Store and rotate Mistral API keys as secrets in Google Cloud

To add Secret Manager as a Vault backend to Kong Gateway, you must create a project, service account key, and grant IAM permissions. This tutorial also uses gcloud, so you need to install and configure that.

1. In the Google Cloud console, create a project and name it test-gateway-vault.
2. In the Service Account settings, click the test-gateway-vault project and then click the email address of the service account that you want to create a key for.
3. From the Keys tab, create a new key from the add key menu and select JSON for the key type.
4. Save the JSON file you downloaded.
5. From the IAM & Admin settings, click the edit icon next to the service account to grant access to the Secret Manager Secret Accessor role for your service account.
6. Install gcloud.
7. Authenticate with gcloud and set your project to test-gateway-vault:

   gcloud auth login
   gcloud config set project test-gateway-vault

   Copied!

In this tutorial, you’ll be storing your Mistral AI API key as a secret in a Konnect Vault.

In the Mistral AI console, create an API key and copy it. You’ll add this API key as a secret to your vault.

Set the environment variables needed to authenticate to Google Cloud:

export GCP_SERVICE_ACCOUNT=$(cat /path/to/file/service-account.json)
export MISTRAL_API_KEY="Bearer YOUR-MISTRAL-API-KEY"

Note that the GCP_SERVICE_ACCOUNT variables must be passed when creating your data plane container.

This is a Konnect tutorial and requires a Konnect personal access token.

1. Create a new personal access token by opening the Konnect PAT page and selecting Generate Token.

2. Export your token to an environment variable:

   export KONNECT_TOKEN='YOUR_KONNECT_PAT'

   Copied!

3. Run the quickstart script to automatically provision a Control Plane and Data Plane, and configure your environment:

   curl -Ls https://get.konghq.com/quickstart | bash -s -- -k $KONNECT_TOKEN \
        -e GCP_SERVICE_ACCOUNT
        --deck-output

   Copied!

   This sets up a Konnect Control Plane named quickstart, provisions a local Data Plane, and prints out the following environment variable exports:

   export DECK_KONNECT_TOKEN=$KONNECT_TOKEN
   export DECK_KONNECT_CONTROL_PLANE_NAME=quickstart
   export DECK_KONNECT_ADDR=https://us.api.konghq.com
   export KONNECT_CONTROL_PLANE_URL=https://us.api.konghq.com
   export KONNECT_PROXY_URL='http://localhost:8000'

   Copied!

   Copy and paste these into your terminal to configure your session.

This tutorial requires Kong Gateway Enterprise. If you don’t have Kong Gateway set up yet, you can use the quickstart script with an enterprise license to get an instance of Kong Gateway running almost instantly.

1. Export your license to an environment variable:

    export KONG_LICENSE_DATA='LICENSE-CONTENTS-GO-HERE'

   Copied!

2. Run the quickstart script:

   curl -Ls https://get.konghq.com/quickstart | bash -s -- -e KONG_LICENSE_DATA \
        -e GCP_SERVICE_ACCOUNT

   Copied!

   Once Kong Gateway is ready, you will see the following message:

    Kong Gateway Ready

To complete this tutorial, install decK. We recommend keeping decK up to date with the latest version (1.66.1).

decK is a CLI tool for managing Kong Gateway declaratively with state files. This guide uses deck gateway apply, which directly applies entity configuration to your Gateway instance.

You can check your current decK version with deck version.

For this tutorial, you’ll need Kong Gateway entities, like Gateway Services and Routes, pre-configured. These entities are essential for Kong Gateway to function but installing them isn’t the focus of this guide. Follow these steps to pre-configure them:

1. Run the following command:

   echo '
   _format_version: "3.0"
   services:
     - name: example-service
       url: http://httpbin.konghq.com/anything
   routes:
     - name: example-route
       paths:
       - "/anything"
       service:
         name: example-service
       protocols:
       - http
       - https
   ' | deck gateway apply -

   Copied!

To learn more about entities, you can read our entities documentation.