curl http://localhost:8200/v1/secret/data/keyring \
-H "X-Vault-Token: $VAULT_TOKEN" \
-H "Content-Type: application/json" \
-d '{"data":{"id":"8zgITLQh","key":"t6NWgbj3g9cbNVC3/D6oZ2Md1Br5gWtRrqb1T2FZy44="}}'
Copied!
Store Keyring data in a HashiCorp Vault
Uses:
Kong Gateway
Incompatible with
konnect
Related Documentation
Related Resources
Minimum Version
Kong Gateway - 3.4
TL;DR
Create a HashiCorp Vault and add a key and ID, then set the kong_keyring_strategy kong.conf parameter to vault and the required keyring_vault_* parameters in your configuration, either in kong.conf or with environment variables. Use the /keyring/vault/sync API to synchronize.
Prerequisites
HashiCorp Vault
This how-to requires you to have a dev mode or self-managed HashiCorp Vault. The following instructions will guide you through configuring a HashiCorp Vault in dev mode with the resources you need to integrate it with Kong Gateway.
Important: This tutorial uses the literal
rootstring as your token, which should only be used in testing and development environments.
- In a terminal, start your Vault dev server with
rootas your token.docker run -d --name vault -p 8200:8200 -e 'VAULT_DEV_ROOT_TOKEN_ID=root' hashicorp/vaultCopied! - Export the
VAULT_ADDRandVAULT_TOKEN:export VAULT_ADDR="http://host.docker.internal:8200" export VAULT_TOKEN="root" export VAULT_HOST="host.docker.internal"Copied!
Create a key in the HashiCorp Vault
The Keyring integration with HashiCorp Vaults allows you to store and version Keyring data. Kong Gateway nodes can read the keys directly from the Vault to encrypt and decrypt sensitive data.
First, we need to add a key and key ID to the Vault. Let’s create a secret named keyring:
Start Kong Gateway
Set the environment variables that will be used by Kong Gateway to enable the Keyring and connect it to the HashiCorp Vault. Since the Keyring feature requires a Kong Gateway Enterprise license, make sure to include it in the environment too.
Create the Kong Gateway container with the environment variables. In this example, we can use the quickstart:
curl -Ls https://get.konghq.com/quickstart | bash -s -- -r "" -e KONG_LICENSE_DATA \
-e KONG_KEYRING_ENABLED=on \
-e KONG_KEYRING_STRATEGY=vault \
-e KONG_KEYRING_VAULT_HOST=$VAULT_ADDR \
-e KONG_KEYRING_VAULT_MOUNT=secret \
-e KONG_KEYRING_VAULT_PATH=keyring \
-e KONG_KEYRING_VAULT_AUTH_METHOD=token \
-e KONG_KEYRING_VAULT_TOKEN=$VAULT_TOKEN
Copied!
Synchronize the Vault with the Keyring
Once the container is created, use the following command to sync the Keyring data from the HashiCorp Vault to the Kong Gateway Keyring.
curl -X POST "http://localhost:8001/keyring/vault/sync" \
--no-progress-meter --fail-with-body
Copied!
Validate
Check that the Keyring contains the key that we created in the HashiCorp Vault:
curl "http://localhost:8001/keyring/" \
--no-progress-meter --fail-with-body
Copied!
The response should contain the ID of the key we created:
{
"ids":[
"8zgITLQh"
],
"active":"8zgITLQh"
}
Copied!
Cleanup
Clean up HashiCorp Vault
Stop the HashiCorp Vault dev server container by running the following:
docker rm -f vault
Copied!
Destroy the Kong Gateway container
curl -Ls https://get.konghq.com/quickstart | bash -s -- -d
Copied!
FAQs
How do I rotate my secrets in HashiCorp Vault and how does Kong Gateway pick up the new secret values?
You can rotate your secret in HashiCorp Vault by creating a new secret version with the updated value. You’ll also want to configure the ttl settings in your Kong Gateway Vault entity so that Kong Gateway pulls the rotated secret periodically.
How does Kong Gateway retrieve secrets from HashiCorp Vault?
Kong Gateway retrieves secrets from HashiCorp Vault’s HTTP API through a two-step process: authentication and secret retrieval.
Step 1: Authentication
Depending on the authentication method defined in config.auth_method, Kong Gateway authenticates to HashiCorp Vault using one of the following methods:
- If you’re using the
tokenauth method, Kong Gateway uses theconfig.tokenas the client token. - If you’re using the
kubernetesauth method, Kong Gateway uses the service account JWT token mounted in the pod (path defined in theconfig.kube_api_token_file) to call the login API for the Kubernetes auth path on the HashiCorp Vault server and retrieve a client token. -
v3.4+ If you’re using the
approleauth method, Kong Gateway uses the AppRole credentials to retrieve a client token. The AppRole role ID is configured by fieldconfig.approle_role_id, and the secret ID is configured by fieldconfig.approle_secret_idorconfig.approle_secret_id_file.- If you set
config.approle_response_wrappingtotrue, then the secret ID configured byconfig.approle_secret_idorconfig.approle_secret_id_filewill be a response wrapping token, and Kong Gateway will call the unwrap API/v1/sys/wrapping/unwrapto unwrap the response wrapping token to fetch the real secret ID. Kong Gateway will use the AppRole role ID and secret ID to call the login API for the AppRole auth path on the HashiCorp Vault server and retrieve a client token.
- If you set
By calling the login API, Kong Gateway will retrieve a client token and then use it in the next step as the value of X-Vault-Token header to retrieve a secret.
Step 2: Retrieving the secret
Kong Gateway uses the client token retrieved in the authentication step to call the Read Secret API and retrieve the secret value. The request varies depending on the secrets engine version you’re using. Kong Gateway will parse the response of the read secret API automatically and return the secret value.