replaced by the new API version v2alpha1. The GatewayConfiguration v1beta1 is still available but has been marked as deprecated. #1792
• Removed KongIngress, TCPIngress and UDPIngress CRDs together with their controllers. For migration guidance from these resources to Gateway API, please refer to the migration documentation. #1971
• Change env vars prefix from GATEWAY_OPERATOR_ to KONG_OPERATOR_. GATEWAY_OPERATOR_ prefixed env vars are still accepted but reported as deprecated. #2004

Added

• Support for cert-manager certificate provisioning for webhooks in Helm Chart. #2122
• Support specifying labels to filter watched Secrets and ConfigMaps of each ControlPlane by spec.objectFilters.secrets.matchLabels and spec.objectFilters.configMaps.matchLabels. Only secrets or configmaps that have the labels matching the specified labels in spec are reconciled. If Kong operator has also flags --secret-label-selector or --config-map-label-selector set, the controller for each ControlPlane also requires reconciled secrets or configmaps to set the labels given in the flags to true. #1982
• Add conversion webhook for KonnectGatewayControlPlane to support seamless conversion between old v1alpha1 and new v1alpha2 API versions. #2023
• Add Konnect related configuration fields to ControlPlane spec, allowing fine-grained control over Konnect integration settings including consumer synchronization, licensing configuration, node refresh periods, and config upload periods. #2009
• Added OptionsValid condition to ControlPlanes’ status. The status is set to True if the ControlPlane’s options in its spec is valid and set to False if the options are invalid against the operator’s configuration. #2070
• Added APIConversion interface to bootstrap Gateway API support in Konnect hybrid mode. #2134
• Move implementation of ControlPlane Extensions mechanism and DataPlaneMetricsExtension from EE. #1583
• Move implementation of certificate management for Konnect DPs from EE. #1590
• ControlPlane status fields controllers and featureGates are filled in with actual configured values based on the defaults and the spec fields. #1771
• Added the following CLI flags to control operator’s behavior:
  • --cache-sync-timeout to control controller-runtime’s time limit set to wait for syncing caches. #1818
  • --cache-sync-period to control controller-runtime’s cache sync period. #1846
• Support the following configuration for running control plane managers in the ControlPlane CRD:
  • Specifying the delay to wait for Kubernetes object caches sync before updating dataplanes by spec.cache.initSyncDuration #1858
  • Specifying the period and timeout of syncing Kong configuration to dataplanes by spec.dataplaneSync.interval and spec.dataplaneSync.timeout #1886
  • Specifying the combined services from HTTPRoutes feature via by spec.translation.combinedServicesFromDifferentHTTPRoutes #1934
  • Specifying the drain support by spec.translation.drainSupport #1940
• Introduce flags --apiserver-host for API, --apiserver-qps and --apiserver-burst to control the QPS and burst (rate-limiting) for the Kubernetes API server client. #1887
• Introduce the flag --emit-kubernetes-events to enable/disable the creation of Kubernetes events in the ControlPlane. The default value is true. #1888
• Added the flag --enable-controlplane-config-dump to enable debug server for dumping Kong configuration translated from ControlPlanes and flag --controlplane-config-dump-bind-address to set the bind address of server. You can access GET /debug/controlplanes to list managed ControlPlanes and get response like {"controlPlanes":[{"namespace":"default","name":"kong-12345","id":"abcd1234-..."}]} listing the namespace, name and UID of managed ControlPlanes. Calling GET /debug/controlplanes/namespace/{namespace}/name/{name}/config/{req_type} can dump Kong configuration of a specific ControlPlane. This endpoint is only available when the ControlPlane’s spec.configDump.state is set to enabled. The {req_type} stands for the request type of dumping configuration. Supported {req_type}s are:
  • successful for configuration in the last successful application.
  • failed for configuration in the last failed application.
  • fallback for configuration applied in the last fallback procedure.
  • raw-error for raw errors returned from the dataplane in the last failed application.
  • diff-report for summaries of differences between the last applied configuration and the configuration in the dataplane before that application. It requires the ControlPlane set spec.configDump.dumpSensitive to enabled. #1894
• Introduce the flag --watch-namespaces to specify which namespaces the operator should watch for configuration resources. The default value is "" which makes the operator watch all namespaces. This flag is checked against the ControlPlane’s spec.watchNamespaces field during ControlPlane reconciliation and if incompatible, ControlPlane reconciliation returns with an error. #1958 #1974
• Refactored Konnect extension processing for ControlPlane and DataPlane resources by introducing the ExtensionProcessor interface. This change enables KonnecExtensions for ControlPlane v2alpha1. #1978

