Azure Key Vault (Certificates)

Kong Gateway can retrieve Azure Key Vault for Certificates for Kong Gateway TLS termination.

You can set up an Azure Key Vault for Certificates vault in one of the following ways:

• Using the Vault entity
• Using environment variables, set at Kong Gateway startup
• Using parameters in kong.conf, set at Kong Gateway startup

The Vault entity can only be used once the database is initialized. Secrets for values that are used before the database is initialized can’t make use of the Vaults entity.

Kong Gateway uses a key to automatically authenticate with the Azure Key Vaults API and grant you access. If you’re using a client secret for authentication, set the following environment variable on your data plane to connect with an Azure Key Vault:

export AZURE_CLIENT_SECRET='YOUR_CLIENT_SECRET'

By default, the vault looks for AZURE_CLIENT_SECRET, but you can customize this with the credentials_prefix field.

If you’re using an Instance Managed Identity Token, you don’t need to set the client secret env variable.

Dedicated Cloud Gateway limitations:

• Azure Key Vault is not supported as a Vault backend on Dedicated Cloud Gateways: Since the client secret has no Vault entity equivalent, it can only be set through this environment variable (or the credentials_prefix variant). Dedicated Cloud Gateways only accept KONG_ and OTEL_ prefixed environment variables, so AZURE_CLIENT_SECRET can’t be set.
• Azure managed identity is not supported on Dedicated Cloud Gateways.

You also need to set KONG_LUA_SSL_VERIFY_DEPTH to at least 3 on your data plane to allow Kong to verify the Azure Key Vault TLS certificate chain:

export KONG_LUA_SSL_VERIFY_DEPTH=3

At minimum, you’ll also need to set the following values on your data plane:

export KONG_VAULT_AZURE_CERTS_VAULT_URI='https://your-vault.vault.azure.com'
export KONG_VAULT_AZURE_CERTS_TENANT_ID='YOUR_TENANT_ID'
export KONG_VAULT_AZURE_CERTS_CLIENT_ID='YOUR_CLIENT_ID'

The following example creates an azure-certs Vault entity. The Vault name must be azure-certs. The vault.prefix value can be your own custom prefix:

_format_version: "3.0"
vaults:
  - name: azure-certs
    prefix: azure-certs-vault
    description: Retrieving certificates from Azure Key Vault
    config:
      vault_uri: https://azure.example.com
      tenant_id: example-azure-tenant-id
      client_id: example-azure-client-id

curl -i -X POST http://localhost:8001/vaults/ \
    --header "Accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
      "name": "azure-certs",
      "prefix": "azure-certs-vault",
      "description": "Retrieving certificates from Azure Key Vault",
      "config": {
        "vault_uri": "https://azure.example.com",
        "tenant_id": "example-azure-tenant-id",
        "client_id": "example-azure-client-id"
      }
    }
    '

curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/vaults/ \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "azure-certs",
      "prefix": "azure-certs-vault",
      "description": "Retrieving certificates from Azure Key Vault",
      "config": {
        "vault_uri": "https://azure.example.com",
        "tenant_id": "example-azure-tenant-id",
        "client_id": "example-azure-client-id"
      }
    }
    '

echo "
apiVersion: configuration.konghq.com/v1alpha1
kind: KongVault
metadata:
  name: azure-certs-vault
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
spec:
  backend: azure-certs
  prefix: azure-certs-vault
  description: Retrieving certificates from Azure Key Vault
  config:
    vault_uri: https://azure.example.com
    tenant_id: example-azure-tenant-id
    client_id: example-azure-client-id
" | kubectl apply -f -

resource "konnect_gateway_vault" "my_vault" {
  prefix = "azure-certs-vault"
  description = "Retrieving certificates from Azure Key Vault"
  config = {
    vault_uri = "https://azure.example.com"
    tenant_id = "example-azure-tenant-id"
    client_id = "example-azure-client-id"
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
}

The following table lists all of the available configuration parameters for an Azure Key Vault (Certificates) vault: