Azure Key Vaults

The current version of Kong Gateway’s implementation supports configuring Azure Key Vaults in two ways:

• Environment variables
• Managed identity authentication

Kong Gateway only supports the Secrets Azure vault type. It doesn’t support the Keys and Certificates vault types.

Configure Azure Key Vaults

Kong Gateway uses a key to automatically authenticate with the Azure Key Vaults API and grant you access.

You need to specify the following values:

• Azure ActiveDirectory Tenant ID
• Azure Client ID
• vault_URI
• Azure Client Secret: This value can only be configured as an environment variable.

You can configure these values with environment variables before starting Kong Gateway. If you are using an Instance Managed Identity Token, setting the environment variables isn’t necessary.

export KONG_VAULT_AZURE_VAULT_URI=https://my-vault.vault.azure.com
export KONG_VAULT_AZURE_TENANT_ID=tenant_id
export KONG_VAULT_AZURE_CLIENT_ID=client_id
export AZURE_CLIENT_SECRET=client_secret

Secrets management via Azure Vault is supported on Azure Instance (VM) and the Azure Function App. It is not currently supported on Azure Container App.

Examples

To use a Secret with the name secret-name, create a JSON object in Azure Key Vault that contains one or more properties:

{
  "foo": "bar",
  "snip": "snap"
}

The Azure AD tenant ID, client ID, vault_uri, and client secret must be specified. You can configure these values with environment variables before starting Kong Gateway:

export KONG_VAULT_AZURE_VAULT_URI=https://my-vault.vault.azure.com
export KONG_VAULT_AZURE_TENANT_ID=tenant_id
export KONG_VAULT_AZURE_CLIENT_ID=client_id
export AZURE_CLIENT_SECRET=client_secret

{vault://azure/secret-name/foo}
{vault://azure/secret-name/snip}

Alternatively, you can configure the vault via the vaults entity.

Configuration via vaults entity

Once the database is initialized, a vault entity can be created to encapsulate the provider and the required Azure Key Vault information:

curl -i -X PUT http://localhost:8001/vaults/azure-key-vault \
  --data name=azure \
  --data description="Storing secrets in Azure Key Vault (Secrets)" \
  --data config.type="secrets" \
  --data config.location="us-east" \
  --data config.vault_uri="http://my-vault-uri.azure.com"

{
    "config": {
        "client_id": null,
        "credentials_prefix": "AZURE",
        "vault_uri": "http://my-vault-uri.azure.com",
        "location": "us-east",
        "neg_ttl": null,
        "resurrect_ttl": null,
        "tenant_id": null,
        "ttl": null,
        "type": "secrets",
        "vault_uri": null
    },
    "created_at": 1696235611,
    "description": "Storing secrets in Azure Key Vault (Secrets)",
    "id": "7c9287c1-2cbc-406b-a013-843fe54dc0b6",
    "name": "azure",
    "prefix": "azure-key-vault",
    "tags": null,
    "updated_at": 1696235611
}

_format_version: "3.0"
vaults:
- config:
    type: secrets
    vault_uri: http://my-vault-uri.azure.com
    location: us-east
  description: Storing secrets in Azure Key Vaults
  name: azure
  prefix: azure-key-vault

With the Vault entity in place, you can reference the Azure secrets through it:

{vault://azure-key-vault/secret-name/foo}
{vault://azure-key-vault/secret-name/snip}

Vault entity configuration options

Use the following configuration options to configure the vaults entity through any of the supported tools:

• Kong Manager
• Konnect
• Admin API
• Declarative configuration

Configuration options for a Azure Key Vault in Kong Gateway:

Common options: