Konnect Config Store vault

The Konnect Config Store vault lets you store and reference secrets directly in Konnect, without connecting to a third-party vault backend. You can manage secrets using the Control Planes Configuration API or the Konnect UI.

Because Konnect resolves these secrets after Kong Gateway connects to the control plane, you can only configure the Konnect Config Store vault using a Vault entity. It doesn’t support kong.conf parameters or environment variables, and you can’t use it to resolve secrets referenced in kong.conf.

Warning: The Konnect Config Store stores secrets at the control plane level, and secret references are resolved before sending the configuration to the data planes. Because of this behavior, you can’t use Konnect Config Store secrets directly in Lua code via the Kong PDK.

Before creating the Vault entity, create a Config Store by sending a POST request to the /config-stores endpoint:

curl -X POST "https://us.api.konghq.com/v2/control-planes/$CONTROL_PLANE_ID/config-stores" \
     --no-progress-meter --fail-with-body  \
     -H "Authorization: Bearer $KONNECT_TOKEN" \
     --json '{
       "name": "my-config-store"
     }'

Export the Config Store ID from the response:

export DECK_CONFIG_STORE_ID='CONFIG STORE ID'

Then create the konnect Vault entity:

_format_version: "3.0"
vaults:
  - name: konnect
    prefix: mysecretvault
    description: Storing secrets in Konnect
    config:
      config_store_id: ${{ env "DECK_CONFIG_STORE_ID" }}

curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/vaults/ \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "konnect",
      "prefix": "mysecretvault",
      "description": "Storing secrets in Konnect",
      "config": {
        "config_store_id": "${config-store-id}"
      }
    }
    '

echo "
apiVersion: configuration.konghq.com/v1alpha1
kind: KongVault
metadata:
  name: konnect-vault
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
spec:
  backend: konnect
  prefix: mysecretvault
  description: Storing secrets in Konnect
  config:
    config_store_id: '$CONFIG_STORE_ID'
" | kubectl apply -f -

resource "konnect_gateway_vault" "my_vault" {
  prefix = "mysecretvault"
  description = "Storing secrets in Konnect"
  config = {
    config_store_id = var.config_store_id
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
}

The following table lists the available configuration parameters for a Konnect Config Store Vault:

• Configure the Konnect Config Store vault View →