Azure Key Vaults

The current version of Kong Gateway’s implementation supports configuring Azure Key Vaults in two ways:

• Environment variables
• Managed identity authentication

Configure Azure Key Vaults

Kong Gateway uses a key to automatically authenticate with the Azure Key Vaults API and grant you access.

You need to specify the following values:

• Azure ActiveDirectory Tenant Id
• Azure Client Id
• vault_URI
• Azure Client Secret - This value can only be configured as an environment variable.

You can configure these values with environment variables before starting Kong Gateway:

export KONG_VAULT_AZURE_VAULT_URI=https://my-vault.vault.azure.com
export AZURE_TENANT_ID=tenant_id
export AZURE_CLIENT_ID=client_id
export AZURE_CLIENT_SECRET=client_secret

With Instance Managed Identity Token, setting the environment variables isn’t necessary.

Examples

Note that Azure’s Key Vault support three different secret types.

• Keys
• Secrets
• Certificates

Kong only supports the Secrets type.

To use a Secret with the name secret-name, create a JSON object in Azure Key Vault that contains one or more properties:

{
  "foo": "bar",
  "snip": "snap"
}

Note that Azure AD tenant Id, client Id, vault_uri and client secret need to be specified. You can configure these values with environment variables before starting Kong Gateway:

export KONG_VAULT_AZURE_VAULT_URI=https://my-vault.vault.azure.com
export AZURE_TENANT_ID=tenant_id
export AZURE_CLIENT_ID=client_id
export AZURE_CLIENT_SECRET=client_secret

{vault://azure/secret-name/foo}
{vault://azure/secret-name/snip}

alternatively, you can configure the vault via the vaults entity.

Configuration via vaults entity

Once the database is initialized, a Vault entity can be created to encapsulate the provider and the required Azure Key Vault information:

Admin API

Declarative configuration

curl -i -X PUT http://localhost:8001/vaults/azure-key-vault \
  --data name=azure \
  --data description="Storing secrets in Azure Key Vault (Secrets)" \
  --data config.type="secrets" \
  --data config.location="us-east" \
  --data config.vault_uri="http://my-vault-uri.azure.com"

Result:

{
    "config": {
        "client_id": null,
        "credentials_prefix": "AZURE",
        "vault_uri": "http://my-vault-uri.azure.com",
        "location": "us-east",
        "neg_ttl": null,
        "resurrect_ttl": null,
        "tenant_id": null,
        "ttl": null,
        "type": "secrets",
        "vault_uri": null
    },
    "created_at": 1696235611,
    "description": "Storing secrets in Azure Key Vault (Secrets)",
    "id": "7c9287c1-2cbc-406b-a013-843fe54dc0b6",
    "name": "azure",
    "prefix": "azure-key-vault",
    "tags": null,
    "updated_at": 1696235611
}

Secrets management is only supported in decK 1.16 and later.

Add the following snippet to your declarative configuration file:

_format_version: "3.0"
vaults:
- config:
    type: secrets
    vault_uri: http://my-vault-uri.azure.com
    location: us-east
  description: Storing secrets in Azure Key Vaults
  name: azure
  prefix: azure-key-vault

With the Vault entity in place, you can reference the Azure secrets through it:

{vault://azure-key-vault/secret-name/foo}
{vault://azure-key-vault/secret-name/snip}

Vault entity configuration options

Use the following configuration options to configure the vaults entity through any of the supported tools:

• Kong Manager

• Konnect

• Admin API

• Declarative configuration

Configuration options for a Azure Key Vault in Kong Gateway:

Common options: