You are browsing documentation for an older version. See the latest documentation here.

Kong Vault

Secrets Management is a Kong Gateway Enterprise feature for storing sensitive plugin configuration separately from the visible plugin configuration.

Secrets Management supports several backend systems. This guide uses the environment variable backend, which requires minimal configuration and integrates well with Kubernetes’ standard Secret-sourced environment variables.

Available Vaults

Kong Gateway supports environment variables, HashiCorp Vault, AWS Secrets Manager and Google Cloud Secret Manager as a source for secret configuration. These vaults can be configured using environment variables on your gateway deployments.

To learn more about the available vaults, see the Kong Gateway documentation.

Environment Vault

1. Set an environment variable on your proxy Pod using valueFrom.secretKeyRef in your deployment. This example makes the redis-password-secret secret available using the environment variable vault.

   kubectl patch deploy -n kong kong-gateway --patch '
   {
     "spec": {
       "template": {
         "spec": {
           "containers": [
             {
               "name": "proxy",
               "env": [
                 {
                   "name": "SECRET_REDIS_PASSWORD",
                   "valueFrom": {
                     "secretKeyRef": {
                       "name": "redis-password-secret",
                       "key": "redis-password"
                     }
                   }
                 }
               ]
             }
           ]
         }
       }
     }
   }'
   

2. Use this value SECRET_REDIS_PASSWORD in a KongPlugin definition.

    apiVersion: configuration.konghq.com/v1
    kind: KongPlugin
    metadata:
      name: rate-limiting-example
    plugin: rate-limiting
    config:
      second: 5
      hour: 10000
      policy: redis
      redis_host: <redis_host>
      redis_password: "vault://env/secret-redis-password"
   

HashiCorp Vault

gateway:
  customEnv:
    vault_hcv_protocol: "https"
    vault_hcv_host: "vault.default.svc.cluster.local"
    vault_hcv_port: "8200"
    vault_hcv_mount: "secret"
    vault_hcv_kv: "v2"
    vault_hcv_auth_method: "token"
    vault_hcv_token: "TOKENSTRINGHERE"

Configure the following in your values.yaml:

AWS Secrets Manager

gateway:
  customEnv:
    aws_access_key_id: ""
    aws_secret_access_key: ""
    aws_region: ""
    aws_session_token: ""

Google Cloud Secret Manager

Configure the following in your values.yaml:

gateway:
  customEnv:
    gcp_service_account: '{"credentials": "here in JSON format. See gcp-project-RANDOM_ID.json"}'