published on Friday, Sep 18, 2026 by kong
published on Friday, Sep 18, 2026 by kong
AIGatewayVault Resource
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as konnect from "@pulumi/konnect";
const myAigatewayvault = new konnect.AiGatewayVault("my_aigatewayvault", {
aws: {
config: {
assumeRoleArn: "...my_assume_role_arn...",
base64Decode: true,
endpointUrl: "...my_endpoint_url...",
negTtl: 0,
region: "us-east-1",
resurrectTtl: 100000000,
roleSessionName: "KongVault",
stsEndpointUrl: "...my_sts_endpoint_url...",
ttl: 0,
},
description: "This vault is used to retrieve redis database access credentials",
labels: {
key: "value",
},
managedBy: {
key: "value",
},
name: "my-awesome-vault",
},
azure: {
config: {
base64Decode: true,
clientId: "...my_client_id...",
credentialsPrefix: "AZURE",
location: "...my_location...",
negTtl: 0,
resurrectTtl: 100000000,
tenantId: "...my_tenant_id...",
ttl: 0,
type: "secrets",
vaultUri: "...my_vault_uri...",
},
description: "This vault is used to retrieve redis database access credentials",
labels: {
key: "value",
},
managedBy: {
key: "value",
},
name: "my-awesome-vault",
},
conjur: {
config: {
account: "...my_account...",
apiKey: "...my_api_key...",
base64Decode: false,
endpointUrl: "...my_endpoint_url...",
login: "...my_login...",
negTtl: 0,
resurrectTtl: 100000000,
ttl: 0,
},
description: "This vault is used to retrieve redis database access credentials",
labels: {
key: "value",
},
managedBy: {
key: "value",
},
name: "my-awesome-vault",
},
env: {
config: {
base64Decode: false,
prefix: "MY_SECRET_",
},
description: "This vault is used to retrieve redis database access credentials",
labels: {
key: "value",
},
managedBy: {
key: "value",
},
name: "my-awesome-vault",
},
gatewayId: "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7",
gcp: {
config: {
base64Decode: true,
negTtl: 0,
projectId: "...my_project_id...",
resurrectTtl: 100000000,
ttl: 0,
},
description: "This vault is used to retrieve redis database access credentials",
labels: {
key: "value",
},
managedBy: {
key: "value",
},
name: "my-awesome-vault",
},
hcv: {
config: {
jwt: {
audiences: "...my_audiences...",
base64Decode: true,
clientId: "...my_client_id...",
clientSecret: "...my_client_secret...",
host: "...my_host...",
kv: "v1",
mount: "secret",
namespace: "...my_namespace...",
negTtl: 0,
port: 5,
protocol: "https",
resurrectTtl: 100000000,
role: "demo",
sslVerify: true,
tokenEndpoint: "...my_token_endpoint...",
ttl: 0,
},
},
description: "This vault is used to retrieve redis database access credentials",
labels: {
key: "value",
},
managedBy: {
key: "value",
},
name: "my-awesome-vault",
},
konnect: {
config: {
configStoreId: "77426bee-2bca-4005-81af-284868fd3038",
},
description: "This vault is used to retrieve redis database access credentials",
labels: {
key: "value",
},
managedBy: {
key: "value",
},
name: "my-awesome-vault",
},
});
import pulumi
import pulumi_konnect as konnect
my_aigatewayvault = konnect.AiGatewayVault("my_aigatewayvault",
aws={
"config": {
"assume_role_arn": "...my_assume_role_arn...",
"base64_decode": True,
"endpoint_url": "...my_endpoint_url...",
"neg_ttl": 0,
"region": "us-east-1",
"resurrect_ttl": 100000000,
"role_session_name": "KongVault",
"sts_endpoint_url": "...my_sts_endpoint_url...",
"ttl": 0,
},
"description": "This vault is used to retrieve redis database access credentials",
"labels": {
"key": "value",
},
"managed_by": {
"key": "value",
},
"name": "my-awesome-vault",
},
azure={
"config": {
"base64_decode": True,
"client_id": "...my_client_id...",
"credentials_prefix": "AZURE",
"location": "...my_location...",
"neg_ttl": 0,
"resurrect_ttl": 100000000,
"tenant_id": "...my_tenant_id...",
"ttl": 0,
"type": "secrets",
"vault_uri": "...my_vault_uri...",
},
"description": "This vault is used to retrieve redis database access credentials",
"labels": {
"key": "value",
},
"managed_by": {
"key": "value",
},
"name": "my-awesome-vault",
},
conjur={
"config": {
"account": "...my_account...",
"api_key": "...my_api_key...",
"base64_decode": False,
"endpoint_url": "...my_endpoint_url...",
"login": "...my_login...",
"neg_ttl": 0,
"resurrect_ttl": 100000000,
"ttl": 0,
},
"description": "This vault is used to retrieve redis database access credentials",
"labels": {
"key": "value",
},
"managed_by": {
"key": "value",
},
"name": "my-awesome-vault",
},
env={
"config": {
"base64_decode": False,
"prefix": "MY_SECRET_",
},
"description": "This vault is used to retrieve redis database access credentials",
"labels": {
"key": "value",
},
"managed_by": {
"key": "value",
},
"name": "my-awesome-vault",
},
gateway_id="5f9fd312-a987-4628-b4c5-bb4f4fddd5f7",
gcp={
"config": {
"base64_decode": True,
"neg_ttl": 0,
"project_id": "...my_project_id...",
"resurrect_ttl": 100000000,
"ttl": 0,
},
"description": "This vault is used to retrieve redis database access credentials",
"labels": {
"key": "value",
},
"managed_by": {
"key": "value",
},
"name": "my-awesome-vault",
},
hcv={
"config": {
"jwt": {
"audiences": "...my_audiences...",
"base64_decode": True,
"client_id": "...my_client_id...",
"client_secret": "...my_client_secret...",
"host": "...my_host...",
"kv": "v1",
"mount": "secret",
"namespace": "...my_namespace...",
"neg_ttl": 0,
"port": 5,
"protocol": "https",
"resurrect_ttl": 100000000,
"role": "demo",
"ssl_verify": True,
"token_endpoint": "...my_token_endpoint...",
"ttl": 0,
},
},
"description": "This vault is used to retrieve redis database access credentials",
"labels": {
"key": "value",
},
"managed_by": {
"key": "value",
},
"name": "my-awesome-vault",
},
konnect={
"config": {
"config_store_id": "77426bee-2bca-4005-81af-284868fd3038",
},
"description": "This vault is used to retrieve redis database access credentials",
"labels": {
"key": "value",
},
"managed_by": {
"key": "value",
},
"name": "my-awesome-vault",
})
package main
import (
"github.com/pulumi/pulumi-terraform-provider/sdks/go/konnect/v3/konnect"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := konnect.NewAiGatewayVault(ctx, "my_aigatewayvault", &konnect.AiGatewayVaultArgs{
Aws: &konnect.AiGatewayVaultAwsArgs{
Config: &konnect.AiGatewayVaultAwsConfigArgs{
AssumeRoleArn: pulumi.String("...my_assume_role_arn..."),
Base64Decode: pulumi.Bool(true),
EndpointUrl: pulumi.String("...my_endpoint_url..."),
NegTtl: pulumi.Float64(0),
Region: pulumi.String("us-east-1"),
ResurrectTtl: pulumi.Float64(100000000),
RoleSessionName: pulumi.String("KongVault"),
StsEndpointUrl: pulumi.String("...my_sts_endpoint_url..."),
Ttl: pulumi.Float64(0),
},
Description: pulumi.String("This vault is used to retrieve redis database access credentials"),
Labels: pulumi.StringMap{
"key": pulumi.String("value"),
},
ManagedBy: pulumi.StringMap{
"key": pulumi.String("value"),
},
Name: pulumi.String("my-awesome-vault"),
},
Azure: &konnect.AiGatewayVaultAzureArgs{
Config: &konnect.AiGatewayVaultAzureConfigArgs{
Base64Decode: pulumi.Bool(true),
ClientId: pulumi.String("...my_client_id..."),
CredentialsPrefix: pulumi.String("AZURE"),
Location: pulumi.String("...my_location..."),
NegTtl: pulumi.Float64(0),
ResurrectTtl: pulumi.Float64(100000000),
TenantId: pulumi.String("...my_tenant_id..."),
Ttl: pulumi.Float64(0),
Type: pulumi.String("secrets"),
VaultUri: pulumi.String("...my_vault_uri..."),
},
Description: pulumi.String("This vault is used to retrieve redis database access credentials"),
Labels: pulumi.StringMap{
"key": pulumi.String("value"),
},
ManagedBy: pulumi.StringMap{
"key": pulumi.String("value"),
},
Name: pulumi.String("my-awesome-vault"),
},
Conjur: &konnect.AiGatewayVaultConjurArgs{
Config: &konnect.AiGatewayVaultConjurConfigArgs{
Account: pulumi.String("...my_account..."),
ApiKey: pulumi.String("...my_api_key..."),
Base64Decode: pulumi.Bool(false),
EndpointUrl: pulumi.String("...my_endpoint_url..."),
Login: pulumi.String("...my_login..."),
NegTtl: pulumi.Float64(0),
ResurrectTtl: pulumi.Float64(100000000),
Ttl: pulumi.Float64(0),
},
Description: pulumi.String("This vault is used to retrieve redis database access credentials"),
Labels: pulumi.StringMap{
"key": pulumi.String("value"),
},
ManagedBy: pulumi.StringMap{
"key": pulumi.String("value"),
},
Name: pulumi.String("my-awesome-vault"),
},
Env: &konnect.AiGatewayVaultEnvArgs{
Config: &konnect.AiGatewayVaultEnvConfigArgs{
Base64Decode: pulumi.Bool(false),
Prefix: pulumi.String("MY_SECRET_"),
},
Description: pulumi.String("This vault is used to retrieve redis database access credentials"),
Labels: pulumi.StringMap{
"key": pulumi.String("value"),
},
ManagedBy: pulumi.StringMap{
"key": pulumi.String("value"),
},
Name: pulumi.String("my-awesome-vault"),
},
GatewayId: pulumi.String("5f9fd312-a987-4628-b4c5-bb4f4fddd5f7"),
Gcp: &konnect.AiGatewayVaultGcpArgs{
Config: &konnect.AiGatewayVaultGcpConfigArgs{
Base64Decode: pulumi.Bool(true),
NegTtl: pulumi.Float64(0),
ProjectId: pulumi.String("...my_project_id..."),
ResurrectTtl: pulumi.Float64(100000000),
Ttl: pulumi.Float64(0),
},
Description: pulumi.String("This vault is used to retrieve redis database access credentials"),
Labels: pulumi.StringMap{
"key": pulumi.String("value"),
},
ManagedBy: pulumi.StringMap{
"key": pulumi.String("value"),
},
Name: pulumi.String("my-awesome-vault"),
},
Hcv: &konnect.AiGatewayVaultHcvArgs{
Config: &konnect.AiGatewayVaultHcvConfigArgs{
Jwt: &konnect.AiGatewayVaultHcvConfigJwtArgs{
Audiences: pulumi.String("...my_audiences..."),
Base64Decode: pulumi.Bool(true),
ClientId: pulumi.String("...my_client_id..."),
ClientSecret: pulumi.String("...my_client_secret..."),
Host: pulumi.String("...my_host..."),
Kv: pulumi.String("v1"),
Mount: pulumi.String("secret"),
Namespace: pulumi.String("...my_namespace..."),
NegTtl: pulumi.Float64(0),
Port: pulumi.Float64(5),
Protocol: pulumi.String("https"),
ResurrectTtl: pulumi.Float64(100000000),
Role: pulumi.String("demo"),
SslVerify: pulumi.Bool(true),
TokenEndpoint: pulumi.String("...my_token_endpoint..."),
Ttl: pulumi.Float64(0),
},
},
Description: pulumi.String("This vault is used to retrieve redis database access credentials"),
Labels: pulumi.StringMap{
"key": pulumi.String("value"),
},
ManagedBy: pulumi.StringMap{
"key": pulumi.String("value"),
},
Name: pulumi.String("my-awesome-vault"),
},
Konnect: &konnect.AiGatewayVaultKonnectArgs{
Config: &konnect.AiGatewayVaultKonnectConfigArgs{
ConfigStoreId: pulumi.String("77426bee-2bca-4005-81af-284868fd3038"),
},
Description: pulumi.String("This vault is used to retrieve redis database access credentials"),
Labels: pulumi.StringMap{
"key": pulumi.String("value"),
},
ManagedBy: pulumi.StringMap{
"key": pulumi.String("value"),
},
Name: pulumi.String("my-awesome-vault"),
},
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Konnect = Pulumi.Konnect;
return await Deployment.RunAsync(() =>
{
var myAigatewayvault = new Konnect.AiGatewayVault("my_aigatewayvault", new()
{
Aws = new Konnect.Inputs.AiGatewayVaultAwsArgs
{
Config = new Konnect.Inputs.AiGatewayVaultAwsConfigArgs
{
AssumeRoleArn = "...my_assume_role_arn...",
Base64Decode = true,
EndpointUrl = "...my_endpoint_url...",
NegTtl = 0,
Region = "us-east-1",
ResurrectTtl = 100000000,
RoleSessionName = "KongVault",
StsEndpointUrl = "...my_sts_endpoint_url...",
Ttl = 0,
},
Description = "This vault is used to retrieve redis database access credentials",
Labels =
{
{ "key", "value" },
},
ManagedBy =
{
{ "key", "value" },
},
Name = "my-awesome-vault",
},
Azure = new Konnect.Inputs.AiGatewayVaultAzureArgs
{
Config = new Konnect.Inputs.AiGatewayVaultAzureConfigArgs
{
Base64Decode = true,
ClientId = "...my_client_id...",
CredentialsPrefix = "AZURE",
Location = "...my_location...",
NegTtl = 0,
ResurrectTtl = 100000000,
TenantId = "...my_tenant_id...",
Ttl = 0,
Type = "secrets",
VaultUri = "...my_vault_uri...",
},
Description = "This vault is used to retrieve redis database access credentials",
Labels =
{
{ "key", "value" },
},
ManagedBy =
{
{ "key", "value" },
},
Name = "my-awesome-vault",
},
Conjur = new Konnect.Inputs.AiGatewayVaultConjurArgs
{
Config = new Konnect.Inputs.AiGatewayVaultConjurConfigArgs
{
Account = "...my_account...",
ApiKey = "...my_api_key...",
Base64Decode = false,
EndpointUrl = "...my_endpoint_url...",
Login = "...my_login...",
NegTtl = 0,
ResurrectTtl = 100000000,
Ttl = 0,
},
Description = "This vault is used to retrieve redis database access credentials",
Labels =
{
{ "key", "value" },
},
ManagedBy =
{
{ "key", "value" },
},
Name = "my-awesome-vault",
},
Env = new Konnect.Inputs.AiGatewayVaultEnvArgs
{
Config = new Konnect.Inputs.AiGatewayVaultEnvConfigArgs
{
Base64Decode = false,
Prefix = "MY_SECRET_",
},
Description = "This vault is used to retrieve redis database access credentials",
Labels =
{
{ "key", "value" },
},
ManagedBy =
{
{ "key", "value" },
},
Name = "my-awesome-vault",
},
GatewayId = "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7",
Gcp = new Konnect.Inputs.AiGatewayVaultGcpArgs
{
Config = new Konnect.Inputs.AiGatewayVaultGcpConfigArgs
{
Base64Decode = true,
NegTtl = 0,
ProjectId = "...my_project_id...",
ResurrectTtl = 100000000,
Ttl = 0,
},
Description = "This vault is used to retrieve redis database access credentials",
Labels =
{
{ "key", "value" },
},
ManagedBy =
{
{ "key", "value" },
},
Name = "my-awesome-vault",
},
Hcv = new Konnect.Inputs.AiGatewayVaultHcvArgs
{
Config = new Konnect.Inputs.AiGatewayVaultHcvConfigArgs
{
Jwt = new Konnect.Inputs.AiGatewayVaultHcvConfigJwtArgs
{
Audiences = "...my_audiences...",
Base64Decode = true,
ClientId = "...my_client_id...",
ClientSecret = "...my_client_secret...",
Host = "...my_host...",
Kv = "v1",
Mount = "secret",
Namespace = "...my_namespace...",
NegTtl = 0,
Port = 5,
Protocol = "https",
ResurrectTtl = 100000000,
Role = "demo",
SslVerify = true,
TokenEndpoint = "...my_token_endpoint...",
Ttl = 0,
},
},
Description = "This vault is used to retrieve redis database access credentials",
Labels =
{
{ "key", "value" },
},
ManagedBy =
{
{ "key", "value" },
},
Name = "my-awesome-vault",
},
Konnect = new Konnect.Inputs.AiGatewayVaultKonnectArgs
{
Config = new Konnect.Inputs.AiGatewayVaultKonnectConfigArgs
{
ConfigStoreId = "77426bee-2bca-4005-81af-284868fd3038",
},
Description = "This vault is used to retrieve redis database access credentials",
Labels =
{
{ "key", "value" },
},
ManagedBy =
{
{ "key", "value" },
},
Name = "my-awesome-vault",
},
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.konnect.AiGatewayVault;
import com.pulumi.konnect.AiGatewayVaultArgs;
import com.pulumi.konnect.inputs.AiGatewayVaultAwsArgs;
import com.pulumi.konnect.inputs.AiGatewayVaultAwsConfigArgs;
import com.pulumi.konnect.inputs.AiGatewayVaultAzureArgs;
import com.pulumi.konnect.inputs.AiGatewayVaultAzureConfigArgs;
import com.pulumi.konnect.inputs.AiGatewayVaultConjurArgs;
import com.pulumi.konnect.inputs.AiGatewayVaultConjurConfigArgs;
import com.pulumi.konnect.inputs.AiGatewayVaultEnvArgs;
import com.pulumi.konnect.inputs.AiGatewayVaultEnvConfigArgs;
import com.pulumi.konnect.inputs.AiGatewayVaultGcpArgs;
import com.pulumi.konnect.inputs.AiGatewayVaultGcpConfigArgs;
import com.pulumi.konnect.inputs.AiGatewayVaultHcvArgs;
import com.pulumi.konnect.inputs.AiGatewayVaultHcvConfigArgs;
import com.pulumi.konnect.inputs.AiGatewayVaultHcvConfigJwtArgs;
import com.pulumi.konnect.inputs.AiGatewayVaultKonnectArgs;
import com.pulumi.konnect.inputs.AiGatewayVaultKonnectConfigArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var myAigatewayvault = new AiGatewayVault("myAigatewayvault", AiGatewayVaultArgs.builder()
.aws(AiGatewayVaultAwsArgs.builder()
.config(AiGatewayVaultAwsConfigArgs.builder()
.assumeRoleArn("...my_assume_role_arn...")
.base64Decode(true)
.endpointUrl("...my_endpoint_url...")
.negTtl(0.0)
.region("us-east-1")
.resurrectTtl(100000000.0)
.roleSessionName("KongVault")
.stsEndpointUrl("...my_sts_endpoint_url...")
.ttl(0.0)
.build())
.description("This vault is used to retrieve redis database access credentials")
.labels(Map.of("key", "value"))
.managedBy(Map.of("key", "value"))
.name("my-awesome-vault")
.build())
.azure(AiGatewayVaultAzureArgs.builder()
.config(AiGatewayVaultAzureConfigArgs.builder()
.base64Decode(true)
.clientId("...my_client_id...")
.credentialsPrefix("AZURE")
.location("...my_location...")
.negTtl(0.0)
.resurrectTtl(100000000.0)
.tenantId("...my_tenant_id...")
.ttl(0.0)
.type("secrets")
.vaultUri("...my_vault_uri...")
.build())
.description("This vault is used to retrieve redis database access credentials")
.labels(Map.of("key", "value"))
.managedBy(Map.of("key", "value"))
.name("my-awesome-vault")
.build())
.conjur(AiGatewayVaultConjurArgs.builder()
.config(AiGatewayVaultConjurConfigArgs.builder()
.account("...my_account...")
.apiKey("...my_api_key...")
.base64Decode(false)
.endpointUrl("...my_endpoint_url...")
.login("...my_login...")
.negTtl(0.0)
.resurrectTtl(100000000.0)
.ttl(0.0)
.build())
.description("This vault is used to retrieve redis database access credentials")
.labels(Map.of("key", "value"))
.managedBy(Map.of("key", "value"))
.name("my-awesome-vault")
.build())
.env(AiGatewayVaultEnvArgs.builder()
.config(AiGatewayVaultEnvConfigArgs.builder()
.base64Decode(false)
.prefix("MY_SECRET_")
.build())
.description("This vault is used to retrieve redis database access credentials")
.labels(Map.of("key", "value"))
.managedBy(Map.of("key", "value"))
.name("my-awesome-vault")
.build())
.gatewayId("5f9fd312-a987-4628-b4c5-bb4f4fddd5f7")
.gcp(AiGatewayVaultGcpArgs.builder()
.config(AiGatewayVaultGcpConfigArgs.builder()
.base64Decode(true)
.negTtl(0.0)
.projectId("...my_project_id...")
.resurrectTtl(100000000.0)
.ttl(0.0)
.build())
.description("This vault is used to retrieve redis database access credentials")
.labels(Map.of("key", "value"))
.managedBy(Map.of("key", "value"))
.name("my-awesome-vault")
.build())
.hcv(AiGatewayVaultHcvArgs.builder()
.config(AiGatewayVaultHcvConfigArgs.builder()
.jwt(AiGatewayVaultHcvConfigJwtArgs.builder()
.audiences("...my_audiences...")
.base64Decode(true)
.clientId("...my_client_id...")
.clientSecret("...my_client_secret...")
.host("...my_host...")
.kv("v1")
.mount("secret")
.namespace("...my_namespace...")
.negTtl(0.0)
.port(5.0)
.protocol("https")
.resurrectTtl(100000000.0)
.role("demo")
.sslVerify(true)
.tokenEndpoint("...my_token_endpoint...")
.ttl(0.0)
.build())
.build())
.description("This vault is used to retrieve redis database access credentials")
.labels(Map.of("key", "value"))
.managedBy(Map.of("key", "value"))
.name("my-awesome-vault")
.build())
.konnect(AiGatewayVaultKonnectArgs.builder()
.config(AiGatewayVaultKonnectConfigArgs.builder()
.configStoreId("77426bee-2bca-4005-81af-284868fd3038")
.build())
.description("This vault is used to retrieve redis database access credentials")
.labels(Map.of("key", "value"))
.managedBy(Map.of("key", "value"))
.name("my-awesome-vault")
.build())
.build());
}
}
resources:
myAigatewayvault:
type: konnect:AiGatewayVault
name: my_aigatewayvault
properties:
aws:
config:
assumeRoleArn: '...my_assume_role_arn...'
base64Decode: true
endpointUrl: '...my_endpoint_url...'
negTtl: 0
region: us-east-1
resurrectTtl: 1e+08
roleSessionName: KongVault
stsEndpointUrl: '...my_sts_endpoint_url...'
ttl: 0
description: This vault is used to retrieve redis database access credentials
labels:
key: value
managedBy:
key: value
name: my-awesome-vault
azure:
config:
base64Decode: true
clientId: '...my_client_id...'
credentialsPrefix: AZURE
location: '...my_location...'
negTtl: 0
resurrectTtl: 1e+08
tenantId: '...my_tenant_id...'
ttl: 0
type: secrets
vaultUri: '...my_vault_uri...'
description: This vault is used to retrieve redis database access credentials
labels:
key: value
managedBy:
key: value
name: my-awesome-vault
conjur:
config:
account: '...my_account...'
apiKey: '...my_api_key...'
base64Decode: false
endpointUrl: '...my_endpoint_url...'
login: '...my_login...'
negTtl: 0
resurrectTtl: 1e+08
ttl: 0
description: This vault is used to retrieve redis database access credentials
labels:
key: value
managedBy:
key: value
name: my-awesome-vault
env:
config:
base64Decode: false
prefix: MY_SECRET_
description: This vault is used to retrieve redis database access credentials
labels:
key: value
managedBy:
key: value
name: my-awesome-vault
gatewayId: 5f9fd312-a987-4628-b4c5-bb4f4fddd5f7
gcp:
config:
base64Decode: true
negTtl: 0
projectId: '...my_project_id...'
resurrectTtl: 1e+08
ttl: 0
description: This vault is used to retrieve redis database access credentials
labels:
key: value
managedBy:
key: value
name: my-awesome-vault
hcv:
config:
jwt:
audiences: '...my_audiences...'
base64Decode: true
clientId: '...my_client_id...'
clientSecret: '...my_client_secret...'
host: '...my_host...'
kv: v1
mount: secret
namespace: '...my_namespace...'
negTtl: 0
port: 5
protocol: https
resurrectTtl: 1e+08
role: demo
sslVerify: true
tokenEndpoint: '...my_token_endpoint...'
ttl: 0
description: This vault is used to retrieve redis database access credentials
labels:
key: value
managedBy:
key: value
name: my-awesome-vault
konnect:
config:
configStoreId: 77426bee-2bca-4005-81af-284868fd3038
description: This vault is used to retrieve redis database access credentials
labels:
key: value
managedBy:
key: value
name: my-awesome-vault
Example coming soon!
Create AiGatewayVault Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new AiGatewayVault(name: string, args: AiGatewayVaultArgs, opts?: CustomResourceOptions);@overload
def AiGatewayVault(resource_name: str,
args: AiGatewayVaultArgs,
opts: Optional[ResourceOptions] = None)
@overload
def AiGatewayVault(resource_name: str,
opts: Optional[ResourceOptions] = None,
gateway_id: Optional[str] = None,
aws: Optional[AiGatewayVaultAwsArgs] = None,
azure: Optional[AiGatewayVaultAzureArgs] = None,
conjur: Optional[AiGatewayVaultConjurArgs] = None,
env: Optional[AiGatewayVaultEnvArgs] = None,
gcp: Optional[AiGatewayVaultGcpArgs] = None,
hcv: Optional[AiGatewayVaultHcvArgs] = None,
konnect: Optional[AiGatewayVaultKonnectArgs] = None)func NewAiGatewayVault(ctx *Context, name string, args AiGatewayVaultArgs, opts ...ResourceOption) (*AiGatewayVault, error)public AiGatewayVault(string name, AiGatewayVaultArgs args, CustomResourceOptions? opts = null)
public AiGatewayVault(String name, AiGatewayVaultArgs args)
public AiGatewayVault(String name, AiGatewayVaultArgs args, CustomResourceOptions options)
type: konnect:AiGatewayVault
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
resource "konnect_ai_gateway_vault" "name" {
# resource properties
}Parameters
- name string
- The unique name of the resource.
- args AiGatewayVaultArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args AiGatewayVaultArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args AiGatewayVaultArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args AiGatewayVaultArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args AiGatewayVaultArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var aiGatewayVaultResource = new Konnect.AiGatewayVault("aiGatewayVaultResource", new()
{
GatewayId = "string",
Aws = new Konnect.Inputs.AiGatewayVaultAwsArgs
{
Config = new Konnect.Inputs.AiGatewayVaultAwsConfigArgs
{
AssumeRoleArn = "string",
Base64Decode = false,
EndpointUrl = "string",
NegTtl = 0.0,
Region = "string",
ResurrectTtl = 0.0,
RoleSessionName = "string",
StsEndpointUrl = "string",
Ttl = 0.0,
},
CreatedAt = "string",
Description = "string",
Id = "string",
Labels =
{
{ "string", "string" },
},
ManagedBy =
{
{ "string", "string" },
},
Name = "string",
UpdatedAt = "string",
},
Azure = new Konnect.Inputs.AiGatewayVaultAzureArgs
{
Config = new Konnect.Inputs.AiGatewayVaultAzureConfigArgs
{
Base64Decode = false,
ClientId = "string",
CredentialsPrefix = "string",
Location = "string",
NegTtl = 0.0,
ResurrectTtl = 0.0,
TenantId = "string",
Ttl = 0.0,
Type = "string",
VaultUri = "string",
},
CreatedAt = "string",
Description = "string",
Id = "string",
Labels =
{
{ "string", "string" },
},
ManagedBy =
{
{ "string", "string" },
},
Name = "string",
UpdatedAt = "string",
},
Conjur = new Konnect.Inputs.AiGatewayVaultConjurArgs
{
Config = new Konnect.Inputs.AiGatewayVaultConjurConfigArgs
{
Account = "string",
ApiKey = "string",
Base64Decode = false,
EndpointUrl = "string",
Login = "string",
NegTtl = 0.0,
ResurrectTtl = 0.0,
Ttl = 0.0,
},
CreatedAt = "string",
Description = "string",
Id = "string",
Labels =
{
{ "string", "string" },
},
ManagedBy =
{
{ "string", "string" },
},
Name = "string",
UpdatedAt = "string",
},
Env = new Konnect.Inputs.AiGatewayVaultEnvArgs
{
Config = new Konnect.Inputs.AiGatewayVaultEnvConfigArgs
{
Base64Decode = false,
Prefix = "string",
},
CreatedAt = "string",
Description = "string",
Id = "string",
Labels =
{
{ "string", "string" },
},
ManagedBy =
{
{ "string", "string" },
},
Name = "string",
UpdatedAt = "string",
},
Gcp = new Konnect.Inputs.AiGatewayVaultGcpArgs
{
Config = new Konnect.Inputs.AiGatewayVaultGcpConfigArgs
{
Base64Decode = false,
NegTtl = 0.0,
ProjectId = "string",
ResurrectTtl = 0.0,
Ttl = 0.0,
},
CreatedAt = "string",
Description = "string",
Id = "string",
Labels =
{
{ "string", "string" },
},
ManagedBy =
{
{ "string", "string" },
},
Name = "string",
UpdatedAt = "string",
},
Hcv = new Konnect.Inputs.AiGatewayVaultHcvArgs
{
Config = new Konnect.Inputs.AiGatewayVaultHcvConfigArgs
{
Approle = new Konnect.Inputs.AiGatewayVaultHcvConfigApproleArgs
{
Base64Decode = false,
Host = "string",
Kv = "string",
Mount = "string",
Namespace = "string",
NegTtl = 0.0,
Path = "string",
Port = 0.0,
Protocol = "string",
ResponseWrapping = false,
ResurrectTtl = 0.0,
RoleId = "string",
SecretId = "string",
SecretIdFile = "string",
SslVerify = false,
Ttl = 0.0,
},
AwsEc2 = new Konnect.Inputs.AiGatewayVaultHcvConfigAwsEc2Args
{
Base64Decode = false,
Host = "string",
Kv = "string",
LoginPath = "string",
Mount = "string",
Namespace = "string",
NegTtl = 0.0,
Nonce = "string",
Port = 0.0,
Protocol = "string",
ResurrectTtl = 0.0,
Role = "string",
SslVerify = false,
Ttl = 0.0,
},
AwsIam = new Konnect.Inputs.AiGatewayVaultHcvConfigAwsIamArgs
{
AccessKeyId = "string",
AssumeRoleArn = "string",
Base64Decode = false,
Host = "string",
Kv = "string",
LoginPath = "string",
Mount = "string",
Namespace = "string",
NegTtl = 0.0,
Port = 0.0,
Protocol = "string",
Region = "string",
ResurrectTtl = 0.0,
Role = "string",
RoleSessionName = "string",
SecretAccessKey = "string",
SslVerify = false,
StsEndpointUrl = "string",
Ttl = 0.0,
},
Azure = new Konnect.Inputs.AiGatewayVaultHcvConfigAzureArgs
{
Base64Decode = false,
Host = "string",
Kv = "string",
LoginPath = "string",
Mount = "string",
Namespace = "string",
NegTtl = 0.0,
Port = 0.0,
Protocol = "string",
ResurrectTtl = 0.0,
Role = "string",
SslVerify = false,
Ttl = 0.0,
},
Cert = new Konnect.Inputs.AiGatewayVaultHcvConfigCertArgs
{
Base64Decode = false,
Cert = "string",
Host = "string",
Key = "string",
Kv = "string",
Mount = "string",
Namespace = "string",
NegTtl = 0.0,
Port = 0.0,
Protocol = "string",
ResurrectTtl = 0.0,
RoleName = "string",
SslVerify = false,
Ttl = 0.0,
},
GcpGce = new Konnect.Inputs.AiGatewayVaultHcvConfigGcpGceArgs
{
Base64Decode = false,
Host = "string",
Kv = "string",
LoginPath = "string",
Mount = "string",
Namespace = "string",
NegTtl = 0.0,
Port = 0.0,
Protocol = "string",
ResurrectTtl = 0.0,
Role = "string",
SslVerify = false,
Ttl = 0.0,
},
GcpIam = new Konnect.Inputs.AiGatewayVaultHcvConfigGcpIamArgs
{
Base64Decode = false,
Host = "string",
JwtExp = 0.0,
Kv = "string",
Mount = "string",
Namespace = "string",
NegTtl = 0.0,
Port = 0.0,
Protocol = "string",
ResurrectTtl = 0.0,
Role = "string",
ServiceAccount = "string",
SslVerify = false,
Ttl = 0.0,
},
Jwt = new Konnect.Inputs.AiGatewayVaultHcvConfigJwtArgs
{
Audiences = "string",
Base64Decode = false,
ClientId = "string",
ClientSecret = "string",
Host = "string",
Kv = "string",
Mount = "string",
Namespace = "string",
NegTtl = 0.0,
Port = 0.0,
Protocol = "string",
ResurrectTtl = 0.0,
Role = "string",
SslVerify = false,
TokenEndpoint = "string",
Ttl = 0.0,
},
Kubernetes = new Konnect.Inputs.AiGatewayVaultHcvConfigKubernetesArgs
{
ApiTokenFile = "string",
Base64Decode = false,
Host = "string",
Kv = "string",
Mount = "string",
Namespace = "string",
NegTtl = 0.0,
Path = "string",
Port = 0.0,
Protocol = "string",
ResurrectTtl = 0.0,
Role = "string",
SslVerify = false,
Ttl = 0.0,
},
Token = new Konnect.Inputs.AiGatewayVaultHcvConfigTokenArgs
{
Base64Decode = false,
Host = "string",
Kv = "string",
Mount = "string",
Namespace = "string",
NegTtl = 0.0,
Port = 0.0,
Protocol = "string",
ResurrectTtl = 0.0,
SslVerify = false,
Token = "string",
Ttl = 0.0,
},
},
CreatedAt = "string",
Description = "string",
Id = "string",
Labels =
{
{ "string", "string" },
},
ManagedBy =
{
{ "string", "string" },
},
Name = "string",
UpdatedAt = "string",
},
Konnect = new Konnect.Inputs.AiGatewayVaultKonnectArgs
{
Config = new Konnect.Inputs.AiGatewayVaultKonnectConfigArgs
{
ConfigStoreId = "string",
},
CreatedAt = "string",
Description = "string",
Id = "string",
Labels =
{
{ "string", "string" },
},
ManagedBy =
{
{ "string", "string" },
},
Name = "string",
UpdatedAt = "string",
},
});
example, err := konnect.NewAiGatewayVault(ctx, "aiGatewayVaultResource", &konnect.AiGatewayVaultArgs{
GatewayId: pulumi.String("string"),
Aws: &konnect.AiGatewayVaultAwsArgs{
Config: &konnect.AiGatewayVaultAwsConfigArgs{
AssumeRoleArn: pulumi.String("string"),
Base64Decode: pulumi.Bool(false),
EndpointUrl: pulumi.String("string"),
NegTtl: pulumi.Float64(0),
Region: pulumi.String("string"),
ResurrectTtl: pulumi.Float64(0),
RoleSessionName: pulumi.String("string"),
StsEndpointUrl: pulumi.String("string"),
Ttl: pulumi.Float64(0),
},
CreatedAt: pulumi.String("string"),
Description: pulumi.String("string"),
Id: pulumi.String("string"),
Labels: pulumi.StringMap{
"string": pulumi.String("string"),
},
ManagedBy: pulumi.StringMap{
"string": pulumi.String("string"),
},
Name: pulumi.String("string"),
UpdatedAt: pulumi.String("string"),
},
Azure: &konnect.AiGatewayVaultAzureArgs{
Config: &konnect.AiGatewayVaultAzureConfigArgs{
Base64Decode: pulumi.Bool(false),
ClientId: pulumi.String("string"),
CredentialsPrefix: pulumi.String("string"),
Location: pulumi.String("string"),
NegTtl: pulumi.Float64(0),
ResurrectTtl: pulumi.Float64(0),
TenantId: pulumi.String("string"),
Ttl: pulumi.Float64(0),
Type: pulumi.String("string"),
VaultUri: pulumi.String("string"),
},
CreatedAt: pulumi.String("string"),
Description: pulumi.String("string"),
Id: pulumi.String("string"),
Labels: pulumi.StringMap{
"string": pulumi.String("string"),
},
ManagedBy: pulumi.StringMap{
"string": pulumi.String("string"),
},
Name: pulumi.String("string"),
UpdatedAt: pulumi.String("string"),
},
Conjur: &konnect.AiGatewayVaultConjurArgs{
Config: &konnect.AiGatewayVaultConjurConfigArgs{
Account: pulumi.String("string"),
ApiKey: pulumi.String("string"),
Base64Decode: pulumi.Bool(false),
EndpointUrl: pulumi.String("string"),
Login: pulumi.String("string"),
NegTtl: pulumi.Float64(0),
ResurrectTtl: pulumi.Float64(0),
Ttl: pulumi.Float64(0),
},
CreatedAt: pulumi.String("string"),
Description: pulumi.String("string"),
Id: pulumi.String("string"),
Labels: pulumi.StringMap{
"string": pulumi.String("string"),
},
ManagedBy: pulumi.StringMap{
"string": pulumi.String("string"),
},
Name: pulumi.String("string"),
UpdatedAt: pulumi.String("string"),
},
Env: &konnect.AiGatewayVaultEnvArgs{
Config: &konnect.AiGatewayVaultEnvConfigArgs{
Base64Decode: pulumi.Bool(false),
Prefix: pulumi.String("string"),
},
CreatedAt: pulumi.String("string"),
Description: pulumi.String("string"),
Id: pulumi.String("string"),
Labels: pulumi.StringMap{
"string": pulumi.String("string"),
},
ManagedBy: pulumi.StringMap{
"string": pulumi.String("string"),
},
Name: pulumi.String("string"),
UpdatedAt: pulumi.String("string"),
},
Gcp: &konnect.AiGatewayVaultGcpArgs{
Config: &konnect.AiGatewayVaultGcpConfigArgs{
Base64Decode: pulumi.Bool(false),
NegTtl: pulumi.Float64(0),
ProjectId: pulumi.String("string"),
ResurrectTtl: pulumi.Float64(0),
Ttl: pulumi.Float64(0),
},
CreatedAt: pulumi.String("string"),
Description: pulumi.String("string"),
Id: pulumi.String("string"),
Labels: pulumi.StringMap{
"string": pulumi.String("string"),
},
ManagedBy: pulumi.StringMap{
"string": pulumi.String("string"),
},
Name: pulumi.String("string"),
UpdatedAt: pulumi.String("string"),
},
Hcv: &konnect.AiGatewayVaultHcvArgs{
Config: &konnect.AiGatewayVaultHcvConfigArgs{
Approle: &konnect.AiGatewayVaultHcvConfigApproleArgs{
Base64Decode: pulumi.Bool(false),
Host: pulumi.String("string"),
Kv: pulumi.String("string"),
Mount: pulumi.String("string"),
Namespace: pulumi.String("string"),
NegTtl: pulumi.Float64(0),
Path: pulumi.String("string"),
Port: pulumi.Float64(0),
Protocol: pulumi.String("string"),
ResponseWrapping: pulumi.Bool(false),
ResurrectTtl: pulumi.Float64(0),
RoleId: pulumi.String("string"),
SecretId: pulumi.String("string"),
SecretIdFile: pulumi.String("string"),
SslVerify: pulumi.Bool(false),
Ttl: pulumi.Float64(0),
},
AwsEc2: &konnect.AiGatewayVaultHcvConfigAwsEc2Args{
Base64Decode: pulumi.Bool(false),
Host: pulumi.String("string"),
Kv: pulumi.String("string"),
LoginPath: pulumi.String("string"),
Mount: pulumi.String("string"),
Namespace: pulumi.String("string"),
NegTtl: pulumi.Float64(0),
Nonce: pulumi.String("string"),
Port: pulumi.Float64(0),
Protocol: pulumi.String("string"),
ResurrectTtl: pulumi.Float64(0),
Role: pulumi.String("string"),
SslVerify: pulumi.Bool(false),
Ttl: pulumi.Float64(0),
},
AwsIam: &konnect.AiGatewayVaultHcvConfigAwsIamArgs{
AccessKeyId: pulumi.String("string"),
AssumeRoleArn: pulumi.String("string"),
Base64Decode: pulumi.Bool(false),
Host: pulumi.String("string"),
Kv: pulumi.String("string"),
LoginPath: pulumi.String("string"),
Mount: pulumi.String("string"),
Namespace: pulumi.String("string"),
NegTtl: pulumi.Float64(0),
Port: pulumi.Float64(0),
Protocol: pulumi.String("string"),
Region: pulumi.String("string"),
ResurrectTtl: pulumi.Float64(0),
Role: pulumi.String("string"),
RoleSessionName: pulumi.String("string"),
SecretAccessKey: pulumi.String("string"),
SslVerify: pulumi.Bool(false),
StsEndpointUrl: pulumi.String("string"),
Ttl: pulumi.Float64(0),
},
Azure: &konnect.AiGatewayVaultHcvConfigAzureArgs{
Base64Decode: pulumi.Bool(false),
Host: pulumi.String("string"),
Kv: pulumi.String("string"),
LoginPath: pulumi.String("string"),
Mount: pulumi.String("string"),
Namespace: pulumi.String("string"),
NegTtl: pulumi.Float64(0),
Port: pulumi.Float64(0),
Protocol: pulumi.String("string"),
ResurrectTtl: pulumi.Float64(0),
Role: pulumi.String("string"),
SslVerify: pulumi.Bool(false),
Ttl: pulumi.Float64(0),
},
Cert: &konnect.AiGatewayVaultHcvConfigCertArgs{
Base64Decode: pulumi.Bool(false),
Cert: pulumi.String("string"),
Host: pulumi.String("string"),
Key: pulumi.String("string"),
Kv: pulumi.String("string"),
Mount: pulumi.String("string"),
Namespace: pulumi.String("string"),
NegTtl: pulumi.Float64(0),
Port: pulumi.Float64(0),
Protocol: pulumi.String("string"),
ResurrectTtl: pulumi.Float64(0),
RoleName: pulumi.String("string"),
SslVerify: pulumi.Bool(false),
Ttl: pulumi.Float64(0),
},
GcpGce: &konnect.AiGatewayVaultHcvConfigGcpGceArgs{
Base64Decode: pulumi.Bool(false),
Host: pulumi.String("string"),
Kv: pulumi.String("string"),
LoginPath: pulumi.String("string"),
Mount: pulumi.String("string"),
Namespace: pulumi.String("string"),
NegTtl: pulumi.Float64(0),
Port: pulumi.Float64(0),
Protocol: pulumi.String("string"),
ResurrectTtl: pulumi.Float64(0),
Role: pulumi.String("string"),
SslVerify: pulumi.Bool(false),
Ttl: pulumi.Float64(0),
},
GcpIam: &konnect.AiGatewayVaultHcvConfigGcpIamArgs{
Base64Decode: pulumi.Bool(false),
Host: pulumi.String("string"),
JwtExp: pulumi.Float64(0),
Kv: pulumi.String("string"),
Mount: pulumi.String("string"),
Namespace: pulumi.String("string"),
NegTtl: pulumi.Float64(0),
Port: pulumi.Float64(0),
Protocol: pulumi.String("string"),
ResurrectTtl: pulumi.Float64(0),
Role: pulumi.String("string"),
ServiceAccount: pulumi.String("string"),
SslVerify: pulumi.Bool(false),
Ttl: pulumi.Float64(0),
},
Jwt: &konnect.AiGatewayVaultHcvConfigJwtArgs{
Audiences: pulumi.String("string"),
