File system vault

The file system vault reads secrets from files on the Kong Gateway data plane’s local filesystem. This vault type doesn’t require any external services or credentials.

You can set up a file system vault in one of the following ways:

• Using the Vault entity
• Using environment variables, set at Kong Gateway startup
• Using parameters in kong.conf, set at Kong Gateway startup

The Vault entity can only be used once the database is initialized. Secrets for values that are used before the database is initialized can’t make use of the Vaults entity.

Cloud Gateway limitations: The file system vault backend is not supported on Dedicated Cloud Gateways or Serverless Gateways. These gateways don’t provide access to the data plane’s local filesystem, so secret files can’t be stored there.

Secrets can be plain text files or JSON files. Set vaults.config.prefix to the directory containing your secret files, then reference secrets relative to that directory:

{
  "client_id": "abc",
  "client_secret": "test123",
  "issuer": "https://your-idp/oauth"
}

abc

The following example creates an fs Vault entity that looks for secrets in the directory /tmp/kong/secrets:

_format_version: "3.0"
vaults:
  - name: fs
    prefix: fs-vault
    description: Storing secrets in local files
    config:
      prefix: "/tmp/kong/secrets"

curl -i -X POST http://localhost:8001/vaults/ \
    --header "Accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
      "name": "fs",
      "prefix": "fs-vault",
      "description": "Storing secrets in local files",
      "config": {
        "prefix": "/tmp/kong/secrets"
      }
    }
    '

curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/vaults/ \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "fs",
      "prefix": "fs-vault",
      "description": "Storing secrets in local files",
      "config": {
        "prefix": "/tmp/kong/secrets"
      }
    }
    '

echo "
apiVersion: configuration.konghq.com/v1alpha1
kind: KongVault
metadata:
  name: fs-vault
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
spec:
  backend: fs
  prefix: fs-vault
  description: Storing secrets in local files
  config:
    prefix: '/tmp/kong/secrets'
" | kubectl apply -f -

resource "konnect_gateway_vault" "my_vault" {
  prefix = "fs-vault"
  description = "Storing secrets in local files"
  config = {
    prefix = "/tmp/kong/secrets"
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
}

The following table lists the available configuration parameters for a file system vault:

• Configure the file system vault backend View →