CyberArk Secrets Manager vault

Uses: Kong Gateway Admin API deck KIC Konnect API Terraform

Create a CyberArk Secrets Manager vault

The following example creates a conjur Vault entity:

kong.yaml

Copied!

_format_version: "3.0"
vaults:
  - name: conjur
    description: Storing secrets in CyberArk Secrets Manager Vault
    prefix: conjur-vault
    config:
      endpoint_url: https://conjur.example.com
      account: example-account
      login: example-login
      auth_method: api_key
      api_key: example-key

curl -i -X POST http://localhost:8001/vaults/ \
    --header "Accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
      "name": "conjur",
      "description": "Storing secrets in CyberArk Secrets Manager Vault",
      "prefix": "conjur-vault",
      "config": {
        "endpoint_url": "https://conjur.example.com",
        "account": "example-account",
        "login": "example-login",
        "auth_method": "api_key",
        "api_key": "example-key"
      }
    }
    '

Copied!

To create a Vault entity, call the Konnect control plane config API’s /vaults endpoint.

curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/vaults/ \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "conjur",
      "description": "Storing secrets in CyberArk Secrets Manager Vault",
      "prefix": "conjur-vault",
      "config": {
        "endpoint_url": "https://conjur.example.com",
        "account": "example-account",
        "login": "example-login",
        "auth_method": "api_key",
        "api_key": "example-key"
      }
    }
    '

Copied!

echo "
apiVersion: configuration.konghq.com/v1alpha1
kind: KongVault
metadata:
  name: conjur-vault
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
spec:
  backend: conjur
  description: Storing secrets in CyberArk Secrets Manager Vault
  prefix: conjur-vault
  config:
    endpoint_url: https://conjur.example.com
    account: example-account
    login: example-login
    auth_method: api_key
    api_key: example-key
" | kubectl apply -f -

Copied!

resource "konnect_gateway_vault" "my_vault" {
  description = "Storing secrets in CyberArk Secrets Manager Vault"
  prefix = "conjur-vault"
  config = {
    endpoint_url = "https://conjur.example.com"
    account = "example-account"
    login = "example-login"
    auth_method = "api_key"
    api_key = "example-key"
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
}

Copied!

Vault configuration options

The following table lists the available configuration parameters for a CyberArk Secrets Manager Vault:

Field name	Parameter format	Description
Endpoint URL v3.11+	Vault entity: `vaults.config.endpoint_url` kong.conf parameter: `vault_conjur_endpoint_url` Environment variable: `KONG_VAULT_CONJUR_ENDPOINT_URL`	The CyberArk Secrets Manager backend URL to connect with. Accepts `http` or `https` protocols.
Authentication method v3.11+	Vault entity: `vaults.config.auth_method` kong.conf parameter: `vault_conjur_auth_method` Environment variable: `KONG_VAULT_CONJUR_AUTH_METHOD`	Defines the authentication mechanism for connecting to the CyberArk Secrets Manager Vault service. Accepted value: `api_key`.
Account v3.11+	Vault entity: `vaults.config.account` kong.conf parameter: `vault_conjur_account` Environment variable: `KONG_VAULT_CONJUR_ACCOUNT`	The CyberArk Secrets Manager organization account name.
Login v3.11+	Vault entity: `vaults.config.login` kong.conf parameter: `vault_conjur_login` Environment variable: `KONG_VAULT_CONJUR_LOGIN`	The login name of the workload identity.
API Key v3.11+	Vault entity: `vaults.config.api_key` kong.conf parameter: `vault_conjur_api_key` Environment variable: `KONG_VAULT_CONJUR_API_KEY`	The API key of the workload identity.
TTL v3.11+	Vault entity: `vaults.config.ttl` kong.conf parameter: `vault_conjur_ttl` Environment variable: `KONG_VAULT_CONJUR_TTL`	Time-to-live (in seconds) for a cached secret. A value of 0 (default) disables rotation. For non-zero values, use at least 60 seconds.
Negative TTL v3.11+	Vault entity: `vaults.config.neg_ttl` kong.conf parameter: `vault_conjur_neg_ttl` Environment variable: `KONG_VAULT_CONJUR_NEG_TTL`	Time-to-live (in seconds) for caching failed secret lookups. A value of 0 (default) disables negative caching. Kong retries after `neg_ttl` expires.
Resurrect TTL v3.11+	Vault entity: `vaults.config.resurrect_ttl` kong.conf parameter: `vault_conjur_resurrect_ttl` Environment variable: `KONG_VAULT_CONJUR_RESURRECT_TTL`	Duration (in seconds) that secrets remain usable after expiration (`config.ttl` is over). Useful when the vault is unreachable or a secret is deleted but not yet replaced. Kong continues retrying for `resurrect_ttl` seconds, then stops. The default is 1e8 seconds (~3 years).

Tutorials

Configure CyberArk Secrets Manager (Conjur) as a vault backend View →

CyberArk Secrets Manager vault

Create a CyberArk Secrets Manager vault

Vault configuration options

Tutorials

Help us make these docs great!

Still need help?