Base64Decode: pulumi.Bool(false),
ClientId: pulumi.String("string"),
ClientSecret: pulumi.String("string"),
Host: pulumi.String("string"),
Kv: pulumi.String("string"),
Mount: pulumi.String("string"),
Namespace: pulumi.String("string"),
NegTtl: pulumi.Float64(0),
Port: pulumi.Float64(0),
Protocol: pulumi.String("string"),
ResurrectTtl: pulumi.Float64(0),
Role: pulumi.String("string"),
SslVerify: pulumi.Bool(false),
TokenEndpoint: pulumi.String("string"),
Ttl: pulumi.Float64(0),
},
Kubernetes: &konnect.AiGatewayVaultHcvConfigKubernetesArgs{
ApiTokenFile: pulumi.String("string"),
Base64Decode: pulumi.Bool(false),
Host: pulumi.String("string"),
Kv: pulumi.String("string"),
Mount: pulumi.String("string"),
Namespace: pulumi.String("string"),
NegTtl: pulumi.Float64(0),
Path: pulumi.String("string"),
Port: pulumi.Float64(0),
Protocol: pulumi.String("string"),
ResurrectTtl: pulumi.Float64(0),
Role: pulumi.String("string"),
SslVerify: pulumi.Bool(false),
Ttl: pulumi.Float64(0),
},
Token: &konnect.AiGatewayVaultHcvConfigTokenArgs{
Base64Decode: pulumi.Bool(false),
Host: pulumi.String("string"),
Kv: pulumi.String("string"),
Mount: pulumi.String("string"),
Namespace: pulumi.String("string"),
NegTtl: pulumi.Float64(0),
Port: pulumi.Float64(0),
Protocol: pulumi.String("string"),
ResurrectTtl: pulumi.Float64(0),
SslVerify: pulumi.Bool(false),
Token: pulumi.String("string"),
Ttl: pulumi.Float64(0),
},
},
CreatedAt: pulumi.String("string"),
Description: pulumi.String("string"),
Id: pulumi.String("string"),
Labels: pulumi.StringMap{
"string": pulumi.String("string"),
},
ManagedBy: pulumi.StringMap{
"string": pulumi.String("string"),
},
Name: pulumi.String("string"),
UpdatedAt: pulumi.String("string"),
},
Konnect: &konnect.AiGatewayVaultKonnectArgs{
Config: &konnect.AiGatewayVaultKonnectConfigArgs{
ConfigStoreId: pulumi.String("string"),
},
CreatedAt: pulumi.String("string"),
Description: pulumi.String("string"),
Id: pulumi.String("string"),
Labels: pulumi.StringMap{
"string": pulumi.String("string"),
},
ManagedBy: pulumi.StringMap{
"string": pulumi.String("string"),
},
Name: pulumi.String("string"),
UpdatedAt: pulumi.String("string"),
},
})
resource "konnect_ai_gateway_vault" "aiGatewayVaultResource" {
lifecycle {
create_before_destroy = true
}
gateway_id = "string"
aws = {
config = {
assume_role_arn = "string"
base64_decode = false
endpoint_url = "string"
neg_ttl = 0
region = "string"
resurrect_ttl = 0
role_session_name = "string"
sts_endpoint_url = "string"
ttl = 0
}
created_at = "string"
description = "string"
id = "string"
labels = {
"string" = "string"
}
managed_by = {
"string" = "string"
}
name = "string"
updated_at = "string"
}
azure = {
config = {
base64_decode = false
client_id = "string"
credentials_prefix = "string"
location = "string"
neg_ttl = 0
resurrect_ttl = 0
tenant_id = "string"
ttl = 0
type = "string"
vault_uri = "string"
}
created_at = "string"
description = "string"
id = "string"
labels = {
"string" = "string"
}
managed_by = {
"string" = "string"
}
name = "string"
updated_at = "string"
}
conjur = {
config = {
account = "string"
api_key = "string"
base64_decode = false
endpoint_url = "string"
login = "string"
neg_ttl = 0
resurrect_ttl = 0
ttl = 0
}
created_at = "string"
description = "string"
id = "string"
labels = {
"string" = "string"
}
managed_by = {
"string" = "string"
}
name = "string"
updated_at = "string"
}
env = {
config = {
base64_decode = false
prefix = "string"
}
created_at = "string"
description = "string"
id = "string"
labels = {
"string" = "string"
}
managed_by = {
"string" = "string"
}
name = "string"
updated_at = "string"
}
gcp = {
config = {
base64_decode = false
neg_ttl = 0
project_id = "string"
resurrect_ttl = 0
ttl = 0
}
created_at = "string"
description = "string"
id = "string"
labels = {
"string" = "string"
}
managed_by = {
"string" = "string"
}
name = "string"
updated_at = "string"
}
hcv = {
config = {
approle = {
base64_decode = false
host = "string"
kv = "string"
mount = "string"
namespace = "string"
neg_ttl = 0
path = "string"
port = 0
protocol = "string"
response_wrapping = false
resurrect_ttl = 0
role_id = "string"
secret_id = "string"
secret_id_file = "string"
ssl_verify = false
ttl = 0
}
aws_ec2 = {
base64_decode = false
host = "string"
kv = "string"
login_path = "string"
mount = "string"
namespace = "string"
neg_ttl = 0
nonce = "string"
port = 0
protocol = "string"
resurrect_ttl = 0
role = "string"
ssl_verify = false
ttl = 0
}
aws_iam = {
access_key_id = "string"
assume_role_arn = "string"
base64_decode = false
host = "string"
kv = "string"
login_path = "string"
mount = "string"
namespace = "string"
neg_ttl = 0
port = 0
protocol = "string"
region = "string"
resurrect_ttl = 0
role = "string"
role_session_name = "string"
secret_access_key = "string"
ssl_verify = false
sts_endpoint_url = "string"
ttl = 0
}
azure = {
base64_decode = false
host = "string"
kv = "string"
login_path = "string"
mount = "string"
namespace = "string"
neg_ttl = 0
port = 0
protocol = "string"
resurrect_ttl = 0
role = "string"
ssl_verify = false
ttl = 0
}
cert = {
base64_decode = false
cert = "string"
host = "string"
key = "string"
kv = "string"
mount = "string"
namespace = "string"
neg_ttl = 0
port = 0
protocol = "string"
resurrect_ttl = 0
role_name = "string"
ssl_verify = false
ttl = 0
}
gcp_gce = {
base64_decode = false
host = "string"
kv = "string"
login_path = "string"
mount = "string"
namespace = "string"
neg_ttl = 0
port = 0
protocol = "string"
resurrect_ttl = 0
role = "string"
ssl_verify = false
ttl = 0
}
gcp_iam = {
base64_decode = false
host = "string"
jwt_exp = 0
kv = "string"
mount = "string"
namespace = "string"
neg_ttl = 0
port = 0
protocol = "string"
resurrect_ttl = 0
role = "string"
service_account = "string"
ssl_verify = false
ttl = 0
}
jwt = {
audiences = "string"
base64_decode = false
client_id = "string"
client_secret = "string"
host = "string"
kv = "string"
mount = "string"
namespace = "string"
neg_ttl = 0
port = 0
protocol = "string"
resurrect_ttl = 0
role = "string"
ssl_verify = false
token_endpoint = "string"
ttl = 0
}
kubernetes = {
api_token_file = "string"
base64_decode = false
host = "string"
kv = "string"
mount = "string"
namespace = "string"
neg_ttl = 0
path = "string"
port = 0
protocol = "string"
resurrect_ttl = 0
role = "string"
ssl_verify = false
ttl = 0
}
token = {
base64_decode = false
host = "string"
kv = "string"
mount = "string"
namespace = "string"
neg_ttl = 0
port = 0
protocol = "string"
resurrect_ttl = 0
ssl_verify = false
token = "string"
ttl = 0
}
}
created_at = "string"
description = "string"
id = "string"
labels = {
"string" = "string"
}
managed_by = {
"string" = "string"
}
name = "string"
updated_at = "string"
}
konnect = {
config = {
config_store_id = "string"
}
created_at = "string"
description = "string"
id = "string"
labels = {
"string" = "string"
}
managed_by = {
"string" = "string"
}
name = "string"
updated_at = "string"
}
}
var aiGatewayVaultResource = new AiGatewayVault("aiGatewayVaultResource", AiGatewayVaultArgs.builder()
.gatewayId("string")
.aws(AiGatewayVaultAwsArgs.builder()
.config(AiGatewayVaultAwsConfigArgs.builder()
.assumeRoleArn("string")
.base64Decode(false)
.endpointUrl("string")
.negTtl(0.0)
.region("string")
.resurrectTtl(0.0)
.roleSessionName("string")
.stsEndpointUrl("string")
.ttl(0.0)
.build())
.createdAt("string")
.description("string")
.id("string")
.labels(Map.of("string", "string"))
.managedBy(Map.of("string", "string"))
.name("string")
.updatedAt("string")
.build())
.azure(AiGatewayVaultAzureArgs.builder()
.config(AiGatewayVaultAzureConfigArgs.builder()
.base64Decode(false)
.clientId("string")
.credentialsPrefix("string")
.location("string")
.negTtl(0.0)
.resurrectTtl(0.0)
.tenantId("string")
.ttl(0.0)
.type("string")
.vaultUri("string")
.build())
.createdAt("string")
.description("string")
.id("string")
.labels(Map.of("string", "string"))
.managedBy(Map.of("string", "string"))
.name("string")
.updatedAt("string")
.build())
.conjur(AiGatewayVaultConjurArgs.builder()
.config(AiGatewayVaultConjurConfigArgs.builder()
.account("string")
.apiKey("string")
.base64Decode(false)
.endpointUrl("string")
.login("string")
.negTtl(0.0)
.resurrectTtl(0.0)
.ttl(0.0)
.build())
.createdAt("string")
.description("string")
.id("string")
.labels(Map.of("string", "string"))
.managedBy(Map.of("string", "string"))
.name("string")
.updatedAt("string")
.build())
.env(AiGatewayVaultEnvArgs.builder()
.config(AiGatewayVaultEnvConfigArgs.builder()
.base64Decode(false)
.prefix("string")
.build())
.createdAt("string")
.description("string")
.id("string")
.labels(Map.of("string", "string"))
.managedBy(Map.of("string", "string"))
.name("string")
.updatedAt("string")
.build())
.gcp(AiGatewayVaultGcpArgs.builder()
.config(AiGatewayVaultGcpConfigArgs.builder()
.base64Decode(false)
.negTtl(0.0)
.projectId("string")
.resurrectTtl(0.0)
.ttl(0.0)
.build())
.createdAt("string")
.description("string")
.id("string")
.labels(Map.of("string", "string"))
.managedBy(Map.of("string", "string"))
.name("string")
.updatedAt("string")
.build())
.hcv(AiGatewayVaultHcvArgs.builder()
.config(AiGatewayVaultHcvConfigArgs.builder()
.approle(AiGatewayVaultHcvConfigApproleArgs.builder()
.base64Decode(false)
.host("string")
.kv("string")
.mount("string")
.namespace("string")
.negTtl(0.0)
.path("string")
.port(0.0)
.protocol("string")
.responseWrapping(false)
.resurrectTtl(0.0)
.roleId("string")
.secretId("string")
.secretIdFile("string")
.sslVerify(false)
.ttl(0.0)
.build())
.awsEc2(AiGatewayVaultHcvConfigAwsEc2Args.builder()
.base64Decode(false)
.host("string")
.kv("string")
.loginPath("string")
.mount("string")
.namespace("string")
.negTtl(0.0)
.nonce("string")
.port(0.0)
.protocol("string")
.resurrectTtl(0.0)
.role("string")
.sslVerify(false)
.ttl(0.0)
.build())
.awsIam(AiGatewayVaultHcvConfigAwsIamArgs.builder()
.accessKeyId("string")
.assumeRoleArn("string")
.base64Decode(false)
.host("string")
.kv("string")
.loginPath("string")
.mount("string")
.namespace("string")
.negTtl(0.0)
.port(0.0)
.protocol("string")
.region("string")
.resurrectTtl(0.0)
.role("string")
.roleSessionName("string")
.secretAccessKey("string")
.sslVerify(false)
.stsEndpointUrl("string")
.ttl(0.0)
.build())
.azure(AiGatewayVaultHcvConfigAzureArgs.builder()
.base64Decode(false)
.host("string")
.kv("string")
.loginPath("string")
.mount("string")
.namespace("string")
.negTtl(0.0)
.port(0.0)
.protocol("string")
.resurrectTtl(0.0)
.role("string")
.sslVerify(false)
.ttl(0.0)
.build())
.cert(AiGatewayVaultHcvConfigCertArgs.builder()
.base64Decode(false)
.cert("string")
.host("string")
.key("string")
.kv("string")
.mount("string")
.namespace("string")
.negTtl(0.0)
.port(0.0)
.protocol("string")
.resurrectTtl(0.0)
.roleName("string")
.sslVerify(false)
.ttl(0.0)
.build())
.gcpGce(AiGatewayVaultHcvConfigGcpGceArgs.builder()
.base64Decode(false)
.host("string")
.kv("string")
.loginPath("string")
.mount("string")
.namespace("string")
.negTtl(0.0)
.port(0.0)
.protocol("string")
.resurrectTtl(0.0)
.role("string")
.sslVerify(false)
.ttl(0.0)
.build())
.gcpIam(AiGatewayVaultHcvConfigGcpIamArgs.builder()
.base64Decode(false)
.host("string")
.jwtExp(0.0)
.kv("string")
.mount("string")
.namespace("string")
.negTtl(0.0)
.port(0.0)
.protocol("string")
.resurrectTtl(0.0)
.role("string")
.serviceAccount("string")
.sslVerify(false)
.ttl(0.0)
.build())
.jwt(AiGatewayVaultHcvConfigJwtArgs.builder()
.audiences("string")
.base64Decode(false)
.clientId("string")
.clientSecret("string")
.host("string")
.kv("string")
.mount("string")
.namespace("string")
.negTtl(0.0)
.port(0.0)
.protocol("string")
.resurrectTtl(0.0)
.role("string")
.sslVerify(false)
.tokenEndpoint("string")
.ttl(0.0)
.build())
.kubernetes(AiGatewayVaultHcvConfigKubernetesArgs.builder()
.apiTokenFile("string")
.base64Decode(false)
.host("string")
.kv("string")
.mount("string")
.namespace("string")
.negTtl(0.0)
.path("string")
.port(0.0)
.protocol("string")
.resurrectTtl(0.0)
.role("string")
.sslVerify(false)
.ttl(0.0)
.build())
.token(AiGatewayVaultHcvConfigTokenArgs.builder()
.base64Decode(false)
.host("string")
.kv("string")
.mount("string")
.namespace("string")
.negTtl(0.0)
.port(0.0)
.protocol("string")
.resurrectTtl(0.0)
.sslVerify(false)
.token("string")
.ttl(0.0)
.build())
.build())
.createdAt("string")
.description("string")
.id("string")
.labels(Map.of("string", "string"))
.managedBy(Map.of("string", "string"))
.name("string")
.updatedAt("string")
.build())
.konnect(AiGatewayVaultKonnectArgs.builder()
.config(AiGatewayVaultKonnectConfigArgs.builder()
.configStoreId("string")
.build())
.createdAt("string")
.description("string")
.id("string")
.labels(Map.of("string", "string"))
.managedBy(Map.of("string", "string"))
.name("string")
.updatedAt("string")
.build())
.build());
ai_gateway_vault_resource = konnect.AiGatewayVault("aiGatewayVaultResource",
gateway_id="string",
aws={
"config": {
"assume_role_arn": "string",
"base64_decode": False,
"endpoint_url": "string",
"neg_ttl": float(0),
"region": "string",
"resurrect_ttl": float(0),
"role_session_name": "string",
"sts_endpoint_url": "string",
"ttl": float(0),
},
"created_at": "string",
"description": "string",
"id": "string",
"labels": {
"string": "string",
},
"managed_by": {
"string": "string",
},
"name": "string",
"updated_at": "string",
},
azure={
"config": {
"base64_decode": False,
"client_id": "string",
"credentials_prefix": "string",
"location": "string",
"neg_ttl": float(0),
"resurrect_ttl": float(0),
"tenant_id": "string",
"ttl": float(0),
"type": "string",
"vault_uri": "string",
},
"created_at": "string",
"description": "string",
"id": "string",
"labels": {
"string": "string",
},
"managed_by": {
"string": "string",
},
"name": "string",
"updated_at": "string",
},
conjur={
"config": {
"account": "string",
"api_key": "string",
"base64_decode": False,
"endpoint_url": "string",
"login": "string",
"neg_ttl": float(0),
"resurrect_ttl": float(0),
"ttl": float(0),
},
"created_at": "string",
"description": "string",
"id": "string",
"labels": {
"string": "string",
},
"managed_by": {
"string": "string",
},
"name": "string",
"updated_at": "string",
},
env={
"config": {
"base64_decode": False,
"prefix": "string",
},
"created_at": "string",
"description": "string",
"id": "string",
"labels": {
"string": "string",
},
"managed_by": {
"string": "string",
},
"name": "string",
"updated_at": "string",
},
gcp={
"config": {
"base64_decode": False,
"neg_ttl": float(0),
"project_id": "string",
"resurrect_ttl": float(0),
"ttl": float(0),
},
"created_at": "string",
"description": "string",
"id": "string",
"labels": {
"string": "string",
},
"managed_by": {
"string": "string",
},
"name": "string",
"updated_at": "string",
},
hcv={
"config": {
"approle": {
"base64_decode": False,
"host": "string",
"kv": "string",
"mount": "string",
"namespace": "string",
"neg_ttl": float(0),
"path": "string",
"port": float(0),
"protocol": "string",
"response_wrapping": False,
"resurrect_ttl": float(0),
"role_id": "string",
"secret_id": "string",
"secret_id_file": "string",
"ssl_verify": False,
"ttl": float(0),
},
"aws_ec2": {
"base64_decode": False,
"host": "string",
"kv": "string",
"login_path": "string",
"mount": "string",
"namespace": "string",
"neg_ttl": float(0),
"nonce": "string",
"port": float(0),
"protocol": "string",
"resurrect_ttl": float(0),
"role": "string",
"ssl_verify": False,
"ttl": float(0),
},
"aws_iam": {
"access_key_id": "string",
"assume_role_arn": "string",
"base64_decode": False,
"host": "string",
"kv": "string",
"login_path": "string",
"mount": "string",
"namespace": "string",
"neg_ttl": float(0),
"port": float(0),
"protocol": "string",
"region": "string",
"resurrect_ttl": float(0),
"role": "string",
"role_session_name": "string",
"secret_access_key": "string",
"ssl_verify": False,
"sts_endpoint_url": "string",
"ttl": float(0),
},
"azure": {
"base64_decode": False,
"host": "string",
"kv": "string",
"login_path": "string",
"mount": "string",
"namespace": "string",
"neg_ttl": float(0),
"port": float(0),
"protocol": "string",
"resurrect_ttl": float(0),
"role": "string",
"ssl_verify": False,
"ttl": float(0),
},
"cert": {
"base64_decode": False,
"cert": "string",
"host": "string",
"key": "string",
"kv": "string",
"mount": "string",
"namespace": "string",
"neg_ttl": float(0),
"port": float(0),
"protocol": "string",
"resurrect_ttl": float(0),
"role_name": "string",
"ssl_verify": False,
"ttl": float(0),
},
"gcp_gce": {
"base64_decode": False,
"host": "string",
"kv": "string",
"login_path": "string",
"mount": "string",
"namespace": "string",
"neg_ttl": float(0),
"port": float(0),
"protocol": "string",
"resurrect_ttl": float(0),
"role": "string",
"ssl_verify": False,
"ttl": float(0),
},
"gcp_iam": {
"base64_decode": False,
"host": "string",
"jwt_exp": float(0),
"kv": "string",
"mount": "string",
"namespace": "string",
"neg_ttl": float(0),
"port": float(0),
"protocol": "string",
"resurrect_ttl": float(0),
"role": "string",
"service_account": "string",
"ssl_verify": False,
"ttl": float(0),
},
"jwt": {
"audiences": "string",
"base64_decode": False,
"client_id": "string",
"client_secret": "string",
"host": "string",
"kv": "string",
"mount": "string",
"namespace": "string",
"neg_ttl": float(0),
"port": float(0),
"protocol": "string",
"resurrect_ttl": float(0),
"role": "string",
"ssl_verify": False,
"token_endpoint": "string",
"ttl": float(0),
},
"kubernetes": {
"api_token_file": "string",
"base64_decode": False,
"host": "string",
"kv": "string",
"mount": "string",
"namespace": "string",
"neg_ttl": float(0),
"path": "string",
"port": float(0),
"protocol": "string",
"resurrect_ttl": float(0),
"role": "string",
"ssl_verify": False,
"ttl": float(0),
},
"token": {
"base64_decode": False,
"host": "string",
"kv": "string",
"mount": "string",
"namespace": "string",
"neg_ttl": float(0),
"port": float(0),
"protocol": "string",
"resurrect_ttl": float(0),
"ssl_verify": False,
"token": "string",
"ttl": float(0),
},
},
"created_at": "string",
"description": "string",
"id": "string",
"labels": {
"string": "string",
},
"managed_by": {
"string": "string",
},
"name": "string",
"updated_at": "string",
},
konnect={
"config": {
"config_store_id": "string",
},
"created_at": "string",
"description": "string",
"id": "string",
"labels": {
"string": "string",
},
"managed_by": {
"string": "string",
},
"name": "string",
"updated_at": "string",
})
const aiGatewayVaultResource = new konnect.AiGatewayVault("aiGatewayVaultResource", {
gatewayId: "string",
aws: {
config: {
assumeRoleArn: "string",
base64Decode: false,
endpointUrl: "string",
negTtl: 0,
region: "string",
resurrectTtl: 0,
roleSessionName: "string",
stsEndpointUrl: "string",
ttl: 0,
},
createdAt: "string",
description: "string",
id: "string",
labels: {
string: "string",
},
managedBy: {
string: "string",
},
name: "string",
updatedAt: "string",
},
azure: {
config: {
base64Decode: false,
clientId: "string",
credentialsPrefix: "string",
location: "string",
negTtl: 0,
resurrectTtl: 0,
tenantId: "string",
ttl: 0,
type: "string",
vaultUri: "string",
},
createdAt: "string",
description: "string",
id: "string",
labels: {
string: "string",
},
managedBy: {
string: "string",
},
name: "string",
updatedAt: "string",
},
conjur: {
config: {
account: "string",
apiKey: "string",
base64Decode: false,
endpointUrl: "string",
login: "string",
negTtl: 0,
resurrectTtl: 0,
ttl: 0,
},
createdAt: "string",
description: "string",
id: "string",
labels: {
string: "string",
},
managedBy: {
string: "string",
},
name: "string",
updatedAt: "string",
},
env: {
config: {
base64Decode: false,
prefix: "string",
},
createdAt: "string",
description: "string",
id: "string",
labels: {
string: "string",
},
managedBy: {
string: "string",
},
name: "string",
updatedAt: "string",
},
gcp: {
config: {
base64Decode: false,
negTtl: 0,
projectId: "string",
resurrectTtl: 0,
ttl: 0,
},
createdAt: "string",
description: "string",
id: "string",
labels: {
string: "string",
},
managedBy: {
string: "string",
},
name: "string",
updatedAt: "string",
},
hcv: {
config: {
approle: {
base64Decode: false,
host: "string",
kv: "string",
mount: "string",
namespace: "string",
negTtl: 0,
path: "string",
port: 0,
protocol: "string",
responseWrapping: false,
resurrectTtl: 0,
roleId: "string",
secretId: "string",
secretIdFile: "string",
sslVerify: false,
ttl: 0,
},
awsEc2: {
base64Decode: false,
host: "string",
kv: "string",
loginPath: "string",
mount: "string",
namespace: "string",
negTtl: 0,
nonce: "string",
port: 0,
protocol: "string",
resurrectTtl: 0,
role: "string",
sslVerify: false,
ttl: 0,
},
awsIam: {
accessKeyId: "string",
assumeRoleArn: "string",
base64Decode: false,
host: "string",
kv: "string",
loginPath: "string",
mount: "string",
namespace: "string",
negTtl: 0,
port: 0,
protocol: "string",
region: "string",
resurrectTtl: 0,
role: "string",
roleSessionName: "string",
secretAccessKey: "string",
sslVerify: false,
stsEndpointUrl: "string",
ttl: 0,
},
azure: {
base64Decode: false,
host: "string",
kv: "string",
loginPath: "string",
mount: "string",
namespace: "string",
negTtl: 0,
port: 0,
protocol: "string",
resurrectTtl: 0,
role: "string",
sslVerify: false,
ttl: 0,
},
cert: {
base64Decode: false,
cert: "string",
host: "string",
key: "string",
kv: "string",
mount: "string",
namespace: "string",
negTtl: 0,
port: 0,
protocol: "string",
resurrectTtl: 0,
roleName: "string",
sslVerify: false,
ttl: 0,
},
gcpGce: {
base64Decode: false,
host: "string",
kv: "string",
loginPath: "string",
mount: "string",
namespace: "string",
negTtl: 0,
port: 0,
protocol: "string",
resurrectTtl: 0,
role: "string",
sslVerify: false,
ttl: 0,
},
gcpIam: {
base64Decode: false,
host: "string",
jwtExp: 0,
kv: "string",
mount: "string",
namespace: "string",
negTtl: 0,
port: 0,
protocol: "string",
resurrectTtl: 0,
role: "string",
serviceAccount: "string",
sslVerify: false,
ttl: 0,
},
jwt: {
audiences: "string",
base64Decode: false,
clientId: "string",
clientSecret: "string",
host: "string",
kv: "string",
mount: "string",
namespace: "string",
negTtl: 0,
port: 0,
protocol: "string",
resurrectTtl: 0,
role: "string",
sslVerify: false,
tokenEndpoint: "string",
ttl: 0,
},
kubernetes: {
apiTokenFile: "string",
base64Decode: false,
host: "string",
kv: "string",
mount: "string",
namespace: "string",
negTtl: 0,
path: "string",
port: 0,
protocol: "string",
resurrectTtl: 0,
role: "string",
sslVerify: false,
ttl: 0,
},
token: {
base64Decode: false,
host: "string",
kv: "string",
mount: "string",
namespace: "string",
negTtl: 0,
port: 0,
protocol: "string",
resurrectTtl: 0,
sslVerify: false,
token: "string",
ttl: 0,
},
},
createdAt: "string",
description: "string",
id: "string",
labels: {
string: "string",
},
managedBy: {
string: "string",
},
name: "string",
updatedAt: "string",
},
konnect: {
config: {
configStoreId: "string",
},
createdAt: "string",
description: "string",
id: "string",
labels: {
string: "string",
},
managedBy: {
string: "string",
},
name: "string",
updatedAt: "string",
},
});
type: konnect:AiGatewayVault
properties:
aws:
config:
assumeRoleArn: string
base64Decode: false
endpointUrl: string
negTtl: 0
region: string
resurrectTtl: 0
roleSessionName: string
stsEndpointUrl: string
ttl: 0
createdAt: string
description: string
id: string
labels:
string: string
managedBy:
string: string
name: string
updatedAt: string
azure:
config:
base64Decode: false
clientId: string
credentialsPrefix: string
location: string
negTtl: 0
resurrectTtl: 0
tenantId: string
ttl: 0
type: string
vaultUri: string
createdAt: string
description: string
id: string
labels:
string: string
managedBy:
string: string
name: string
updatedAt: string
conjur:
config:
account: string
apiKey: string
base64Decode: false
endpointUrl: string
login: string
negTtl: 0
resurrectTtl: 0
ttl: 0
createdAt: string
description: string
id: string
labels:
string: string
managedBy:
string: string
name: string
updatedAt: string
env:
config:
base64Decode: false
prefix: string
createdAt: string
description: string
id: string
labels:
string: string
managedBy:
string: string
name: string
updatedAt: string
gatewayId: string
gcp:
config:
base64Decode: false
negTtl: 0
projectId: string
resurrectTtl: 0
ttl: 0
createdAt: string
description: string
id: string
labels:
string: string
managedBy:
string: string
name: string
updatedAt: string
hcv:
config:
approle:
base64Decode: false
host: string
kv: string
mount: string
namespace: string
negTtl: 0
path: string
port: 0
protocol: string
responseWrapping: false
resurrectTtl: 0
roleId: string
secretId: string
secretIdFile: string
sslVerify: false
ttl: 0
awsEc2:
base64Decode: false
host: string
kv: string
loginPath: string
mount: string
namespace: string
negTtl: 0
nonce: string
port: 0
protocol: string
resurrectTtl: 0
role: string
sslVerify: false
ttl: 0
awsIam:
accessKeyId: string
assumeRoleArn: string
base64Decode: false
host: string
kv: string
loginPath: string
mount: string
namespace: string
negTtl: 0
port: 0
protocol: string
region: string
resurrectTtl: 0
role: string
roleSessionName: string
secretAccessKey: string
sslVerify: false
stsEndpointUrl: string
ttl: 0
azure:
base64Decode: false
host: string
kv: string
loginPath: string
mount: string
namespace: string
negTtl: 0
port: 0
protocol: string
resurrectTtl: 0
role: string
sslVerify: false
ttl: 0
cert:
base64Decode: false
cert: string
host: string
key: string
kv: string
mount: string
namespace: string
negTtl: 0
port: 0
protocol: string
resurrectTtl: 0
roleName: string
sslVerify: false
ttl: 0
gcpGce:
base64Decode: false
host: string
kv: string
loginPath: string
mount: string
namespace: string
negTtl: 0
port: 0
protocol: string
resurrectTtl: 0
role: string
sslVerify: false
ttl: 0
gcpIam:
base64Decode: false
host: string
jwtExp: 0
kv: string
mount: string
namespace: string
negTtl: 0
port: 0
protocol: string
resurrectTtl: 0
role: string
serviceAccount: string
sslVerify: false
ttl: 0
jwt:
audiences: string
base64Decode: false
clientId: string
clientSecret: string
host: string
kv: string
mount: string
namespace: string
negTtl: 0
port: 0
protocol: string
resurrectTtl: 0
role: string
sslVerify: false
tokenEndpoint: string
ttl: 0
kubernetes:
apiTokenFile: string
base64Decode: false
host: string
kv: string
mount: string
namespace: string
negTtl: 0
path: string
port: 0
protocol: string
resurrectTtl: 0
role: string
sslVerify: false
ttl: 0
token:
base64Decode: false
host: string
kv: string
mount: string
namespace: string
negTtl: 0
port: 0
protocol: string
resurrectTtl: 0
sslVerify: false
token: string
ttl: 0
createdAt: string
description: string
id: string
labels:
string: string
managedBy:
string: string
name: string
updatedAt: string
konnect:
config:
configStoreId: string
createdAt: string
description: string
id: string
labels:
string: string
managedBy:
string: string
name: string
updatedAt: string
AiGatewayVault Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The AiGatewayVault resource accepts the following input properties:
- Gateway
Id string - The unique ID of the AI Gateway.
- Aws
Ai
Gateway Vault Aws - Azure
Ai
Gateway Vault Azure - Conjur
Ai
Gateway Vault Conjur - Env
Ai
Gateway Vault Env - Gcp
Ai
Gateway Vault Gcp - Hcv
Ai
Gateway Vault Hcv - Konnect
Ai
Gateway Vault Konnect
- gateway
Id String - The unique ID of the AI Gateway.
- aws
Ai
Gateway Vault Aws - azure
Ai
Gateway Vault Azure - conjur
Ai
Gateway Vault Conjur - env
Ai
Gateway Vault Env - gcp
Ai
Gateway Vault Gcp - hcv
Ai
Gateway Vault Hcv - konnect
Ai
Gateway Vault Konnect
- gateway
Id string - The unique ID of the AI Gateway.
- aws
Ai
Gateway Vault Aws - azure
Ai
Gateway Vault Azure - conjur
Ai
Gateway Vault Conjur - env
Ai
Gateway Vault Env - gcp
Ai
Gateway Vault Gcp - hcv
Ai
Gateway Vault Hcv - konnect
Ai
Gateway Vault Konnect
- gateway
Id String - The unique ID of the AI Gateway.
- aws Property Map
- azure Property Map
- conjur Property Map
- env Property Map
- gcp Property Map
- hcv Property Map
- konnect Property Map
Outputs
All input properties are implicitly available as output properties. Additionally, the AiGatewayVault resource produces the following output properties:
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Description string
- The description of the Vault.
- Id string
- The provider-assigned unique ID for this managed resource.
- Name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Description string
- The description of the Vault.
- Id string
- The provider-assigned unique ID for this managed resource.
- Name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- created_
at string - An ISO-8601 timestamp representation of entity creation date.
- description string
- The description of the Vault.
- id string
- The provider-assigned unique ID for this managed resource.
- name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated_
at string - An ISO-8601 timestamp representation of entity update date.
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- description String
- The description of the Vault.
- id String
- The provider-assigned unique ID for this managed resource.
- name String
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
- created
At string - An ISO-8601 timestamp representation of entity creation date.
- description string
- The description of the Vault.
- id string
- The provider-assigned unique ID for this managed resource.
- name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At string - An ISO-8601 timestamp representation of entity update date.
- created_
at str - An ISO-8601 timestamp representation of entity creation date.
- description str
- The description of the Vault.
- id str
- The provider-assigned unique ID for this managed resource.
- name str
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated_
at str - An ISO-8601 timestamp representation of entity update date.
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- description String
- The description of the Vault.
- id String
- The provider-assigned unique ID for this managed resource.
- name String
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
Look up Existing AiGatewayVault Resource
Get an existing AiGatewayVault resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: AiGatewayVaultState, opts?: CustomResourceOptions): AiGatewayVault@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
aws: Optional[AiGatewayVaultAwsArgs] = None,
azure: Optional[AiGatewayVaultAzureArgs] = None,
conjur: Optional[AiGatewayVaultConjurArgs] = None,
created_at: Optional[str] = None,
description: Optional[str] = None,
env: Optional[AiGatewayVaultEnvArgs] = None,
gateway_id: Optional[str] = None,
gcp: Optional[AiGatewayVaultGcpArgs] = None,
hcv: Optional[AiGatewayVaultHcvArgs] = None,
konnect: Optional[AiGatewayVaultKonnectArgs] = None,
name: Optional[str] = None,
updated_at: Optional[str] = None) -> AiGatewayVaultfunc GetAiGatewayVault(ctx *Context, name string, id IDInput, state *AiGatewayVaultState, opts ...ResourceOption) (*AiGatewayVault, error)public static AiGatewayVault Get(string name, Input<string> id, AiGatewayVaultState? state, CustomResourceOptions? opts = null)public static AiGatewayVault get(String name, Output<String> id, AiGatewayVaultState state, CustomResourceOptions options)resources: _: type: konnect:AiGatewayVault get: id: ${id}import {
to = konnect_ai_gateway_vault.example
id = "${id}"
}
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Aws
Ai
Gateway Vault Aws - Azure
Ai
Gateway Vault Azure - Conjur
Ai
Gateway Vault Conjur - Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Description string
- The description of the Vault.
- Env
Ai
Gateway Vault Env - Gateway
Id string - The unique ID of the AI Gateway.
- Gcp
Ai
Gateway Vault Gcp - Hcv
Ai
Gateway Vault Hcv - Konnect
Ai
Gateway Vault Konnect - Name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- Aws
Ai
Gateway Vault Aws Args - Azure
Ai
Gateway Vault Azure Args - Conjur
Ai
Gateway Vault Conjur Args - Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Description string
- The description of the Vault.
- Env
Ai
Gateway Vault Env Args - Gateway
Id string - The unique ID of the AI Gateway.
- Gcp
Ai
Gateway Vault Gcp Args - Hcv
Ai
Gateway Vault Hcv Args - Konnect
Ai
Gateway Vault Konnect Args - Name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- aws object
- azure object
- conjur object
- created_
at string - An ISO-8601 timestamp representation of entity creation date.
- description string
- The description of the Vault.
- env object
- gateway_
id string - The unique ID of the AI Gateway.
- gcp object
- hcv object
- konnect object
- name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated_
at string - An ISO-8601 timestamp representation of entity update date.
- aws
Ai
Gateway Vault Aws - azure
Ai
Gateway Vault Azure - conjur
Ai
Gateway Vault Conjur - created
At String - An ISO-8601 timestamp representation of entity creation date.
- description String
- The description of the Vault.
- env
Ai
Gateway Vault Env - gateway
Id String - The unique ID of the AI Gateway.
- gcp
Ai
Gateway Vault Gcp - hcv
Ai
Gateway Vault Hcv - konnect
Ai
Gateway Vault Konnect - name String
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
- aws
Ai
Gateway Vault Aws - azure
Ai
Gateway Vault Azure - conjur
Ai
Gateway Vault Conjur - created
At string - An ISO-8601 timestamp representation of entity creation date.
- description string
- The description of the Vault.
- env
Ai
Gateway Vault Env - gateway
Id string - The unique ID of the AI Gateway.
- gcp
Ai
Gateway Vault Gcp - hcv
Ai
Gateway Vault Hcv - konnect
Ai
Gateway Vault Konnect - name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At string - An ISO-8601 timestamp representation of entity update date.
- aws
Ai
Gateway Vault Aws Args - azure
Ai
Gateway Vault Azure Args - conjur
Ai
Gateway Vault Conjur Args - created_
at str - An ISO-8601 timestamp representation of entity creation date.
- description str
- The description of the Vault.
- env
Ai
Gateway Vault Env Args - gateway_
id str - The unique ID of the AI Gateway.
- gcp
Ai
Gateway Vault Gcp Args - hcv
Ai
Gateway Vault Hcv Args - konnect
Ai
Gateway Vault Konnect Args - name str
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated_
at str - An ISO-8601 timestamp representation of entity update date.
- aws Property Map
- azure Property Map
- conjur Property Map
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- description String
- The description of the Vault.
- env Property Map
- gateway
Id String - The unique ID of the AI Gateway.
- gcp Property Map
- hcv Property Map
- konnect Property Map
- name String
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
Supporting Types
AiGatewayVaultAws, AiGatewayVaultAwsArgs
- Config
Ai
Gateway Vault Aws Config - Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Description string
- The description of the Vault. Default: ""
- Id string
- Contains a unique identifier used for this resource.
- Labels Dictionary<string, string>
- Public labels store information about an entity that can be used for filtering a list of objects.
- Managed
By Dictionary<string, string> - Name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- Config
Ai
Gateway Vault Aws Config - Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Description string
- The description of the Vault. Default: ""
- Id string
- Contains a unique identifier used for this resource.
- Labels map[string]string
- Public labels store information about an entity that can be used for filtering a list of objects.
- Managed
By map[string]string - Name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- config object
- Not Null
- created_
at string - An ISO-8601 timestamp representation of entity creation date.
- description string
- The description of the Vault. Default: ""
- id string
- Contains a unique identifier used for this resource.
- labels map(string)
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed_
by map(string) - name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated_
at string - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Vault Aws Config - Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- description String
- The description of the Vault. Default: ""
- id String
- Contains a unique identifier used for this resource.
- labels Map<String,String>
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By Map<String,String> - name String
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Vault Aws Config - Not Null
- created
At string - An ISO-8601 timestamp representation of entity creation date.
- description string
- The description of the Vault. Default: ""
- id string
- Contains a unique identifier used for this resource.
- labels {[key: string]: string}
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By {[key: string]: string} - name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At string - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Vault Aws Config - Not Null
- created_
at str - An ISO-8601 timestamp representation of entity creation date.
- description str
- The description of the Vault. Default: ""
- id str
- Contains a unique identifier used for this resource.
- labels Mapping[str, str]
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed_
by Mapping[str, str] - name str
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated_
at str - An ISO-8601 timestamp representation of entity update date.
- config Property Map
- Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- description String
- The description of the Vault. Default: ""
- id String
- Contains a unique identifier used for this resource.
- labels Map<String>
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By Map<String> - name String
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
AiGatewayVaultAwsConfig, AiGatewayVaultAwsConfigArgs
- Assume
Role stringArn - The ARN of the role to assume when retrieving secrets from AWS Secrets Manager.
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Endpoint
Url string - The endpoint URL of the AWS Secrets Manager service. If not specified, the default is https://secretsmanager.{region}.amazonaws.com. You can override this by specifying a complete URL including the http/https scheme.
- Neg
Ttl double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Region string
- The AWS region where your vault is located.
- Resurrect
Ttl double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Role
Session stringName - The session name used when assuming a role. Default: "KongVault"
- Sts
Endpoint stringUrl - A custom STS endpoint URL used for IAM role assumption. Overrides the default https://sts.amazonaws.com or regional variant https://sts.\n\n.amazonaws.com. Include the full http/https scheme. Only specify this if using a private VPC endpoint for STS.
- Ttl double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- Assume
Role stringArn - The ARN of the role to assume when retrieving secrets from AWS Secrets Manager.
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Endpoint
Url string - The endpoint URL of the AWS Secrets Manager service. If not specified, the default is https://secretsmanager.{region}.amazonaws.com. You can override this by specifying a complete URL including the http/https scheme.
- Neg
Ttl float64 - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Region string
- The AWS region where your vault is located.
- Resurrect
Ttl float64 - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Role
Session stringName - The session name used when assuming a role. Default: "KongVault"
- Sts
Endpoint stringUrl - A custom STS endpoint URL used for IAM role assumption. Overrides the default https://sts.amazonaws.com or regional variant https://sts.\n\n.amazonaws.com. Include the full http/https scheme. Only specify this if using a private VPC endpoint for STS.
- Ttl float64
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- assume_
role_ stringarn - The ARN of the role to assume when retrieving secrets from AWS Secrets Manager.
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- endpoint_
url string - The endpoint URL of the AWS Secrets Manager service. If not specified, the default is https://secretsmanager.{region}.amazonaws.com. You can override this by specifying a complete URL including the http/https scheme.
- neg_
ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- region string
- The AWS region where your vault is located.
- resurrect_
ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role_
session_ stringname - The session name used when assuming a role. Default: "KongVault"
- sts_
endpoint_ stringurl - A custom STS endpoint URL used for IAM role assumption. Overrides the default https://sts.amazonaws.com or regional variant https://sts.\n\n.amazonaws.com. Include the full http/https scheme. Only specify this if using a private VPC endpoint for STS.
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- assume
Role StringArn - The ARN of the role to assume when retrieving secrets from AWS Secrets Manager.
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- endpoint
Url String - The endpoint URL of the AWS Secrets Manager service. If not specified, the default is https://secretsmanager.{region}.amazonaws.com. You can override this by specifying a complete URL including the http/https scheme.
- neg
Ttl Double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- region String
- The AWS region where your vault is located.
- resurrect
Ttl Double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role
Session StringName - The session name used when assuming a role. Default: "KongVault"
- sts
Endpoint StringUrl - A custom STS endpoint URL used for IAM role assumption. Overrides the default https://sts.amazonaws.com or regional variant https://sts.\n\n.amazonaws.com. Include the full http/https scheme. Only specify this if using a private VPC endpoint for STS.
- ttl Double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- assume
Role stringArn - The ARN of the role to assume when retrieving secrets from AWS Secrets Manager.
- base64Decode boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- endpoint
Url string - The endpoint URL of the AWS Secrets Manager service. If not specified, the default is https://secretsmanager.{region}.amazonaws.com. You can override this by specifying a complete URL including the http/https scheme.
- neg
Ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- region string
- The AWS region where your vault is located.
- resurrect
Ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role
Session stringName - The session name used when assuming a role. Default: "KongVault"
- sts
Endpoint stringUrl - A custom STS endpoint URL used for IAM role assumption. Overrides the default https://sts.amazonaws.com or regional variant https://sts.\n\n.amazonaws.com. Include the full http/https scheme. Only specify this if using a private VPC endpoint for STS.
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- assume_
role_ strarn - The ARN of the role to assume when retrieving secrets from AWS Secrets Manager.
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- endpoint_
url str - The endpoint URL of the AWS Secrets Manager service. If not specified, the default is https://secretsmanager.{region}.amazonaws.com. You can override this by specifying a complete URL including the http/https scheme.
- neg_
ttl float - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- region str
- The AWS region where your vault is located.
- resurrect_
ttl float - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role_
session_ strname - The session name used when assuming a role. Default: "KongVault"
- sts_
endpoint_ strurl - A custom STS endpoint URL used for IAM role assumption. Overrides the default https://sts.amazonaws.com or regional variant https://sts.\n\n.amazonaws.com. Include the full http/https scheme. Only specify this if using a private VPC endpoint for STS.
- ttl float
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- assume
Role StringArn - The ARN of the role to assume when retrieving secrets from AWS Secrets Manager.
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- endpoint
Url String - The endpoint URL of the AWS Secrets Manager service. If not specified, the default is https://secretsmanager.{region}.amazonaws.com. You can override this by specifying a complete URL including the http/https scheme.
- neg
Ttl Number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- region String
- The AWS region where your vault is located.
- resurrect
Ttl Number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role
Session StringName - The session name used when assuming a role. Default: "KongVault"
- sts
Endpoint StringUrl - A custom STS endpoint URL used for IAM role assumption. Overrides the default https://sts.amazonaws.com or regional variant https://sts.\n\n.amazonaws.com. Include the full http/https scheme. Only specify this if using a private VPC endpoint for STS.
- ttl Number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
AiGatewayVaultAzure, AiGatewayVaultAzureArgs
- Config
Ai
Gateway Vault Azure Config - Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Description string
- The description of the Vault. Default: ""
- Id string
- Contains a unique identifier used for this resource.
- Labels Dictionary<string, string>
- Public labels store information about an entity that can be used for filtering a list of objects.
- Managed
By Dictionary<string, string> - Name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- Config
Ai
Gateway Vault Azure Config - Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Description string
- The description of the Vault. Default: ""
- Id string
- Contains a unique identifier used for this resource.
- Labels map[string]string
- Public labels store information about an entity that can be used for filtering a list of objects.
- Managed
By map[string]string - Name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- config object
- Not Null
- created_
at string - An ISO-8601 timestamp representation of entity creation date.
- description string
- The description of the Vault. Default: ""
- id string
- Contains a unique identifier used for this resource.
- labels map(string)
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed_
by map(string) - name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated_
at string - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Vault Azure Config - Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- description String
- The description of the Vault. Default: ""
- id String
- Contains a unique identifier used for this resource.
- labels Map<String,String>
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By Map<String,String> - name String
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Vault Azure Config - Not Null
- created
At string - An ISO-8601 timestamp representation of entity creation date.
- description string
- The description of the Vault. Default: ""
- id string
- Contains a unique identifier used for this resource.
- labels {[key: string]: string}
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By {[key: string]: string} - name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At string - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Vault Azure Config - Not Null
- created_
at str - An ISO-8601 timestamp representation of entity creation date.
- description str
- The description of the Vault. Default: ""
- id str
- Contains a unique identifier used for this resource.
- labels Mapping[str, str]
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed_
by Mapping[str, str] - name str
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated_
at str - An ISO-8601 timestamp representation of entity update date.
- config Property Map
- Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- description String
- The description of the Vault. Default: ""
- id String
- Contains a unique identifier used for this resource.
- labels Map<String>
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By Map<String> - name String
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
AiGatewayVaultAzureConfig, AiGatewayVaultAzureConfigArgs
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Client
Id string - The client ID for your registered application. You can find this in the Azure Dashboard under App Registrations.
- Credentials
Prefix string - The prefix for the credentials stored in the Azure Key Vault. Default: "AZURE"
- Location string
- Each Azure geography includes one or more regions that meet specific data residency and compliance requirements. Not Null
- Neg
Ttl double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Resurrect
Ttl double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Tenant
Id string - The DirectoryId and TenantId are the same: both refer to the GUID representing your Azure Active Directory tenant. Microsoft documentation and products may use either term depending on context.
- Ttl double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- Type string
- Default: "secrets"; must be "secrets"
- Vault
Uri string - The URI from which the vault is reachable. This value can be found in your Azure Key Vault Dashboard under the Vault URI entry. Not Null
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Client
Id string - The client ID for your registered application. You can find this in the Azure Dashboard under App Registrations.
- Credentials
Prefix string - The prefix for the credentials stored in the Azure Key Vault. Default: "AZURE"
- Location string
- Each Azure geography includes one or more regions that meet specific data residency and compliance requirements. Not Null
- Neg
Ttl float64 - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Resurrect
Ttl float64 - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Tenant
Id string - The DirectoryId and TenantId are the same: both refer to the GUID representing your Azure Active Directory tenant. Microsoft documentation and products may use either term depending on context.
- Ttl float64
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- Type string
- Default: "secrets"; must be "secrets"
- Vault
Uri string - The URI from which the vault is reachable. This value can be found in your Azure Key Vault Dashboard under the Vault URI entry. Not Null
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- client_
id string - The client ID for your registered application. You can find this in the Azure Dashboard under App Registrations.
- credentials_
prefix string - The prefix for the credentials stored in the Azure Key Vault. Default: "AZURE"
- location string
- Each Azure geography includes one or more regions that meet specific data residency and compliance requirements. Not Null
- neg_
ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- resurrect_
ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- tenant_
id string - The DirectoryId and TenantId are the same: both refer to the GUID representing your Azure Active Directory tenant. Microsoft documentation and products may use either term depending on context.
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- type string
- Default: "secrets"; must be "secrets"
- vault_
uri string - The URI from which the vault is reachable. This value can be found in your Azure Key Vault Dashboard under the Vault URI entry. Not Null
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- client
Id String - The client ID for your registered application. You can find this in the Azure Dashboard under App Registrations.
- credentials
Prefix String - The prefix for the credentials stored in the Azure Key Vault. Default: "AZURE"
- location String
- Each Azure geography includes one or more regions that meet specific data residency and compliance requirements. Not Null
- neg
Ttl Double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- resurrect
Ttl Double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- tenant
Id String - The DirectoryId and TenantId are the same: both refer to the GUID representing your Azure Active Directory tenant. Microsoft documentation and products may use either term depending on context.
- ttl Double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- type String
- Default: "secrets"; must be "secrets"
- vault
Uri String - The URI from which the vault is reachable. This value can be found in your Azure Key Vault Dashboard under the Vault URI entry. Not Null
- base64Decode boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- client
Id string - The client ID for your registered application. You can find this in the Azure Dashboard under App Registrations.
- credentials
Prefix string - The prefix for the credentials stored in the Azure Key Vault. Default: "AZURE"
- location string
- Each Azure geography includes one or more regions that meet specific data residency and compliance requirements. Not Null
- neg
Ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- resurrect
Ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- tenant
Id string - The DirectoryId and TenantId are the same: both refer to the GUID representing your Azure Active Directory tenant. Microsoft documentation and products may use either term depending on context.
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- type string
- Default: "secrets"; must be "secrets"
- vault
Uri string - The URI from which the vault is reachable. This value can be found in your Azure Key Vault Dashboard under the Vault URI entry. Not Null
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- client_
id str - The client ID for your registered application. You can find this in the Azure Dashboard under App Registrations.
- credentials_
prefix str - The prefix for the credentials stored in the Azure Key Vault. Default: "AZURE"
- location str
- Each Azure geography includes one or more regions that meet specific data residency and compliance requirements. Not Null
- neg_
ttl float - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- resurrect_
ttl float - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- tenant_
id str - The DirectoryId and TenantId are the same: both refer to the GUID representing your Azure Active Directory tenant. Microsoft documentation and products may use either term depending on context.
- ttl float
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- type str
- Default: "secrets"; must be "secrets"
- vault_
uri str - The URI from which the vault is reachable. This value can be found in your Azure Key Vault Dashboard under the Vault URI entry. Not Null
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- client
Id String - The client ID for your registered application. You can find this in the Azure Dashboard under App Registrations.
- credentials
Prefix String - The prefix for the credentials stored in the Azure Key Vault. Default: "AZURE"
- location String
- Each Azure geography includes one or more regions that meet specific data residency and compliance requirements. Not Null
- neg
Ttl Number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- resurrect
Ttl Number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- tenant
Id String - The DirectoryId and TenantId are the same: both refer to the GUID representing your Azure Active Directory tenant. Microsoft documentation and products may use either term depending on context.
- ttl Number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- type String
- Default: "secrets"; must be "secrets"
- vault
Uri String - The URI from which the vault is reachable. This value can be found in your Azure Key Vault Dashboard under the Vault URI entry. Not Null
AiGatewayVaultConjur, AiGatewayVaultConjurArgs
- Config
Ai
Gateway Vault Conjur Config - Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Description string
- The description of the Vault. Default: ""
- Id string
- Contains a unique identifier used for this resource.
- Labels Dictionary<string, string>
- Public labels store information about an entity that can be used for filtering a list of objects.
- Managed
By Dictionary<string, string> - Name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- Config
Ai
Gateway Vault Conjur Config - Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Description string
- The description of the Vault. Default: ""
- Id string
- Contains a unique identifier used for this resource.
- Labels map[string]string
- Public labels store information about an entity that can be used for filtering a list of objects.
- Managed
By map[string]string - Name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- config object
- Not Null
- created_
at string - An ISO-8601 timestamp representation of entity creation date.
- description string
- The description of the Vault. Default: ""
- id string
- Contains a unique identifier used for this resource.
- labels map(string)
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed_
by map(string) - name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated_
at string - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Vault Conjur Config - Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- description String
- The description of the Vault. Default: ""
- id String
- Contains a unique identifier used for this resource.
- labels Map<String,String>
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By Map<String,String> - name String
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Vault Conjur Config - Not Null
- created
At string - An ISO-8601 timestamp representation of entity creation date.
- description string
- The description of the Vault. Default: ""
- id string
- Contains a unique identifier used for this resource.
- labels {[key: string]: string}
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By {[key: string]: string} - name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At string - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Vault Conjur Config - Not Null
- created_
at str - An ISO-8601 timestamp representation of entity creation date.
- description str
- The description of the Vault. Default: ""
- id str
- Contains a unique identifier used for this resource.
- labels Mapping[str, str]
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed_
by Mapping[str, str] - name str
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated_
at str - An ISO-8601 timestamp representation of entity update date.
- config Property Map
- Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- description String
- The description of the Vault. Default: ""
- id String
- Contains a unique identifier used for this resource.
- labels Map<String>
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By Map<String> - name String
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
AiGatewayVaultConjurConfig, AiGatewayVaultConjurConfigArgs
- Account string
- The CyberArk Secrets Manager organization account name. Not Null
- Api
Key string - The API key of the workload identity.
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Endpoint
Url string - The CyberArk Secrets Manager backend URL to connect with. Accepts http or https protocols. Not Null
- Login string
- The login name of the workload identity. Not Null
- Neg
Ttl double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Resurrect
Ttl double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Ttl double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- Account string
- The CyberArk Secrets Manager organization account name. Not Null
- Api
Key string - The API key of the workload identity.
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Endpoint
Url string - The CyberArk Secrets Manager backend URL to connect with. Accepts http or https protocols. Not Null
- Login string
- The login name of the workload identity. Not Null
- Neg
Ttl float64 - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Resurrect
Ttl float64 - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Ttl float64
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- account string
- The CyberArk Secrets Manager organization account name. Not Null
- api_
key string - The API key of the workload identity.
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- endpoint_
url string - The CyberArk Secrets Manager backend URL to connect with. Accepts http or https protocols. Not Null
- login string
- The login name of the workload identity. Not Null
- neg_
ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- resurrect_
ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- account String
- The CyberArk Secrets Manager organization account name. Not Null
- api
Key String - The API key of the workload identity.
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- endpoint
Url String - The CyberArk Secrets Manager backend URL to connect with. Accepts http or https protocols. Not Null
- login String
- The login name of the workload identity. Not Null
- neg
Ttl Double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- resurrect
Ttl Double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- ttl Double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- account string
- The CyberArk Secrets Manager organization account name. Not Null
- api
Key string - The API key of the workload identity.
- base64Decode boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- endpoint
Url string - The CyberArk Secrets Manager backend URL to connect with. Accepts http or https protocols. Not Null
- login string
- The login name of the workload identity. Not Null
- neg
Ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- resurrect
Ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- account str
- The CyberArk Secrets Manager organization account name. Not Null
- api_
key str - The API key of the workload identity.
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- endpoint_
url str - The CyberArk Secrets Manager backend URL to connect with. Accepts http or https protocols. Not Null
- login str
- The login name of the workload identity. Not Null
- neg_
ttl float - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- resurrect_
ttl float - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- ttl float
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- account String
- The CyberArk Secrets Manager organization account name. Not Null
- api
Key String - The API key of the workload identity.
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- endpoint
Url String - The CyberArk Secrets Manager backend URL to connect with. Accepts http or https protocols. Not Null
- login String
- The login name of the workload identity. Not Null
- neg
Ttl Number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- resurrect
Ttl Number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- ttl Number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
AiGatewayVaultEnv, AiGatewayVaultEnvArgs
- Config
Ai
Gateway Vault Env Config - Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Description string
- The description of the Vault. Default: ""
- Id string
- Contains a unique identifier used for this resource.
- Labels Dictionary<string, string>
- Public labels store information about an entity that can be used for filtering a list of objects.
- Managed
By Dictionary<string, string> - Name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- Config
Ai
Gateway Vault Env Config - Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Description string
- The description of the Vault. Default: ""
- Id string
- Contains a unique identifier used for this resource.
- Labels map[string]string
- Public labels store information about an entity that can be used for filtering a list of objects.
- Managed
By map[string]string - Name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- config object
- Not Null
- created_
at string - An ISO-8601 timestamp representation of entity creation date.
- description string
- The description of the Vault. Default: ""
- id string
- Contains a unique identifier used for this resource.
- labels map(string)
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed_
by map(string) - name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated_
at string - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Vault Env Config - Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- description String
- The description of the Vault. Default: ""
- id String
- Contains a unique identifier used for this resource.
- labels Map<String,String>
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By Map<String,String> - name String
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Vault Env Config - Not Null
- created
At string - An ISO-8601 timestamp representation of entity creation date.
- description string
- The description of the Vault. Default: ""
- id string
- Contains a unique identifier used for this resource.
- labels {[key: string]: string}
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By {[key: string]: string} - name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At string - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Vault Env Config - Not Null
- created_
at str - An ISO-8601 timestamp representation of entity creation date.
- description str
- The description of the Vault. Default: ""
- id str
- Contains a unique identifier used for this resource.
- labels Mapping[str, str]
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed_
by Mapping[str, str] - name str
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated_
at str - An ISO-8601 timestamp representation of entity update date.
- config Property Map
- Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- description String
- The description of the Vault. Default: ""
- id String
- Contains a unique identifier used for this resource.
- labels Map<String>
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By Map<String> - name String
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
AiGatewayVaultEnvConfig, AiGatewayVaultEnvConfigArgs
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Prefix string
- The prefix for the environment variable that the value will be stored in.
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Prefix string
- The prefix for the environment variable that the value will be stored in.
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- prefix string
- The prefix for the environment variable that the value will be stored in.
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- prefix String
- The prefix for the environment variable that the value will be stored in.
- base64Decode boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- prefix string
- The prefix for the environment variable that the value will be stored in.
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- prefix str
- The prefix for the environment variable that the value will be stored in.
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- prefix String
- The prefix for the environment variable that the value will be stored in.
AiGatewayVaultGcp, AiGatewayVaultGcpArgs
- Config
Ai
Gateway Vault Gcp Config - Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Description string
- The description of the Vault. Default: ""
- Id string
- Contains a unique identifier used for this resource.
- Labels Dictionary<string, string>
- Public labels store information about an entity that can be used for filtering a list of objects.
- Managed
By Dictionary<string, string> - Name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- Config
Ai
Gateway Vault Gcp Config - Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Description string
- The description of the Vault. Default: ""
- Id string
- Contains a unique identifier used for this resource.
- Labels map[string]string
- Public labels store information about an entity that can be used for filtering a list of objects.
- Managed
By map[string]string - Name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- config object
- Not Null
- created_
at string - An ISO-8601 timestamp representation of entity creation date.
- description string
- The description of the Vault. Default: ""
- id string
- Contains a unique identifier used for this resource.
- labels map(string)
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed_
by map(string) - name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated_
at string - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Vault Gcp Config - Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- description String
- The description of the Vault. Default: ""
- id String
- Contains a unique identifier used for this resource.
- labels Map<String,String>
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By Map<String,String> - name String
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Vault Gcp Config - Not Null
- created
At string - An ISO-8601 timestamp representation of entity creation date.
- description string
- The description of the Vault. Default: ""
- id string
- Contains a unique identifier used for this resource.
- labels {[key: string]: string}
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By {[key: string]: string} - name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At string - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Vault Gcp Config - Not Null
- created_
at str - An ISO-8601 timestamp representation of entity creation date.
- description str
- The description of the Vault. Default: ""
- id str
- Contains a unique identifier used for this resource.
- labels Mapping[str, str]
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed_
by Mapping[str, str] - name str
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated_
at str - An ISO-8601 timestamp representation of entity update date.
- config Property Map
- Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- description String
- The description of the Vault. Default: ""
- id String
- Contains a unique identifier used for this resource.
