At this point you have installed and configured the providers successfully. It’s time to create some resources using the Konnect API.
Create a file named main.tf and add the following to create a Global Control Plane in Konnect:
resource "konnect_mesh_control_plane" "my_meshcontrolplane" {
provider = konnect-beta
name = "tf-cp"
description = "A control plane created using terraform"
labels = {
"terraform" = "true"
}
}
After saving the file, run terraform apply -auto-approve to create the resource.
You should see:
# konnect_mesh_control_plane.my_meshcontrolplane will be created
+ resource "konnect_mesh_control_plane" "my_meshcontrolplane" {
+ created_at = (known after apply)
+ description = "A control plane created using terraform"
+ features = (known after apply)
+ id = (known after apply)
+ labels = {
+ "terraform" = "true"
}
+ name = "tf-cp"
+ updated_at = (known after apply)
}
Now that there is a Control Plane, we can create a new Mesh.
Notice that the cp_id property is set to the ID of the control plane created in the previous step.
The skip_creating_initial_policies property is set to ["*"] to skip creating the default policies so that all resources in the Mesh are tracked by Terraform.
Add the following to main.tf:
resource "konnect_mesh" "my_mesh" {
provider = konnect-beta
name = "my-mesh"
type = "Mesh"
skip_creating_initial_policies = [ "*" ]
cp_id = konnect_mesh_control_plane.my_meshcontrolplane.id
}
Run terraform apply -auto-approve and watch as Terraform creates a new Mesh in your Control Plane.
Let’s add mTLS to the mesh. Replace the konnect_mesh resource you added in main.tf with the following definition:
resource "konnect_mesh" "my_mesh" {
provider = konnect-beta
name = "my-mesh"
type = "Mesh"
skip_creating_initial_policies = [ "*" ]
mtls = {
"backends" = [
{
"name" = "ca-1"
"type" = "builtin"
}
]
"mode" = "permissive"
"enabledBackend" = "ca-1"
}
cp_id = konnect_mesh_control_plane.my_meshcontrolplane.id
}
Run terraform apply -auto-approve and you will see the Mesh being updated in place:
# konnect_mesh.my_mesh will be updated in-place
~ resource "konnect_mesh" "my_mesh" {
+ mtls = {
+ backends = [
+ {
+ name = "ca-1"
+ type = "builtin"
},
]
}
name = "my-mesh"
# (3 unchanged attributes hidden)
}
For full schema of the Mesh resource, see the konnect-beta provider documentation.
The Kong Mesh documentation policy examples now contain an additional “Terraform” tab showing a Terraform representation of a policy.
Let’s take an example from MeshTrafficPermission page
Autogenerated labels like “kuma.io/mesh”, “kuma.io/origin” etc. have to be manually added to the resources.
This limitation will be removed in the GA release.
Add the following policy to main.tf:
resource "konnect_mesh_traffic_permission" "allow_all" {
provider = konnect-beta
type = "MeshTrafficPermission"
name = "allow-all"
spec = {
from = [
{
target_ref = {
kind = "Mesh"
}
default = {
action = "Allow"
}
}
]
}
labels = {
"kuma.io/mesh" = konnect_mesh.my_mesh.name
}
cp_id = konnect_mesh_control_plane.my_meshcontrolplane.id
mesh = konnect_mesh.my_mesh.name
}
Run terraform apply -auto-approve to create the policy.
Certain properties (like Mesh name, policy name, etc.) are used as identifiers and changing them will result in a new resource being created and all dependant resources being recreated.
So changing mesh name to another-name
resource "konnect_mesh" "my_mesh" {
# ...
name = "another-name"
# ...
}
Will result in forced replacement of both mesh and konnect_mesh_traffic_permission resources:
# konnect_mesh.my_mesh must be replaced
-/+ resource "konnect_mesh" "my_mesh" {
~ name = "mesh1" -> "another-name" # forces replacement
# (4 unchanged attributes hidden)
}
# konnect_mesh_access_log.konnect_mesh_traffic_permission must be replaced
-/+ resource "konnect_mesh_traffic_permission" "allow_all" {
~ creation_time = "2025-03-13T09:53:00.606442Z" -> (known after apply)
~ labels = {
~ "kuma.io/mesh" = "mesh1" -> "another-name"
}
~ mesh = "mesh1" -> "another-name" # forces replacement