# Konnect Control Plane Bootstrap

> Bootstrap new Konnect Gateway control planes. Use for first-run topology, hosted versus self-hosted data planes, region/name/ownership choices, or moving from quickstart setup to durable management. Not for runtime triage or post-bootstrap Gateway config.

- **Type:** Skill
- **Install:** `agentstack add skill-kong-ai-marketplace-konnect-control-plane-bootstrap`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Kong](https://agentstack.voostack.com/s/kong)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Kong](https://github.com/Kong)
- **Source:** https://github.com/Kong/ai-marketplace/tree/main/plugins/kong-konnect/skills/konnect-control-plane-bootstrap
- **Website:** https://konghq.com

## Install

```sh
agentstack add skill-kong-ai-marketplace-konnect-control-plane-bootstrap
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Konnect control plane bootstrap

## Goal

Help an operator stand up a new Konnect Gateway control plane with the right
bootstrap assumptions before the problem becomes Gateway drift or runtime
troubleshooting.

Use this skill for initial setup, first-run topology choices, naming, labels,
ownership boundaries, and "what should we create first?" decisions. Do not use
it for ongoing incident triage, retrofitting generic Gateway config, or fixing
an already unhealthy existing control plane unless the missing piece is still
bootstrap scope.

## Tool Selection

- Use the shared `kong-konnect` MCP server first for live inspection of
  existing control planes, groups, and adjacent Konnect Gateway resources.
- If the control plane already exists and the operator is mainly debugging
  attachment, health, rollout, or config-application symptoms, hand off to
  `konnect-gateway-triage` instead of treating the problem as bootstrap.
- Preserve the repository's chosen declarative toolchain when bootstrap should
  be codified: use `terraform-konnect` for HCL-managed control planes,
  `kongctl-declarative` for `kongctl` YAML, and `deck-gateway` only after the
  control plane exists and the task becomes Gateway-entity configuration.
- If the user is following an official quickstart path, keep the quickstart and
  the durable repo-managed setup distinct in your explanation.
- If live Konnect state matters and `kong-konnect` MCP is not connected, say so
  early and continue with user-provided artifacts or repo context.

## References To Load

Load only the reference file that matches the active branch:

- `references/topology-choice.md`
  - Load when the main question is hosted versus self-hosted data planes,
    quick local bootstrap versus durable shared environment, or environment
    shape.
- `references/bootstrap-artifacts.md`
  - Load when the user needs to separate control plane creation, data plane
    attachment, and first Gateway config into concrete bootstrap milestones.
- `references/ownership-boundaries.md`
  - Load when naming, labels, region, repo ownership, or durable management
    path is the real bootstrap decision.

## Workflow

### 1. Classify whether the task is bootstrap or repair

First determine whether the user is:

- creating a net-new control plane
- converting a quickstart into a durable managed environment
- or debugging an existing control plane that should already be operational

If the real problem is health, rollout, connectivity, or config application on
an existing control plane, hand off early to `konnect-gateway-triage`.

### 2. Identify the intended deployment shape

Clarify:

- whether the user needs a quick local bootstrap, a durable shared environment,
  or both
- whether data planes will be self-hosted, Dedicated Cloud Gateways, or
  serverless / Kong-managed where applicable
- whether the environment is dev, staging, prod, or a shared platform slice

Do not treat a tutorial quickstart as the final production shape by default.

Load `references/topology-choice.md` when the deployment shape itself is still
the hard part.

### 3. Confirm region, naming, and ownership boundaries

Decide:

- Konnect region
- control plane naming convention
- labels or environment boundaries
- which team, repo, or automation path will own the control plane

Bootstrap errors here cause long-lived confusion later, especially when several
control planes look similar.

Load `references/ownership-boundaries.md` when region, labels, names, or team
ownership are the main source of ambiguity.

### 4. Separate platform bootstrap from Gateway config

For a new control plane, keep these concerns distinct:

- creating the control plane
- attaching or provisioning data planes
- verifying connectivity and heartbeat
- applying the first Gateway entities

The control plane is not “done” just because it exists in Konnect.

Load `references/bootstrap-artifacts.md` when the operator needs the bootstrap
milestones spelled out more explicitly.

### 5. Choose the first durable management path

Default decision rule:

- if the team already manages Konnect with Terraform, bootstrap in
  `terraform-konnect`
- if the team already manages Konnect with `kongctl`, bootstrap in
  `kongctl-declarative`
- if the task is only to get a local quickstart running, explain the quickstart
  separately and then point to the durable management path

Do not force migration between tools during bootstrap unless the user asked for
it.

### 6. Validate the first post-bootstrap state

Before calling the bootstrap complete, verify:

- the control plane exists in the intended region
- the target data plane hosting model is correct
- the connection path is understood
- the ownership boundary and next automation path are explicit
- the user knows whether the next step is Gateway entity config, Portal work,
  or runtime verification

### 7. Hand off to the next operational surface

Common next steps:

- `konnect-gateway-triage` if the control plane exists but connectivity or
  rollout is unhealthy
- `deck-gateway` for first Gateway-entity config in a `decK` repo
- `terraform-konnect` or `kongctl-declarative` for durable control-plane
  codification

## Konnect-Specific Gotchas

- Quickstart success does not mean the durable environment model is decided.
- Control plane creation, data plane hosting, and Gateway config are separate
  milestones.
- A bootstrap request often hides a repair request; classify that early before
  recommending creation steps.
- Region mistakes are expensive because many later symptoms look like auth or
  drift failures.
- A healthy control plane object does not prove the data plane is attached or
  the first config rollout will succeed.
- `decK` is not the control-plane bootstrap tool; it becomes relevant after the
  control plane exists.

## Validation Checklist

Before answering, verify that you can state:

- which deployment shape the user actually needs
- the intended region, name, and ownership boundary
- whether the data plane hosting model is correct
- whether the next step is bootstrap, connectivity, or Gateway config
- which declarative tool skill should own the durable setup

## Handoffs

- Use `konnect-gateway-triage` when the bootstrap is complete enough that the
  remaining problem is health, connectivity, or rollout.
- Use `terraform-konnect` or `kongctl-declarative` when the user wants the
  control plane managed as code.
- Use `deck-gateway` once the control plane exists and the task becomes Gateway
  entity configuration.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Kong](https://github.com/Kong)
- **Source:** [Kong/ai-marketplace](https://github.com/Kong/ai-marketplace)
- **License:** MIT
- **Homepage:** https://konghq.com

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-kong-ai-marketplace-konnect-control-plane-bootstrap
- Seller: https://agentstack.voostack.com/s/kong
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.