Entities Managed by decK

decK manages entity configuration for Kong Gateway, including all core proxy entities.

It does not manage Kong Gateway configuration parameters in kong.conf, or content and configuration for the Dev Portal.

Entity	Managed by decK?
Services	1
Routes
Consumers
Plugins
Certificates
CA Certificates
SNIs
Upstreams
Targets
Vaults
Keys and key sets
Licenses
Workspaces	2
RBAC: roles and endpoint permissions
RBAC: groups and admins
Developers
Consumer groups
Event hooks
Keyring and data encryption

[1]: decK doesn’t manage documents (document_objects) related to services, which means they are not included in dump/sync actions. If you attempt to delete a service that has an associated document via decK, it will fail. Manage service documents directly through Kong Manager.

[2]: decK can create workspaces and manage entities in a given workspace. However, decK can’t delete workspaces, and it can’t update multiple workspaces simultaneously. See Manage multiple workspaces for more information.

While deck can manage a majority of Kong Gateway’s configuration, we recommend additional arrangements for deployment, backup, and restoring unmanaged entities for a more comprehensive approach.

In the event that the data plane loses connection to the control plane in hybrid mode, the data plane can continue to function using a backup declarative configuration file. This feature is not available if you have any unmanaged entities configured.