Configure Google Cloud Secret Manager as a vault backend

To add Secret Manager as a Vault backend to Kong Gateway, you must configure the following:

1. In the Google Cloud console, create a project and name it test-gateway-vault.

2. On the Secret Manager page, create a secret called test-secret with the following JSON content:

    secret

   Copied!
3. Create a service account key and grant IAM permissions:
   1. In the Service Account settings, click the test-gateway-vault project and then click the email address of the service account that you want to create a key for.
   2. From the Keys tab, create a new key from the add key menu and select JSON for the key type.
   3. Save the JSON file you downloaded.
   4. From the IAM & Admin settings, click the edit icon next to the service account to grant access to the Secret Manager Secret Accessor role for your service account.

Set the environment variables needed to authenticate to Google Cloud:

export GCP_SERVICE_ACCOUNT=$(cat /path/to/file/service-account.json | jq -c)
export KONG_LUA_SSL_TRUSTED_CERTIFICATE='system'

Note that these variables need to be passed when creating your Data Plane container.

This is a Konnect tutorial and requires a Konnect personal access token.

1. Create a new personal access token by opening the Konnect PAT page and selecting Generate Token.

2. Export your token to an environment variable:

   export KONNECT_TOKEN='YOUR_KONNECT_PAT'

   Copied!

3. Run the quickstart script to automatically provision a Control Plane and Data Plane, and configure your environment:

   curl -Ls https://get.konghq.com/quickstart | bash -s -- -k $KONNECT_TOKEN \
        -e GCP_SERVICE_ACCOUNT
        -e KONG_LUA_SSL_TRUSTED_CERTIFICATE
        --deck-output

   Copied!

   This sets up a Konnect Control Plane named quickstart, provisions a local Data Plane, and prints out the following environment variable exports:

   export DECK_KONNECT_TOKEN=$KONNECT_TOKEN
   export DECK_KONNECT_CONTROL_PLANE_NAME=quickstart
   export DECK_KONNECT_ADDR=https://us.api.konghq.com
   export KONNECT_CONTROL_PLANE_URL=https://us.api.konghq.com
   export KONNECT_PROXY_URL='http://localhost:8000'

   Copied!

   Copy and paste these into your terminal to configure your session.

This tutorial requires Kong Gateway Enterprise. If you don’t have Kong Gateway set up yet, you can use the quickstart script with an enterprise license to get an instance of Kong Gateway running almost instantly.

1. Export your license to an environment variable:

    export KONG_LICENSE_DATA='LICENSE-CONTENTS-GO-HERE'

   Copied!

2. Run the quickstart script:

   curl -Ls https://get.konghq.com/quickstart | bash -s -- -e KONG_LICENSE_DATA \
        -e GCP_SERVICE_ACCOUNT \
        -e KONG_LUA_SSL_TRUSTED_CERTIFICATE

   Copied!

   Once Kong Gateway is ready, you will see the following message:

    Kong Gateway Ready

To complete this tutorial, install decK. We recommend keeping decK up to date with the latest version (1.66.1).

decK is a CLI tool for managing Kong Gateway declaratively with state files. This guide uses deck gateway apply, which directly applies entity configuration to your Gateway instance.

You can check your current decK version with deck version.