Google Cloud Secret Manager vault

You can set up a Google Cloud Secret Manager vault in one of the following ways:

• Using the Vault entity
• Using environment variables, set at Kong Gateway startup
• Using parameters in kong.conf, set at Kong Gateway startup

The Vault entity can only be used once the database is initialized. Secrets for values that are used before the database is initialized can’t make use of the Vaults entity.

To configure GCP Secret Manager, the GCP_SERVICE_ACCOUNT environment variable must be set to the JSON document referring to the credentials for your service account:

export GCP_SERVICE_ACCOUNT=$(cat gcp-project-c61f2411f321.json)

Kong Gateway uses the key to automatically authenticate with the GCP API and grant you access.

To use GCP Secret Manager with Workload Identity on a GKE cluster, update your pod spec so that the service account is attached to the pod. For configuration information, read the Workload Identity configuration documentation.

Notes:

• With Workload Identity, setting the GCP_SERVICE_ACCOUNT isn’t necessary.
• When using GCP Vault as a backend, make sure you have configured system as part of the lua_ssl_trusted_certificate configuration directive so that the SSL certificates used by the official GCP API can be trusted by Kong.

The following example creates a gcp Vault entity:

_format_version: "3.0"
vaults:
  - name: gcp
    prefix: gcp-sm-vault
    description: Stored secrets in Secret Manager
    config:
      project_id: test-gateway-vault

curl -i -X POST http://localhost:8001/vaults/ \
    --header "Accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
      "name": "gcp",
      "prefix": "gcp-sm-vault",
      "description": "Stored secrets in Secret Manager",
      "config": {
        "project_id": "test-gateway-vault"
      }
    }
    '

curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/vaults/ \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "gcp",
      "prefix": "gcp-sm-vault",
      "description": "Stored secrets in Secret Manager",
      "config": {
        "project_id": "test-gateway-vault"
      }
    }
    '

echo "
apiVersion: configuration.konghq.com/v1alpha1
kind: KongVault
metadata:
  name: gcp-vault
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
spec:
  backend: gcp
  prefix: gcp-sm-vault
  description: Stored secrets in Secret Manager
  config:
    project_id: test-gateway-vault
" | kubectl apply -f -

resource "konnect_gateway_vault" "my_vault" {
  prefix = "gcp-sm-vault"
  description = "Stored secrets in Secret Manager"
  config = {
    project_id = "test-gateway-vault"
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
}

The following table lists the available configuration parameters for a GCP Secret Manager Vault:

• Configure Google Cloud Secret Manager as a vault backend View →