Release/0.16.0 (#188)

* chore: bump speakeasy to 1.724.1 (#185)

* Chore/sync with platform api 2026.02.24 (#186)

* tests: fix according to event gateway breaking changes

* OpenAPI changes

* Generated provider and docs

* Update CHANGELOG.md

* feat: Updated OpenAPI file for cloud gateway-addon. (#187)

* feat: Updated OpenAPI file for cloud gateway-addon.

* feat: added .go files, .speakeasy and docs directory

* feat: added test for cloud gateway add-on

* fix: resolved review comments on test

* chore: prepare for v0.16.0 release

* Fix/cgw addon resource name (#189)

* OpenAPI changes

* Generated provider, docs and examples

* tests: rename resource

* Update CHANGELOG.md

---------

Co-authored-by: shivaygupta-dotcom <shivay.gupta@konghq.com>

Author: harshadixit12

.speakeasy/gen.lock

@@ -1,11 +1,11 @@
-speakeasyVersion: 1.676.1
+speakeasyVersion: 1.724.1
 sources: {}
 targets:
     terraform:
         source: kong
 workflow:
     workflowVersion: 1.0.0
-    speakeasyVersion: 1.676.1
+    speakeasyVersion: 1.724.1
     sources:
         kong:
             inputs:

.speakeasy/workflow.lock

@@ -1,5 +1,5 @@
 workflowVersion: 1.0.0
-speakeasyVersion: 1.676.1
+speakeasyVersion: 1.724.1
 sources:
     kong:
         inputs:

.speakeasy/workflow.yaml

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.16.0
+> Released on 2026/03/02
+
+### BREAKING CHANGES
+* `event_gateway_listener_id` renamed to `listener_id` in `konnect_event_gateway_listener_policy_forward_to_virtual_cluster` and `konnect_event_gateway_listener_policy_tls_server`
+* Schema registry references simplified to use `id` directly instead of `schema_registry_reference_by_id`/`schema_registry_reference_by_name` in `konnect_event_gateway_consume_policy_schema_validation` and `konnect_event_gateway_produce_policy_schema_validation`
+* Virtual cluster references simplified to use `id` directly instead of `virtual_cluster_reference_by_id`/`virtual_cluster_reference_by_name` in `konnect_event_gateway_listener_policy_forward_to_virtual_cluster`
+* Static key references simplified to use `id` directly instead of `reference_by_id`/`reference_by_name` in `konnect_event_gateway_produce_policy_encrypt`
+
+### Features
+* Add support for configuring Managed Cache in Cloud Gateway using `konnect_cloud_gateway_addon` resource
+
 ## 0.15.0
 > Released on 2026/02/16
 

CHANGELOG.md

@@ -16,13 +16,13 @@ terraform {
   required_providers {
     konnect-beta = {
       source  = "kong/konnect-beta"
-      version = "0.15.0"
+      version = "0.16.0"
     }
   }
 }
 
 provider "konnect-beta" {
-  # Configuration options
+  server_url = "..." # Optional - can use KONNECT_SERVER_URL environment variable
 }
 ```
 

docs/index.md

@@ -35,6 +35,7 @@ resource "konnect_auth_server_clients" "my_authserverclients" {
   redirect_uris = [
     "https://flashy-sauerkraut.com/"
   ]
+  refresh_token_duration = 84206233
   response_types = [
     "none"
   ]
@@ -65,6 +66,7 @@ resource "konnect_auth_server_clients" "my_authserverclients" {
 Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
 - `login_uri` (String) The URI of the login page where the user is redirected to authenticate in interactive flows. The login page must be secure (HTTPS).
 - `redirect_uris` (List of String) The URIs that the client is allowed to redirect to after authentication in interactive flows. All redirect URIs must be absolute URIs, be secure (HTTPS), and must not include a fragment component.
+- `refresh_token_duration` (Number) The duration of the minted refresh token is valid for, in seconds. Default: 2592000
 - `token_endpoint_auth_method` (String) Requested authentication method for OAuth 2.0 endpoints. Default: "client_secret_post"; must be one of ["client_secret_post", "none"]
 
 ### Read-Only

docs/resources/auth_server_clients.md

@@ -0,0 +1,226 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "konnect_cloud_gateway_addon Resource - terraform-provider-konnect-beta"
+subcategory: ""
+description: |-
+  CloudGatewayAddon Resource
+---
+
+# konnect_cloud_gateway_addon (Resource)
+
+CloudGatewayAddon Resource
+
+## Example Usage
+
+```terraform
+resource "konnect_cloud_gateway_addon" "my_cloudgatewayaddon" {
+  provider = konnect-beta
+  config = {
+    managed_cache = {
+      capacity_config = {
+        tiered = {
+          tier = "2xlarge"
+        }
+      }
+    }
+  }
+  name = "my-add-on"
+  owner = {
+    control_plane_group = {
+      control_plane_group_geo = "me"
+      control_plane_group_id  = "123e4567-e89b-12d3-a456-426614174000"
+    }
+  }
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `config` (Attributes) Configuration for creating different types of add-ons. Requires replacement if changed. (see [below for nested schema](#nestedatt--config))
+- `name` (String) Unique human-readable name of the add-on. Requires replacement if changed.
+- `owner` (Attributes) Owner for the add-on. Requires replacement if changed. (see [below for nested schema](#nestedatt--owner))
+
+### Read-Only
+
+- `created_at` (String) RFC-3339 timestamp representation of add-on creation date.
+- `entity_version` (Number) Monotonically-increasing version count of the add-on, to indicate the order of updates to the add-on.
+- `id` (String) The ID of this resource.
+- `state` (String) The current state of the add-on. Possible values:
+- `initializing` - The add-on is in the process of being initialized/updated.
+- `ready` - The add-on is fully operational.
+- `terminating` - The add-on is in the process of being deleted.
+- `updated_at` (String) RFC-3339 timestamp representation of add-on update date.
+
+<a id="nestedatt--config"></a>
+### Nested Schema for `config`
+
+Optional:
+
+- `managed_cache` (Attributes) Configuration for creating a managed cache add-on. Requires replacement if changed. (see [below for nested schema](#nestedatt--config--managed_cache))
+
+Read-Only:
+
+- `managed_cache_add_on_config_response` (Attributes) Configuration for managed cache add-on. (see [below for nested schema](#nestedatt--config--managed_cache_add_on_config_response))
+
+<a id="nestedatt--config--managed_cache"></a>
+### Nested Schema for `config.managed_cache`
+
+Required:
+
+- `capacity_config` (Attributes) Configuration for managed cache capacity and performance characteristics. Requires replacement if changed. (see [below for nested schema](#nestedatt--config--managed_cache--capacity_config))
+
+<a id="nestedatt--config--managed_cache--capacity_config"></a>
+### Nested Schema for `config.managed_cache.capacity_config`
+
+Optional:
+
+- `tiered` (Attributes) Capacity tiers with pre-configured size and performance characteristics. Requires replacement if changed. (see [below for nested schema](#nestedatt--config--managed_cache--capacity_config--tiered))
+
+<a id="nestedatt--config--managed_cache--capacity_config--tiered"></a>
+### Nested Schema for `config.managed_cache.capacity_config.tiered`
+
+Required:
+
+- `tier` (String) Capacity tier that determines both cache size and performance characteristics:
+- micro: ~0.5 GiB capacity
+- small: ~1 GiB capacity
+- medium: ~3 GiB capacity
+- large: ~6 GiB capacity
+- xlarge: ~12 GiB capacity
+- 2xlarge: ~25 GiB capacity
+- 4xlarge: ~52 GiB capacity
+must be one of ["micro", "small", "medium", "large", "xlarge", "2xlarge", "4xlarge"]; Requires replacement if changed.
+
+
+
+
+<a id="nestedatt--config--managed_cache_add_on_config_response"></a>
+### Nested Schema for `config.managed_cache_add_on_config_response`
+
+Read-Only:
+
+- `capacity_config` (Attributes) Configuration for managed cache capacity and performance characteristics. (see [below for nested schema](#nestedatt--config--managed_cache_add_on_config_response--capacity_config))
+- `data_plane_groups` (Attributes List) List of data-plane groups where the managed cache is deployed. (see [below for nested schema](#nestedatt--config--managed_cache_add_on_config_response--data_plane_groups))
+- `state_metadata` (Attributes) Metadata describing the state of the managed cache add-on. (see [below for nested schema](#nestedatt--config--managed_cache_add_on_config_response--state_metadata))
+
+<a id="nestedatt--config--managed_cache_add_on_config_response--capacity_config"></a>
+### Nested Schema for `config.managed_cache_add_on_config_response.capacity_config`
+
+Read-Only:
+
+- `tiered` (Attributes) Capacity tiers with pre-configured size and performance characteristics. (see [below for nested schema](#nestedatt--config--managed_cache_add_on_config_response--capacity_config--tiered))
+
+<a id="nestedatt--config--managed_cache_add_on_config_response--capacity_config--tiered"></a>
+### Nested Schema for `config.managed_cache_add_on_config_response.capacity_config.tiered`
+
+Read-Only:
+
+- `tier` (String) Capacity tier that determines both cache size and performance characteristics:
+- micro: ~0.5 GiB capacity
+- small: ~1 GiB capacity
+- medium: ~3 GiB capacity
+- large: ~6 GiB capacity
+- xlarge: ~12 GiB capacity
+- 2xlarge: ~25 GiB capacity
+- 4xlarge: ~52 GiB capacity
+
+
+
+<a id="nestedatt--config--managed_cache_add_on_config_response--data_plane_groups"></a>
+### Nested Schema for `config.managed_cache_add_on_config_response.data_plane_groups`
+
+Read-Only:
+
+- `cloud_gateway_network_id` (String) Network ID this data-plane group is attached to.
+- `id` (String) ID of the data-plane group.
+- `provider` (String) Name of cloud provider.
+- `region` (String) Region of cloud provider the data-plane group is deployed to.
+- `state` (String) The current state of the managed cache add-on in the data-plane group. Possible values:
+- `initializing` - The add-on is in the process of being initialized/updated and is setting up necessary resources for this data-plane group.
+- `ready` - The add-on is fully operational for this data-plane group.
+- `error` - The add-on is in an error state, and is not operational for this data-plane group.
+- `terminating` - The add-on is in the process of being deleted for this data-plane group.
+- `state_metadata` (Attributes) Metadata describing the state of the managed cache add-on in the data-plane group. (see [below for nested schema](#nestedatt--config--managed_cache_add_on_config_response--data_plane_groups--state_metadata))
+
+<a id="nestedatt--config--managed_cache_add_on_config_response--data_plane_groups--state_metadata"></a>
+### Nested Schema for `config.managed_cache_add_on_config_response.data_plane_groups.state_metadata`
+
+Read-Only:
+
+- `error_reason` (String) Reason why the managed cache add-on may be in an error state, reported from backing infrastructure.
+
+
+
+<a id="nestedatt--config--managed_cache_add_on_config_response--state_metadata"></a>
+### Nested Schema for `config.managed_cache_add_on_config_response.state_metadata`
+
+Read-Only:
+
+- `cache_config_id` (String) Reference to cache configuration for this add-on.
+- `cache_host` (String) Env vault path to cache hostname.
+- `cache_port` (String) Env vault path to cache port.
+- `cache_server_name` (String) Env vault path to cache server name.
+- `cache_username` (String) Env vault path to cache username.
+- `cloud_authentication` (Attributes) Metadata describing the cloud authentication details for managed cache add-on. (see [below for nested schema](#nestedatt--config--managed_cache_add_on_config_response--state_metadata--cloud_authentication))
+
+<a id="nestedatt--config--managed_cache_add_on_config_response--state_metadata--cloud_authentication"></a>
+### Nested Schema for `config.managed_cache_add_on_config_response.state_metadata.cloud_authentication`
+
+Read-Only:
+
+- `auth_provider` (String) Env vault path to cache auth provider.
+- `aws_assume_role_arn` (String) Env vault path to aws assume role arn.
+- `aws_cache_name` (String) Env vault path to aws cache name.
+- `aws_region` (String) Env vault path to aws region.
+- `azure_tenant_id` (String) Env vault path to azure tenant id.
+
+
+
+
+
+<a id="nestedatt--owner"></a>
+### Nested Schema for `owner`
+
+Optional:
+
+- `control_plane` (Attributes) Control Plane is the owner for the add-on. Requires replacement if changed. (see [below for nested schema](#nestedatt--owner--control_plane))
+- `control_plane_group` (Attributes) Control Plane Group is the owner for the add-on. Requires replacement if changed. (see [below for nested schema](#nestedatt--owner--control_plane_group))
+
+<a id="nestedatt--owner--control_plane"></a>
+### Nested Schema for `owner.control_plane`
+
+Optional:
+
+- `control_plane_geo` (String) Set of control-plane geos supported for deploying cloud-gateways configurations. Not Null; must be one of ["us", "eu", "au", "me", "in", "sg"]; Requires replacement if changed.
+- `control_plane_id` (String) ID of the control-plane that owns this add-on. Not Null; Requires replacement if changed.
+
+
+<a id="nestedatt--owner--control_plane_group"></a>
+### Nested Schema for `owner.control_plane_group`
+
+Optional:
+
+- `control_plane_group_geo` (String) Set of control-plane geos supported for deploying cloud-gateways configurations. Not Null; must be one of ["us", "eu", "au", "me", "in", "sg"]; Requires replacement if changed.
+- `control_plane_group_id` (String) ID of the control-plane group that owns this add-on. Not Null; Requires replacement if changed.
+
+## Import
+
+Import is supported using the following syntax:
+
+In Terraform v1.5.0 and later, the [`import` block](https://developer.hashicorp.com/terraform/language/import) can be used with the `id` attribute, for example:
+
+```terraform
+import {
+  to = konnect_cloud_gateway_addon.my_konnect_cloud_gateway_addon
+  id = "550e8400-e29b-41d4-a716-446655440000"
+}
+```
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
+```shell
+terraform import konnect_cloud_gateway_addon.my_konnect_cloud_gateway_addon "550e8400-e29b-41d4-a716-446655440000"
+```

docs/resources/cloud_gateway_addon.md

@@ -52,7 +52,7 @@ resource "konnect_dashboard" "my_dashboard" {
                 ]
                 granularity = "twelveHourly"
                 metrics = [
-                  "kong_latency_p50"
+                  "kong_latency_average"
                 ]
                 time_range = {
                   relative = {

docs/resources/dashboard.md

@@ -61,7 +61,7 @@ resource "konnect_event_gateway_backend_cluster" "my_eventgatewaybackendcluster"
 
 ### Optional
 
-- `description` (String) A human-readable description of the virtual cluster. Default: ""
+- `description` (String) A human-readable description of the backend cluster. Default: ""
 - `insecure_allow_anonymous_virtual_cluster_auth` (Boolean) If true, virtual clusters can have allow anonymous authentication and use this backend cluster.
 This setting is not recommended for production use as it may create privilege escalation vulnerabilities.
 Default: false

docs/resources/event_gateway_backend_cluster.md

@@ -85,7 +85,7 @@ Required:
 
 - `action` (String) How to handle the request if the rule matches. must be one of ["allow", "deny"]
 - `operations` (Attributes List) Types of Kafka operations to match against. Note that not every operation can apply to every resource type. (see [below for nested schema](#nestedatt--config--rules--operations))
-- `resource_names` (Attributes List) If any of these entries match, the resource name matches for this rule. (see [below for nested schema](#nestedatt--config--rules--resource_names))
+- `resource_names` (Attributes List) If any of these entries match, the resource name matches for this rule. A maximum of 50 entries are allowed. (see [below for nested schema](#nestedatt--config--rules--resource_names))
 - `resource_type` (String) This rule applies to access only for type of resource. must be one of ["topic", "group", "transactional_id", "cluster"]
 
 <a id="nestedatt--config--rules--operations"></a>