Changes

• ControlPlane provisioned conditions’ reasons have been renamed to actually reflect the new operator architecture. PodsReady is now Provisioned and PodsNotReady is now ProvisioningInProgress. #1985
• Vendor gateway-operator CRDs locally and switch Kustomize to use the vendored source. #2195
• kong/kong-gateway v3.11 is the default proxy image. #2212

Fixes

• Do not check “Programmed” condition in status of Gateway listeners in extracting certificates in controlplane’s translation of Kong configuration. This fixes the disappearance of certificates when deployment status of DataPlane owned by the gateway (including deletion of pods, rolling update of dataplane deployment, scaling of dataplane and so on). #2038
• Correctly assume default Kong router flavor is traditional_compatible when KONG_ROUTER_FLAVOR is not set. This fixes incorrectly populated GatewayClass.status.supportedFeatures when the default was assumed to be expressions. #2043
• Support setting exposed nodeport of the dataplane service for Gateways by nodePort field in spec.listenersOptions. #2058
• Fixed lack of instance_name and protocols reconciliation for KongPluginBinding when reconciling against Konnect. #1681
• The KonnectExtension status is kept updated when the KonnectGatewayControlPlane is deleted and re-created. When this happens, the KonnectGatewayControlPlane sees its Konnect ID changed, as well as the endpoints. All this data is constantly enforced into the KonnectExtension status. #1684
• Fix the issue that invalid label value causing ingress controller fails to store the license from Konnect into Secret. #1976
• Fixed a missing watch in GatewayClass reconciler for related GatewayConfiguration resources. #2161

Release date: 2025-07-11

Fixes

• Ignore the ForbiddenError in sdk-konnect-go returned from running CRUD operations against Konnect APIs. This prevents endless reconciliation when an operation is not allowed (due to e.g. exhausted quota). #1811

Release date: 2025-05-22

• Allowed the kubectl rollout restart operation for Deployment resources created via DataPlane CRD. #1660

Release date: 2025-05-07

Added

• In KonnectGatewayControlPlane fields Status.Endpoints.ControlPlaneEndpoint and Status.Endpoints.TelemetryEndpoint are filled with respective values from Konnect. #1415
• Add namespacedRef support for referencing networks in KonnectCloudGatewayDataPlaneGroupConfiguration #1423
• Introduced new CLI flags:
  • --logging-mode (or GATEWAY_OPERATOR_LOGGING_MODE env var) to set the logging mode (development can be set for simplified logging).
  • --validate-images (or GATEWAY_OPERATOR_VALIDATE_IMAGES env var) to enable ControlPlane and DataPlane image validation (it’s set by default to true). #1435
• Add support for -enforce-config for ControlPlane’s ValidatingWebhookConfiguration. This allows to use operator’s ControlPlane resources in AKS clusters. #1512
• KongRoute can be migrated from serviceless to service bound and vice versa. #1492
• Add KonnectCloudGatewayTransitGateway controller to support managing Konnect transit gateways. #1489
• Added support for setting PodDisruptionBudget in GatewayConfiguration’s DataPlane options. #1526
• Added spec.watchNamespace field to ControlPlane and GatewayConfiguration CRDs to allow watching resources only in the specified namespace. When spec.watchNamespace.type=list is used, each specified namespace requires a WatchNamespaceGrant that allows the ControlPlane to watch resources in the specified namespace. Aforementioned list is extended with ControlPlane’s own namespace which doesn’t require said WatchNamespaceGrant. #1388 #1410 #1555 For more information on this please see: https://developer.konghq.com/operator/reference/control-plane-watch-namespaces/#controlplane-s-watchnamespaces-field
• Implemented Mirror and Origin KonnectGatewayControlPlanes. #1496

