GCP Secrets Manager

    • Environment variables
    • Workload Identity

    To configure GCP Secrets Manager, the environment variable must be set to the JSON document referring to the credentials for your service account:

    Kong Gateway uses the key to automatically authenticate with the GCP API and grant you access.

    To use GCP Secrets Manager with on a GKE cluster, update your pod spec so that the service account is attached to the pod. For configuration information, read the Workload Identity configuration documentation.

    To use a GCP Secret Manager secret with the name my-secret-name, create a JSON object in GCP that contains one or more properties:

    1. {
    2.   "foo": "bar",
    3.   "snip": "snap"
    4. }
    1. {vault://gcp/my-secret-name/foo?project_id=my_project_id}
    2. {vault://gcp/my-secret-name/snip?project_id=my_project_id}

    Note that both the provider (gcp) as well as the GCP project ID (my_project_id) need to be specified. You can configure the project ID with an environment variable before starting Kong Gateway:

    Then you don’t need to repeat it in references:

    Once the database is initialized, a Vault entity can be created that encapsulates the provider and the GCP project ID:

    Admin API

    Declarative configuration

    HTTPie

    1. curl -i -X PUT http://HOSTNAME:8001/vaults/my-gcp-sm-vault \
    2.   --data name=gcp \
    3.   --data description="Storing secrets in GCP Secrets Manager" \
    4.   --data config.project_id="my_project_id"

    Result:

    1. {
    2.     "config": {
    3.         "project_id": "my_project_id"
    4.     },
    5.     "created_at": 1657874961,
    6.     "description": "Storing secrets in GCP Secrets Manager",
    8.     "prefix": "my-gcp-sm-vault",
    9.     "tags": null,
    10.     "updated_at": 1657874961
    11. }

    Secrets management is supported in decK 1.16 and later.

    Add the following snippet to your declarative configuration file:

    1. _format_version: "3.0"
    2. vaults:
    3. - config:
    4.     project_id: my_project_id
    5.   description: Storing secrets in GCP Secrets Manager
    6.   name: gcp

    With the Vault entity in place, you can reference the GCP secrets through it: