Usage:
kongctl create mesh [flags]
kongctl create mesh [command]
Examples:
# Issue a token that proves a zone's identity to the global control plane
kongctl create mesh zone-token --zone zone1 --valid-for 720h --control-plane-id <id>
# Issue a token that proves a dataplane's identity
kongctl create mesh dataplane-token --mesh default --name backend-01 --control-plane-id <id>
# Mesh resources are written with apply, since a write creates or replaces
kongctl apply mesh -f policy.yaml --control-plane-id <id>
Available Commands:
dataplane-token Issue a token that proves a dataplane's identity
zone-token Issue a token that proves a zone's identity
Flags:
--all-meshes List mesh scoped resources across every mesh instead of one. Ignored for global types.
- Config path: [ konnect.mesh.all-meshes ]
--base-url string Base URL for Konnect API requests.
- Config path: [ konnect.base-url ]
- Default : [ https://us.api.konghq.com ]
--ca-cert-file string Path to a CA certificate that verifies a self managed control plane.
- Config path: [ konnect.mesh.control-plane.ca-cert-file ]
--client-cert-file string Path to a client certificate presented to a self managed control plane.
- Config path: [ konnect.mesh.control-plane.client-cert-file ]
--client-key-file string Path to the key for --client-cert-file.
- Config path: [ konnect.mesh.control-plane.client-key-file ]
--color-theme string Configures the CLI UI/theme (prompt, tables, TUI elements).
- Config path: [ color-theme ]
- Examples : [ auto, 3024_day, 3024_night, aardvark_blue, abernathy ]
- Reference : [ https://github.com/lrstanley/bubbletint/blob/master/DEFAULT_TINTS.md ] (default "auto")
--config-file string Path to the configuration file to load.
- Environment variable: KONGCTL_CONFIG_FILE (overridden by this flag)
- Default: [ $XDG_CONFIG_HOME/kongctl/config.yaml ]
--control-plane-id string ID of the Konnect Kong Mesh control plane to use.
- Config path: [ konnect.mesh.control-plane.id ]
--control-plane-name string Name of the Konnect Kong Mesh control plane to use.
- Config path: [ konnect.mesh.control-plane.name ]
--control-plane-token string Bearer token for a self managed control plane. Not used for a Konnect hosted one.
- Config path: [ konnect.mesh.control-plane.token ]
--control-plane-url string API URL of a self managed Kong Mesh control plane. Provide only one control plane selector flag.
- Config path: [ konnect.mesh.control-plane.url ]
-h, --help help for mesh
--jq string Filter JSON responses using jq expressions (powered by gojq for full jq compatibility)
--jq-color string Controls colorized output for jq filter results.
- Config path: [ jq.color.enabled ]
- Allowed : [ auto|always|never ] (default "auto")
--jq-color-theme string Select the color theme used for jq filter results.
- Config path: [ jq.color.theme ]
- Examples : [ friendly, github-dark, dracula ]
- Reference : [ https://xyproto.github.io/splash/docs/ ] (default "friendly")
-r, --jq-raw-output Output string jq results without JSON quotes (like jq -r).
- Config path: [ jq.raw-output ]
--log-file string Write execution logs to the specified file instead of STDERR.
- Config path: [ log-file ]
--log-level string Configures the logging level. Execution logs are written to STDERR.
- Config path: [ log-level ]
- Allowed : [ trace|debug|info|warn|error ] (default "error")
-m, --mesh string Mesh that mesh scoped resources belong to.
- Config path: [ konnect.mesh.mesh ] (default "default")
--no-telemetry Disable telemetry for this command invocation. Overrides config and env.
- Config path: [ telemetry.enabled ]
- Env var : [ KONGCTL_NO_TELEMETRY ]
- Default : [ false ]
--no-trunc Preserve full cell widths in static text tables beyond terminal width.
Does not change column selection, UUID formatting, or explicit string slices.
- Config path: [ text.no-trunc ]
- Default : [ false ]
-o, --output string Configures the format of data written to STDOUT.
- Config path: [ output ]
- Allowed : [ json|yaml|text ] (default "text")
--pat string Konnect Personal Access Token.
- Config path: [ konnect.pat ]
-p, --profile string Specify the profile to use for this command. (default "default")
--region string Konnect region identifier (for example "eu"). Used to construct the base URL when --base-url is not provided.
- Config path: [ konnect.region ]
--text-id-format string Configure UUID rendering in static text-table ID columns.
- Config path: [ text.id-format ]
- Allowed : [ compact|full ]
- Default : [ compact ]
--text-layout string Configure static text-table column selection.
- Config path: [ text.layout ]
- Allowed : [ compact|auto|wide ]
- Default : [ compact ]
--tls-skip-verify Do not verify a self managed control plane's certificate. Prefer --ca-cert-file.
- Config path: [ konnect.mesh.control-plane.tls-skip-verify ]
Use "kongctl create mesh [command] --help" for more information about a command.
Issue a dataplane token from the control plane.
A dataplane token lets kuma-dp prove its identity when it connects. Bind the
token as narrowly as the deployment allows: to a name, to a workload, or to
tags, rather than to the mesh alone.
The token is written to stdout with no trailing newline, so it can be
redirected straight into the file kuma-dp reads.
Usage:
kongctl create mesh dataplane-token [flags]
Aliases:
dataplane-token, dp-token
Examples:
# A token bound to one dataplane, written to a file
kongctl create mesh dataplane-token --name dp-01 --valid-for 24h > /tmp/token
# A token bound to a mesh only
kongctl create mesh dataplane-token -m prod --valid-for 24h
# A token bound to tags
kongctl create mesh dataplane-token --tag kuma.io/service=web --valid-for 24h
Flags:
--all-meshes List mesh scoped resources across every mesh instead of one. Ignored for global types.
- Config path: [ konnect.mesh.all-meshes ]
--base-url string Base URL for Konnect API requests.
- Config path: [ konnect.base-url ]
- Default : [ https://us.api.konghq.com ]
--ca-cert-file string Path to a CA certificate that verifies a self managed control plane.
- Config path: [ konnect.mesh.control-plane.ca-cert-file ]
--client-cert-file string Path to a client certificate presented to a self managed control plane.
- Config path: [ konnect.mesh.control-plane.client-cert-file ]
--client-key-file string Path to the key for --client-cert-file.
- Config path: [ konnect.mesh.control-plane.client-key-file ]
--color-theme string Configures the CLI UI/theme (prompt, tables, TUI elements).
- Config path: [ color-theme ]
- Examples : [ auto, 3024_day, 3024_night, aardvark_blue, abernathy ]
- Reference : [ https://github.com/lrstanley/bubbletint/blob/master/DEFAULT_TINTS.md ] (default "auto")
--config-file string Path to the configuration file to load.
- Environment variable: KONGCTL_CONFIG_FILE (overridden by this flag)
- Default: [ $XDG_CONFIG_HOME/kongctl/config.yaml ]
--control-plane-id string ID of the Konnect Kong Mesh control plane to use.
- Config path: [ konnect.mesh.control-plane.id ]
--control-plane-name string Name of the Konnect Kong Mesh control plane to use.
- Config path: [ konnect.mesh.control-plane.name ]
--control-plane-token string Bearer token for a self managed control plane. Not used for a Konnect hosted one.
- Config path: [ konnect.mesh.control-plane.token ]
--control-plane-url string API URL of a self managed Kong Mesh control plane. Provide only one control plane selector flag.
- Config path: [ konnect.mesh.control-plane.url ]
-h, --help help for dataplane-token
--jq string Filter JSON responses using jq expressions (powered by gojq for full jq compatibility)
--jq-color string Controls colorized output for jq filter results.
- Config path: [ jq.color.enabled ]
- Allowed : [ auto|always|never ] (default "auto")
--jq-color-theme string Select the color theme used for jq filter results.
- Config path: [ jq.color.theme ]
- Examples : [ friendly, github-dark, dracula ]
- Reference : [ https://xyproto.github.io/splash/docs/ ] (default "friendly")
-r, --jq-raw-output Output string jq results without JSON quotes (like jq -r).
- Config path: [ jq.raw-output ]
--log-file string Write execution logs to the specified file instead of STDERR.
- Config path: [ log-file ]
--log-level string Configures the logging level. Execution logs are written to STDERR.
- Config path: [ log-level ]
- Allowed : [ trace|debug|info|warn|error ] (default "error")
-m, --mesh string Mesh that mesh scoped resources belong to.
- Config path: [ konnect.mesh.mesh ] (default "default")
--name string Name of the dataplane the token identifies. Given per invocation; it has no configured default.
--no-telemetry Disable telemetry for this command invocation. Overrides config and env.
- Config path: [ telemetry.enabled ]
- Env var : [ KONGCTL_NO_TELEMETRY ]
- Default : [ false ]
--no-trunc Preserve full cell widths in static text tables beyond terminal width.
Does not change column selection, UUID formatting, or explicit string slices.
- Config path: [ text.no-trunc ]
- Default : [ false ]
-o, --output string Configures the format of data written to STDOUT.
- Config path: [ output ]
- Allowed : [ json|yaml|text ] (default "text")
--pat string Konnect Personal Access Token (PAT) used to authenticate the CLI.
Setting this value overrides tokens obtained from the login command.
- Config path: [ konnect.pat ]
-p, --profile string Specify the profile to use for this command. (default "default")
--proxy-type string Proxy type the token is for (for example "dataplane"). Given per invocation; it has no configured default.
--region string Konnect region identifier (for example "eu"). Used to construct the base URL when --base-url is not provided.
- Config path: [ konnect.region ]
--tag stringToString Tag values the dataplane must carry. Repeatable; separate multiple values for one tag with commas. Given per invocation; it has no configured default. (default [])
--text-id-format string Configure UUID rendering in static text-table ID columns.
- Config path: [ text.id-format ]
- Allowed : [ compact|full ]
- Default : [ compact ]
--text-layout string Configure static text-table column selection.
- Config path: [ text.layout ]
- Allowed : [ compact|auto|wide ]
- Default : [ compact ]
--tls-skip-verify Do not verify a self managed control plane's certificate. Prefer --ca-cert-file.
- Config path: [ konnect.mesh.control-plane.tls-skip-verify ]
--valid-for duration How long the token remains valid, for example "24h".
- Config path: [ konnect.mesh.token.valid-for ]
--workload string Workload label value the dataplane must carry. Given per invocation; it has no configured default.
Issue a zone token from the control plane.
A zone token lets a zone control plane prove its identity to a global control
plane when it joins.
The token is written to stdout with no trailing newline, so it can be
redirected straight into a file.
Usage:
kongctl create mesh zone-token [flags]
Examples:
# A token for a zone, written to a file
kongctl create mesh zone-token --zone zone-1 --valid-for 24h > /tmp/zone-token
Flags:
--all-meshes List mesh scoped resources across every mesh instead of one. Ignored for global types.
- Config path: [ konnect.mesh.all-meshes ]
--base-url string Base URL for Konnect API requests.
- Config path: [ konnect.base-url ]
- Default : [ https://us.api.konghq.com ]
--ca-cert-file string Path to a CA certificate that verifies a self managed control plane.
- Config path: [ konnect.mesh.control-plane.ca-cert-file ]
--client-cert-file string Path to a client certificate presented to a self managed control plane.
- Config path: [ konnect.mesh.control-plane.client-cert-file ]
--client-key-file string Path to the key for --client-cert-file.
- Config path: [ konnect.mesh.control-plane.client-key-file ]
--color-theme string Configures the CLI UI/theme (prompt, tables, TUI elements).
- Config path: [ color-theme ]
- Examples : [ auto, 3024_day, 3024_night, aardvark_blue, abernathy ]
- Reference : [ https://github.com/lrstanley/bubbletint/blob/master/DEFAULT_TINTS.md ] (default "auto")
--config-file string Path to the configuration file to load.
- Environment variable: KONGCTL_CONFIG_FILE (overridden by this flag)
- Default: [ $XDG_CONFIG_HOME/kongctl/config.yaml ]
--control-plane-id string ID of the Konnect Kong Mesh control plane to use.
- Config path: [ konnect.mesh.control-plane.id ]
--control-plane-name string Name of the Konnect Kong Mesh control plane to use.
- Config path: [ konnect.mesh.control-plane.name ]
--control-plane-token string Bearer token for a self managed control plane. Not used for a Konnect hosted one.
- Config path: [ konnect.mesh.control-plane.token ]
--control-plane-url string API URL of a self managed Kong Mesh control plane. Provide only one control plane selector flag.
- Config path: [ konnect.mesh.control-plane.url ]
-h, --help help for zone-token
--jq string Filter JSON responses using jq expressions (powered by gojq for full jq compatibility)
--jq-color string Controls colorized output for jq filter results.
- Config path: [ jq.color.enabled ]
- Allowed : [ auto|always|never ] (default "auto")
--jq-color-theme string Select the color theme used for jq filter results.
- Config path: [ jq.color.theme ]
- Examples : [ friendly, github-dark, dracula ]
- Reference : [ https://xyproto.github.io/splash/docs/ ] (default "friendly")
-r, --jq-raw-output Output string jq results without JSON quotes (like jq -r).
- Config path: [ jq.raw-output ]
--log-file string Write execution logs to the specified file instead of STDERR.
- Config path: [ log-file ]
--log-level string Configures the logging level. Execution logs are written to STDERR.
- Config path: [ log-level ]
- Allowed : [ trace|debug|info|warn|error ] (default "error")
-m, --mesh string Mesh that mesh scoped resources belong to.
- Config path: [ konnect.mesh.mesh ] (default "default")
--no-telemetry Disable telemetry for this command invocation. Overrides config and env.
- Config path: [ telemetry.enabled ]
- Env var : [ KONGCTL_NO_TELEMETRY ]
- Default : [ false ]
--no-trunc Preserve full cell widths in static text tables beyond terminal width.
Does not change column selection, UUID formatting, or explicit string slices.
- Config path: [ text.no-trunc ]
- Default : [ false ]
-o, --output string Configures the format of data written to STDOUT.
- Config path: [ output ]
- Allowed : [ json|yaml|text ] (default "text")
--pat string Konnect Personal Access Token (PAT) used to authenticate the CLI.
Setting this value overrides tokens obtained from the login command.
- Config path: [ konnect.pat ]
-p, --profile string Specify the profile to use for this command. (default "default")
--region string Konnect region identifier (for example "eu"). Used to construct the base URL when --base-url is not provided.
- Config path: [ konnect.region ]
--scope strings Scope of resources the token can identify.
- Config path: [ konnect.mesh.token.scope ] (default [cp])
--text-id-format string Configure UUID rendering in static text-table ID columns.
- Config path: [ text.id-format ]
- Allowed : [ compact|full ]
- Default : [ compact ]
--text-layout string Configure static text-table column selection.
- Config path: [ text.layout ]
- Allowed : [ compact|auto|wide ]
- Default : [ compact ]
--tls-skip-verify Do not verify a self managed control plane's certificate. Prefer --ca-cert-file.
- Config path: [ konnect.mesh.control-plane.tls-skip-verify ]
--valid-for duration How long the token remains valid, for example "24h".
- Config path: [ konnect.mesh.token.valid-for ]
--zone string Name of the zone the token identifies. Given per invocation; it has no configured default.