Changes

• Deduce KonnectCloudGatewayDataPlaneGroupConfiguration region based on the attached KonnectAPIAuthConfiguration instead of using a hardcoded eu value. #1409
• Support NodePort as ingress service type for DataPlane #1430
• Allow setting NodePort port number for ingress service for DataPlane. #1516
• Updated kubernetes-configuration dependency for adding scale subresource for DataPlane CRD. #1523
• Bump kong/kubernetes-configuration dependency to v1.4.0 #1574

Fixes

• Fix setting the defaults for GatewayConfiguration’s ReadinessProbe when only timeouts and/or delays are specified. Now the HTTPGet field is set to /status/ready as expected with the Gateway scenario. #1395
• Fix ingress service name not being applied when using GatewayConfiguration. #1515
• Fix ingress service port name setting. #1524

Release date: 2025-04-01

Added

• Add namespacedRef support for referencing networks in KonnectCloudGatewayDataPlaneGroupConfiguration #1425
• Set ControlPlaneRefValid condition to false when reference to KonnectGatewayControlPlane is invalid #1421

Changes

• Deduce KonnectCloudGatewayDataPlaneGroupConfiguration region based on the attached KonnectAPIAuthConfiguration instead of using a hardcoded eu value. #1417
• Bump kong/kubernetes-configuration dependency to v1.3.

Release date: 2025-03-11

Breaking Changes

• Added check of whether using Secret in another namespace in AIGateway’s spec.cloudProviderCredentials is allowed. If the AIGateway and the Secret referenced in spec.cloudProviderCredentials are not in the same namespace, there MUST be a ReferenceGrant in the namespace of the Secret that allows the AIGateways to reference the Secret. This may break usage of AIGateways that is already using Secret in other namespaces as AI cloud provider credentials. #1161
• Migrate KGO CRDs to the kubernetes-configuration repo. With this migration process, we have removed the api and pkg/clientset from the KGO repo. This is a breaking change which requires manual action for projects that use operator’s Go APIs. In order to migrate please use the import paths from the kong/kubernetes-configuration repo instead. For example: github.com/kong/kong-operator/api/v1beta1 becomes github.com/kong/kubernetes-configuration/api/gateway-operator/v1beta1. #1148
• Support for the konnect-extension.gateway-operator.konghq.com CRD has been interrupted. The new API konnect-extension.konnect.konghq.com must be used instead. The migration path is described in the Kong documentation. #1183
• Migrate KGO CRDs conditions to the kubernetes-configuration repo. With this migration process, we have moved all conditions from the KGO repo to kubernetes-configuration. This is a breaking change which requires manual action for projects that use operator’s Go conditions types. In order to migrate please use the import paths from the kong/kubernetes-configuration repo instead. #1281 #1305 #1306 #1318

Added

• Added Name field in ServiceOptions to allow specifying name of the owning service. Currently specifying ingress service of DataPlane is supported. #966
• Added support for global plugins with KongPluginBinding’s scope field. The default value is OnlyTargets which means that the plugin will be applied only to the targets specified in the targets field. The new alternative is GlobalInControlPlane that will make the plugin apply globally in a control plane. #1052
• Added -cluster-ca-key-type and -cluster-ca-key-size CLI flags to allow configuring cluster CA private key type and size. Currently allowed values: rsa and ecdsa (default). #1081
• The GatewayClass Accepted Condition is set to False with reason InvalidParameters in case the .spec.parametersRef field is not a valid reference to an existing GatewayConfiguration object. #1021
• The SupportedFeatures field is properly set in the GatewayClass status. It requires the experimental version of Gateway API (as of v1.2.x) installed in your cluster, and the flag --enable-gateway-api-experimental set. #1010
• Added support for KongConsumer credentials in Konnect entities support. Users can now specify credentials for KongConsumers in Secrets and reference them in KongConsumers’ credentials field.
  • basic-auth #1120
  • key-auth #1168
  • acl #1187
  • jwt #1208
  • hmac #1222
• Added prometheus metrics for Konnect entity operations in the metrics server:
  • gateway_operator_konnect_entity_operation_count for number of operations.
  • gateway_operator_konnect_entity_operation_duration_milliseconds for duration of operations. #953
• Added support for KonnectCloudGatewayNetwork CRD which can manage Konnect Cloud Gateway Network entities. #1136
• Reconcile affected KonnectExtensions when the Secret used as Dataplane certificate is modified. A secret must have the konghq.com/konnect-dp-cert label to trigger the reconciliation. #1250
• When the DataPlane is configured in Konnect, the /status/ready endpoint is set as the readiness probe. #1235
• Added support for KonnectDataPlaneGroupConfiguration CRD which can manage Konnect Cloud Gateway DataPlane Group configurations entities. #1186
• Supported KonnectExtension to attach to Konnect control planes by setting namespace and name of KonnectGatewayControlPlane in spec.konnectControlPlane. #1254
• Added support for KonnectExtensions on ControlPlanes. #1262
• Added support for KonnectExtension’s status controlPlaneRefs and dataPlaneRefs fields. #1297
• Added support for KonnectExtensions on Gateways via GatewayConfiguration extensibility. #1292
• Added -enforce-config flag to enforce the configuration of the ControlPlane and DataPlane Deployments. #1307
• Added Automatic secret provisioning for KonnectExtension certificates. #1304

Changed

• KonnectExtension does not require spec.serverHostname to be set by a user anymore - default is set to konghq.com. #947
• Support KIC 3.4 #972
• Allow more than 1 replica for ControlPlane’s Deployment to support HA deployments of KIC. #978
• Removed support for the migration of legacy labels so upgrading the operator from 1.3 (or older) to 1.5.0, should be done through 1.4.1 #976
• Move ControlPlane image validation to CRD CEL rules. #984
• Remove usage of kube-rbac-proxy. Its functionality of can be now achieved by using the new flag --metrics-access-filter (or a corresponding GATEWAY_OPERATOR_METRICS_ACCESS_FILTER env). The default value for the flag is off which doesn’t restrict the access to the metrics endpoint. The flag can be set to rbac which will configure KGO to verify the token sent with the request. For more information on this migration please consult kubernetes-sigs/kubebuilder#3907. #956
• Move DataPlane ports validation to ValidationAdmissionPolicy and ValidationAdmissionPolicyBinding. #1007
• Move DataPlane db mode validation to CRD CEL validation expressions. With this change only the KONG_DATABASE environment variable directly set in the podTemplateSpec is validated. EnvFrom is not evaluated anymore for this validation. #1049
• Move DataPlane promotion in progress validation to CRD CEL validation expressions. This is relevant for DataPlanes with BlueGreen rollouts enabled only. #1054
• Move DataPlane’s rollout strategy validation of disallowed AutomaticPromotion to CRD CEL validation expressions. This is relevant for DataPlanes with BlueGreen rollouts enabled only. #1056
• Move DataPlane’s rollout resource strategy validation of disallowed DeleteOnPromotionRecreateOnRollout to CRD CEL validation expressions. This is relevant for DataPlanes with BlueGreen rollouts enabled only. #1065
• The GatewayClass Accepted Condition is set to False with reason InvalidParameters in case the .spec.parametersRef field is not a valid reference to an existing GatewayConfiguration object. #1021
• Validating webhook is now disabled by default. At this point webhook doesn’t perform any validations. These were all moved either to CRD CEL validation expressions or to the ValidationAdmissionPolicy. Flag remains in place to not cause a breaking change for users that rely on it. #1066
• Remove ValidatingAdmissionWebhook from the operator. As of now, all the validations have been moved to CRD CEL validation expressions or to the ValidationAdmissionPolicy. All the flags that were configuring the webhook are now deprecated and do not have any effect. They will be removed in next major release. #1100
• Konnect entities that are attached to a Konnect CP through a ControlPlaneRef do not get an owner relationship set to the ControlPlane anymore hence they are not deleted when the ControlPlane is deleted. #1099
• Remove the owner relationship between KongService and KongRoute. #1178
• Remove the owner relationship between KongTarget and KongUpstream. #1279
• Remove the owner relationship between KongCertificate and KongSNI. #1285
• Remove the owner relationship between KongKeys and KongKeysSets and KonnectGatewayControlPlanes. #1291
• Check whether an error from calling Konnect API is a validation error by HTTP status code in Konnect entity controller. If the HTTP status code is 400, we consider the error as a validation error and do not try to requeue the Konnect entity. #1226
• Credential resources used as Konnect entities that are attached to a KongConsumer resource do not get an owner relationship set to the KongConsumer anymore hence they are not deleted when the KongConsumer is deleted. #1259

Fixes

• Fix DataPlanes with KonnectExtension and BlueGreen settings. Both the Live and preview deployments are now customized with Konnect-related settings. #910
• Remove RunAsUser specification in jobs to create webhook certificates because Openshift does not specifying RunAsUser by default. #964
• Fix watch predicates for types shared between KGO and KIC. #948
• Fix unexpected error logs caused by passing an odd number of arguments to the logger in the KongConsumer reconciler. #983
• Fix checking status when using a KonnectGatewayControlPlane with KIC CP type as a ControlPlaneRef. #1115
• Fix setting DataPlane’s readiness probe using GatewayConfiguration. #1118
• Fix handling Konnect API conflicts. #1176

Release date: 2025-01-23

Fixes

• Bump kong/kubernetes-configuration dependency to v1.0.8 that fixes the issue with spec.headers in KongRoute CRD by aligning to the expected schema (instead of map[string]string, it should be map[string][]string). Please make sure you update the KGO channel CRDs accordingly in your cluster: kustomize build github.com/Kong/kubernetes-configuration/config/crd/gateway-operator\?ref=v1.0.8 | kubectl apply -f - #1072

Release date: 2024-11-28

Fixes

• Fix setting the ServiceAccountName for DataPlane’s Deployment. #897
• Fixed setting ExternalTrafficPolicy on DataPlane’s ingress Service when the requested value is empty. #898
• Set 0 members on KonnectGatewayControlPlane which type is set to group. #896
• Fixed a panic in KonnectAPIAuthConfigurationReconciler occurring when nil response was returned by Konnect API when fetching the organization information. #901
• Bump sdk-konnect-go version to 0.1.10 to fix handling global API endpoints. #894

Release date: 2024-10-31

Added

• Proper User-Agent header is now set on outgoing HTTP requests. #387
• Introduce KongPluginInstallation CRD to allow installing custom Kong plugins distributed as container images. #400, #424, #474, #560, #615, #476
• Extended DataPlane API with a possibility to specify PodDisruptionBudget to be created for the DataPlane deployments via spec.resources.podDisruptionBudget. #464
• Add KonnectAPIAuthConfiguration reconciler. #456
• Add support for Konnect tokens in Secrets in KonnectAPIAuthConfiguration reconciler. #459
• Add KonnectControlPlane reconciler. #462
• Add KongService reconciler for Konnect control planes. #470
• Add KongUpstream reconciler for Konnect control planes. #593
• Add KongConsumer reconciler for Konnect control planes. #493
• Add KongRoute reconciler for Konnect control planes. #506
• Add KongConsumerGroup reconciler for Konnect control planes. #510
• Add KongCACertificate reconciler for Konnect CA certificates. #626
• Add KongCertificate reconciler for Konnect Certificates. #643
• Added command line flags to configure the certificate generator job’s images. #516
• Add KongPluginBinding reconciler for Konnect Plugins. #513, #535
• Add KongTarget reconciler for Konnect Targets. #627
• Add KongVault reconciler for Konnect Vaults. #597
• Add KongKey reconciler for Konnect Keys. #646
• Add KongKeySet reconciler for Konnect KeySets. #657
• Add KongDataPlaneClientCertificate reconciler for Konnect DataPlaneClientCertificates. #694
• The KonnectExtension CRD has been introduced. Such a CRD can be attached to a DataPlane via the extensions field to have a konnect-flavored DataPlane. #453, #578, #736
• Entities created in Konnect are now labeled (or tagged for those that does not support labels) with origin Kubernetes object’s metadata: k8s-name, k8s-namespace, k8s-uid, k8s-generation, k8s-kind, k8s-group, k8s-version. #565
• Add KongService, KongRoute, KongConsumer, and KongConsumerGroup watchers in the KongPluginBinding reconciler. #571
• Annotating the following resource with the konghq.com/plugins annotation results in the creation of a managed KongPluginBinding resource:
  • KongService #550
  • KongRoute #644
  • KongConsumer #676
  • KongConsumerGroup #684 These KongPluginBindings are taken by the KongPluginBinding reconciler to create the corresponding plugin objects in Konnect.
• KongConsumer associated with ConsumerGroups is now reconciled in Konnect by removing/adding the consumer from/to the consumer groups. #592
• Add support for KongConsumer credentials:
  • basic-auth #625
  • API key #635
  • ACL #661
  • JWT #678
  • HMAC Auth #687
• Add support for KongRoutes bound directly to KonnectGatewayControlPlanes (serviceless routes). #669
• Allow setting KonnectGatewayControlPlanes group membership #697
• Apply Konnect-related customizations to DataPlanes that properly reference KonnectExtension resources. #714
• The KonnectExtension functionality is enabled only when the --enable-controller-konnect flag or the GATEWAY_OPERATOR_ENABLE_CONTROLLER_KONNECT env var is set. #738

Fixes

• Fixed ControlPlane cluster wide resources not migrating to new ownership labels (introduced in 1.3.0) when upgrading the operator from 1.2 (or older) to 1.3.0. #369
• Requeue instead of reporting an error when a finalizer removal yields a conflict. #454
• Requeue instead of reporting an error when a GatewayClass status update yields a conflict. #612
• Guard object counters with checks whether CRDs for them exist #710
• Do not reconcile Gateways nor assign any finalizers when the referred GatewayClass is not supported. #711
• Fixed setting ExternalTrafficPolicy on DataPlane’s ingress Service during update and patch operations. #750
• Fixed setting ExternalTrafficPolicy on DataPlane’s ingress Service. Remove the default value (Cluster). Prevent setting this field for ClusterIP Services. #812

Changes

• Default version of ControlPlane is bumped to 3.3.1 #580
• Default version of DataPlane is bumped to 3.8.0 #572
• Gateway API has been bumped to v1.2.0 #674

Release date: 2024-06-24

Added

• Add ExternalTrafficPolicy to DataPlane’s ServiceOptions #241

Breaking Changes

• Changes project layout to match kubebuilder v4. Some import paths (due to dir renames) have changed apis -> api and controllers -> controller. #84

Changes

• Gateway do not have their Ready status condition set anymore. This aligns with Gateway API and its conformance test suite. #246
• Gateways’ listeners now have their attachedRoutes count filled in the status. #251
• Detect when ControlPlane has its admission webhook disabled via CONTROLLER_ADMISSION_WEBHOOK_LISTEN environment variable and ensure that relevant webhook resources are not created/deleted. #326
• The OwnerReferences on cluster-wide resources to indicate their owner are now replaced by a proper set of labels to identify kind, namespace, and name of the owning object. #259
• Default version of ControlPlane is bumped to 3.2.0 #327

Fixes

• Fix enforcing up to date ControlPlane’s ValidatingWebhookConfiguration #225