Environment variable vault

The environment variable vault is built into Kong Gateway and doesn’t require any external services. You can store secrets as environment variables on the data plane and reference them in any field that supports Vault references.

You can set up an environment variable vault in one of the following ways:

The Vault entity can only be used once the database is initialized. Secrets for values that are used before the database is initialized can’t make use of the Vaults entity.

Create an environment variable vault

The following example creates an env Vault entity:

Vault configuration options

Field name

Parameter format

Description

Environment Variable Prefix
  • Vault entity: vaults.config.prefix
  • kong.conf parameter: vault_env_prefix
  • Environment variable: KONG_VAULT_ENV_PREFIX
The prefix for the environment variable that the value will be stored in.
Base64 Decode
v3.11+
  • Vault entity: vaults.config.base64_decode
  • kong.conf parameter: vault_env_decode_base64
  • Environment variable: KONG_VAULT_ENV_DECODE_BASE64
Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.

Help us make these docs great!

Kong Developer docs are open source. If you find these useful and want to make them better, contribute today!