Migrate configuration into control plane groups

There are a few situations in which you might want to migrate existing configuration into a control plane group.

Migrate standard control plane configuration into a control plane group. In this scenario, you are migrating config from Konnect to a different control plane in Konnect.
Migrate self-managed Kong Gateway workspace configuration into a control plane group in Konnect. In this scenario, you are migrating from self-managed to cloud managed.

A control plane group can’t be configured directly. It compiles configuration from its member control planes.

Therefore, when migrating, you will need at least two new groups: a control plane group and a standard control plane.

Prerequisites

Control plane admin permissions
decK v1.12 or later installed
You have a Konnect access token and you have made sure that decK can connect to your account

Prepare control planes for migration

Create a control plane group:

 curl -i -X POST https://<region>.api.konghq.com/v2/control-planes \
     -H "Authorization: Bearer <your_KPAT>" \
     --data name=CPG \
     --data cluster_type=CLUSTER_TYPE_COMPOSITE

Create a new standard control plane:

 curl -i -X POST https://<region>.api.konghq.com/v2/control-planes \
     -H "Authorization: Bearer <your_KPAT>" \
     --data name=CP1 \
     --data cluster_type=CLUSTER_TYPE_HYBRID

Add the new control plane to the group as a member:

 curl -i -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/group-memberships/add \
     -H "Authorization: Bearer <your_KPAT>" \
     --json '{"members": [{"id": "062e2f2c-0f42-4938-91b4-f73f399260f5"}]}'

Note: When adding a standard control plane to a group, make sure it has no connected data plane nodes.

Scenario: Migrate a control plane configuration into a control plane group

If you want to migrate a standard control plane into a group, Kong recommends the following path:

Create a control plane group.
Create a new standard control plane and add as a member to the control plane group.
Dump the configuration from the old standard control plane.
Apply configuration to new standard control plane that is a member of the control plane group.
Start new data plane nodes in control plane group and test routes.
Decommission the old standard control plane.

We recommend this workflow because it gives you the opportunity to review shared entities and avoid conflicts. It also decouples any team, dev portal, or identity permissions from the standard control plane. This way, you won’t accidentally grant access to the wrong resources to a new group of users.

Assuming you already have a control plane group and a member control plane, you can export the configuration from the old control plane and apply it to the new one.

Export the configuration of the old control plane via deck gateway dump:

 deck gateway dump \
     -o old-group.yaml \
     --konnect-token <your_KPAT> \
     --konnect-control-plane-name old-group

Sync the configuration to the new group:
```
 deck gateway sync old-group.yaml \
     --konnect-token <your_KPAT> \
     --konnect-control-plane-name CP1
```
Note that you can’t sync the configuration to the control plane group CPG. Control plane groups don’t have their own configuration. They inherit combined configuration from all of their member control planes.

Scenario: Migrate workspaces to control plane groups

Use decK to migrate a self-managed Kong Gateway workspace into a control plane group.

Run deck gateway dump to export workspace configuration into a file:
```
 deck gateway dump --workspace ws1 -o ws1.yaml
```
Open the file. Remove the following:
- Any _workspace entries: There are no workspaces in Konnect. For a similar concept, see control planes.
- Configuration for the Portal App Registration plugin: App registration is supported in Konnect, but not through a plugin, and decK does not manage it.
- Any other unsupported plugins
Preview the import with the deck gateway diff command, pointing to the control plane that you want to target:
```
 deck gateway diff ws1.yaml --konnect-control-plane-name CP1
```
If you’re satisfied with the preview, run deck gateway sync:
```
 deck gateway sync ws1.yaml --konnect-control-plane-name CP1
```
If you don’t specify the --konnect-control-plane-name flag, decK targets the default control plane. If you have more than one control plane in your organization, we recommend always setting this flag to avoid accidentally pushing configuration to the wrong control plane.
Log in to your Kong Konnect account.
From the left navigation menu, open Gateway Manager, then open the control plane you just updated.
Look through the configuration details of any imported entities to make sure they were migrated successfully.