- labels Map<String>
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By Map<String> - name String
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
AiGatewayVaultGcpConfig, AiGatewayVaultGcpConfigArgs
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Neg
Ttl double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Project
Id string - The project ID from your Google API Console. You can find it by visiting your Google API Console and selecting “Manage all projects” in the projects list. Not Null
- Resurrect
Ttl double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Ttl double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Neg
Ttl float64 - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Project
Id string - The project ID from your Google API Console. You can find it by visiting your Google API Console and selecting “Manage all projects” in the projects list. Not Null
- Resurrect
Ttl float64 - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Ttl float64
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- neg_
ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- project_
id string - The project ID from your Google API Console. You can find it by visiting your Google API Console and selecting “Manage all projects” in the projects list. Not Null
- resurrect_
ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- neg
Ttl Double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- project
Id String - The project ID from your Google API Console. You can find it by visiting your Google API Console and selecting “Manage all projects” in the projects list. Not Null
- resurrect
Ttl Double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- ttl Double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- neg
Ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- project
Id string - The project ID from your Google API Console. You can find it by visiting your Google API Console and selecting “Manage all projects” in the projects list. Not Null
- resurrect
Ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- neg_
ttl float - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- project_
id str - The project ID from your Google API Console. You can find it by visiting your Google API Console and selecting “Manage all projects” in the projects list. Not Null
- resurrect_
ttl float - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- ttl float
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- neg
Ttl Number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- project
Id String - The project ID from your Google API Console. You can find it by visiting your Google API Console and selecting “Manage all projects” in the projects list. Not Null
- resurrect
Ttl Number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- ttl Number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
AiGatewayVaultHcv, AiGatewayVaultHcvArgs
- Config
Ai
Gateway Vault Hcv Config - Configuration for an AI Gateway Vault. Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Description string
- The description of the Vault. Default: ""
- Id string
- Contains a unique identifier used for this resource.
- Labels Dictionary<string, string>
- Public labels store information about an entity that can be used for filtering a list of objects.
- Managed
By Dictionary<string, string> - Name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- Config
Ai
Gateway Vault Hcv Config - Configuration for an AI Gateway Vault. Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Description string
- The description of the Vault. Default: ""
- Id string
- Contains a unique identifier used for this resource.
- Labels map[string]string
- Public labels store information about an entity that can be used for filtering a list of objects.
- Managed
By map[string]string - Name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- config object
- Configuration for an AI Gateway Vault. Not Null
- created_
at string - An ISO-8601 timestamp representation of entity creation date.
- description string
- The description of the Vault. Default: ""
- id string
- Contains a unique identifier used for this resource.
- labels map(string)
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed_
by map(string) - name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated_
at string - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Vault Hcv Config - Configuration for an AI Gateway Vault. Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- description String
- The description of the Vault. Default: ""
- id String
- Contains a unique identifier used for this resource.
- labels Map<String,String>
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By Map<String,String> - name String
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Vault Hcv Config - Configuration for an AI Gateway Vault. Not Null
- created
At string - An ISO-8601 timestamp representation of entity creation date.
- description string
- The description of the Vault. Default: ""
- id string
- Contains a unique identifier used for this resource.
- labels {[key: string]: string}
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By {[key: string]: string} - name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At string - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Vault Hcv Config - Configuration for an AI Gateway Vault. Not Null
- created_
at str - An ISO-8601 timestamp representation of entity creation date.
- description str
- The description of the Vault. Default: ""
- id str
- Contains a unique identifier used for this resource.
- labels Mapping[str, str]
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed_
by Mapping[str, str] - name str
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated_
at str - An ISO-8601 timestamp representation of entity update date.
- config Property Map
- Configuration for an AI Gateway Vault. Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- description String
- The description of the Vault. Default: ""
- id String
- Contains a unique identifier used for this resource.
- labels Map<String>
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By Map<String> - name String
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
AiGatewayVaultHcvConfig, AiGatewayVaultHcvConfigArgs
- Approle
Ai
Gateway Vault Hcv Config Approle - Aws
Ec2 AiGateway Vault Hcv Config Aws Ec2 - Aws
Iam AiGateway Vault Hcv Config Aws Iam - Azure
Ai
Gateway Vault Hcv Config Azure - Cert
Ai
Gateway Vault Hcv Config Cert - Gcp
Gce AiGateway Vault Hcv Config Gcp Gce - Gcp
Iam AiGateway Vault Hcv Config Gcp Iam - Jwt
Ai
Gateway Vault Hcv Config Jwt - Kubernetes
Ai
Gateway Vault Hcv Config Kubernetes - Token
Ai
Gateway Vault Hcv Config Token
- Approle
Ai
Gateway Vault Hcv Config Approle - Aws
Ec2 AiGateway Vault Hcv Config Aws Ec2 - Aws
Iam AiGateway Vault Hcv Config Aws Iam - Azure
Ai
Gateway Vault Hcv Config Azure - Cert
Ai
Gateway Vault Hcv Config Cert - Gcp
Gce AiGateway Vault Hcv Config Gcp Gce - Gcp
Iam AiGateway Vault Hcv Config Gcp Iam - Jwt
Ai
Gateway Vault Hcv Config Jwt - Kubernetes
Ai
Gateway Vault Hcv Config Kubernetes - Token
Ai
Gateway Vault Hcv Config Token
- approle
Ai
Gateway Vault Hcv Config Approle - aws
Ec2 AiGateway Vault Hcv Config Aws Ec2 - aws
Iam AiGateway Vault Hcv Config Aws Iam - azure
Ai
Gateway Vault Hcv Config Azure - cert
Ai
Gateway Vault Hcv Config Cert - gcp
Gce AiGateway Vault Hcv Config Gcp Gce - gcp
Iam AiGateway Vault Hcv Config Gcp Iam - jwt
Ai
Gateway Vault Hcv Config Jwt - kubernetes
Ai
Gateway Vault Hcv Config Kubernetes - token
Ai
Gateway Vault Hcv Config Token
- approle
Ai
Gateway Vault Hcv Config Approle - aws
Ec2 AiGateway Vault Hcv Config Aws Ec2 - aws
Iam AiGateway Vault Hcv Config Aws Iam - azure
Ai
Gateway Vault Hcv Config Azure - cert
Ai
Gateway Vault Hcv Config Cert - gcp
Gce AiGateway Vault Hcv Config Gcp Gce - gcp
Iam AiGateway Vault Hcv Config Gcp Iam - jwt
Ai
Gateway Vault Hcv Config Jwt - kubernetes
Ai
Gateway Vault Hcv Config Kubernetes - token
Ai
Gateway Vault Hcv Config Token
- approle
Ai
Gateway Vault Hcv Config Approle - aws_
ec2 AiGateway Vault Hcv Config Aws Ec2 - aws_
iam AiGateway Vault Hcv Config Aws Iam - azure
Ai
Gateway Vault Hcv Config Azure - cert
Ai
Gateway Vault Hcv Config Cert - gcp_
gce AiGateway Vault Hcv Config Gcp Gce - gcp_
iam AiGateway Vault Hcv Config Gcp Iam - jwt
Ai
Gateway Vault Hcv Config Jwt - kubernetes
Ai
Gateway Vault Hcv Config Kubernetes - token
Ai
Gateway Vault Hcv Config Token
AiGatewayVaultHcvConfigApprole, AiGatewayVaultHcvConfigApproleArgs
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Host string
- The hostname of your HashiCorp vault. Not Null
- Kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- Mount string
- The mount point. Default: "secret"
- Namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- Neg
Ttl double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Path string
- Path for enabling the AppRole auth method. Single leading/trailing slashes are trimmed. Default: "approle"
- Port double
- The port number of your HashiCorp vault. Not Null
- Protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- Response
Wrapping bool - Whether the secret ID is a response-wrapping token. When true, Kong unwraps the token to get the actual secret ID. Note: tokens can only be unwrapped once; distribute them individually to Kong nodes. Default: false
- Resurrect
Ttl double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Role
Id string - Specifies the AppRole role ID in HashiCorp Vault.
Either
role_idorsecret_id_filemust be set. - Secret
Id string - Defines the AppRole’s secret ID in HashiCorp Vault.
- Secret
Id stringFile - Path to a file containing the AppRole secret ID.
Either
role_idorsecret_id_filemust be set. - Ssl
Verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- Ttl double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Host string
- The hostname of your HashiCorp vault. Not Null
- Kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- Mount string
- The mount point. Default: "secret"
- Namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- Neg
Ttl float64 - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Path string
- Path for enabling the AppRole auth method. Single leading/trailing slashes are trimmed. Default: "approle"
- Port float64
- The port number of your HashiCorp vault. Not Null
- Protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- Response
Wrapping bool - Whether the secret ID is a response-wrapping token. When true, Kong unwraps the token to get the actual secret ID. Note: tokens can only be unwrapped once; distribute them individually to Kong nodes. Default: false
- Resurrect
Ttl float64 - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Role
Id string - Specifies the AppRole role ID in HashiCorp Vault.
Either
role_idorsecret_id_filemust be set. - Secret
Id string - Defines the AppRole’s secret ID in HashiCorp Vault.
- Secret
Id stringFile - Path to a file containing the AppRole secret ID.
Either
role_idorsecret_id_filemust be set. - Ssl
Verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- Ttl float64
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host string
- The hostname of your HashiCorp vault. Not Null
- kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount string
- The mount point. Default: "secret"
- namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg_
ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- path string
- Path for enabling the AppRole auth method. Single leading/trailing slashes are trimmed. Default: "approle"
- port number
- The port number of your HashiCorp vault. Not Null
- protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- response_
wrapping bool - Whether the secret ID is a response-wrapping token. When true, Kong unwraps the token to get the actual secret ID. Note: tokens can only be unwrapped once; distribute them individually to Kong nodes. Default: false
- resurrect_
ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role_
id string - Specifies the AppRole role ID in HashiCorp Vault.
Either
role_idorsecret_id_filemust be set. - secret_
id string - Defines the AppRole’s secret ID in HashiCorp Vault.
- secret_
id_ stringfile - Path to a file containing the AppRole secret ID.
Either
role_idorsecret_id_filemust be set. - ssl_
verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host String
- The hostname of your HashiCorp vault. Not Null
- kv String
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount String
- The mount point. Default: "secret"
- namespace String
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl Double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- path String
- Path for enabling the AppRole auth method. Single leading/trailing slashes are trimmed. Default: "approle"
- port Double
- The port number of your HashiCorp vault. Not Null
- protocol String
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- response
Wrapping Boolean - Whether the secret ID is a response-wrapping token. When true, Kong unwraps the token to get the actual secret ID. Note: tokens can only be unwrapped once; distribute them individually to Kong nodes. Default: false
- resurrect
Ttl Double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role
Id String - Specifies the AppRole role ID in HashiCorp Vault.
Either
role_idorsecret_id_filemust be set. - secret
Id String - Defines the AppRole’s secret ID in HashiCorp Vault.
- secret
Id StringFile - Path to a file containing the AppRole secret ID.
Either
role_idorsecret_id_filemust be set. - ssl
Verify Boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl Double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host string
- The hostname of your HashiCorp vault. Not Null
- kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount string
- The mount point. Default: "secret"
- namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- path string
- Path for enabling the AppRole auth method. Single leading/trailing slashes are trimmed. Default: "approle"
- port number
- The port number of your HashiCorp vault. Not Null
- protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- response
Wrapping boolean - Whether the secret ID is a response-wrapping token. When true, Kong unwraps the token to get the actual secret ID. Note: tokens can only be unwrapped once; distribute them individually to Kong nodes. Default: false
- resurrect
Ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role
Id string - Specifies the AppRole role ID in HashiCorp Vault.
Either
role_idorsecret_id_filemust be set. - secret
Id string - Defines the AppRole’s secret ID in HashiCorp Vault.
- secret
Id stringFile - Path to a file containing the AppRole secret ID.
Either
role_idorsecret_id_filemust be set. - ssl
Verify boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host str
- The hostname of your HashiCorp vault. Not Null
- kv str
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount str
- The mount point. Default: "secret"
- namespace str
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg_
ttl float - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- path str
- Path for enabling the AppRole auth method. Single leading/trailing slashes are trimmed. Default: "approle"
- port float
- The port number of your HashiCorp vault. Not Null
- protocol str
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- response_
wrapping bool - Whether the secret ID is a response-wrapping token. When true, Kong unwraps the token to get the actual secret ID. Note: tokens can only be unwrapped once; distribute them individually to Kong nodes. Default: false
- resurrect_
ttl float - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role_
id str - Specifies the AppRole role ID in HashiCorp Vault.
Either
role_idorsecret_id_filemust be set. - secret_
id str - Defines the AppRole’s secret ID in HashiCorp Vault.
- secret_
id_ strfile - Path to a file containing the AppRole secret ID.
Either
role_idorsecret_id_filemust be set. - ssl_
verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl float
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host String
- The hostname of your HashiCorp vault. Not Null
- kv String
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount String
- The mount point. Default: "secret"
- namespace String
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl Number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- path String
- Path for enabling the AppRole auth method. Single leading/trailing slashes are trimmed. Default: "approle"
- port Number
- The port number of your HashiCorp vault. Not Null
- protocol String
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- response
Wrapping Boolean - Whether the secret ID is a response-wrapping token. When true, Kong unwraps the token to get the actual secret ID. Note: tokens can only be unwrapped once; distribute them individually to Kong nodes. Default: false
- resurrect
Ttl Number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role
Id String - Specifies the AppRole role ID in HashiCorp Vault.
Either
role_idorsecret_id_filemust be set. - secret
Id String - Defines the AppRole’s secret ID in HashiCorp Vault.
- secret
Id StringFile - Path to a file containing the AppRole secret ID.
Either
role_idorsecret_id_filemust be set. - ssl
Verify Boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl Number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
AiGatewayVaultHcvConfigAwsEc2, AiGatewayVaultHcvConfigAwsEc2Args
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Host string
- The hostname of your HashiCorp vault. Not Null
- Kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- Login
Path string - The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
- Mount string
- The mount point. Default: "secret"
- Namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- Neg
Ttl double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Nonce string
- The nonce for AWS EC2 auth. Not Null
- Port double
- The port number of your HashiCorp vault. Not Null
- Protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- Resurrect
Ttl double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Role string
- The role to use for AWS EC2 auth. Not Null
- Ssl
Verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- Ttl double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Host string
- The hostname of your HashiCorp vault. Not Null
- Kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- Login
Path string - The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
- Mount string
- The mount point. Default: "secret"
- Namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- Neg
Ttl float64 - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Nonce string
- The nonce for AWS EC2 auth. Not Null
- Port float64
- The port number of your HashiCorp vault. Not Null
- Protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- Resurrect
Ttl float64 - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Role string
- The role to use for AWS EC2 auth. Not Null
- Ssl
Verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- Ttl float64
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host string
- The hostname of your HashiCorp vault. Not Null
- kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- login_
path string - The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
- mount string
- The mount point. Default: "secret"
- namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg_
ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- nonce string
- The nonce for AWS EC2 auth. Not Null
- port number
- The port number of your HashiCorp vault. Not Null
- protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect_
ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role string
- The role to use for AWS EC2 auth. Not Null
- ssl_
verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host String
- The hostname of your HashiCorp vault. Not Null
- kv String
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- login
Path String - The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
- mount String
- The mount point. Default: "secret"
- namespace String
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl Double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- nonce String
- The nonce for AWS EC2 auth. Not Null
- port Double
- The port number of your HashiCorp vault. Not Null
- protocol String
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl Double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role String
- The role to use for AWS EC2 auth. Not Null
- ssl
Verify Boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl Double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host string
- The hostname of your HashiCorp vault. Not Null
- kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- login
Path string - The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
- mount string
- The mount point. Default: "secret"
- namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- nonce string
- The nonce for AWS EC2 auth. Not Null
- port number
- The port number of your HashiCorp vault. Not Null
- protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role string
- The role to use for AWS EC2 auth. Not Null
- ssl
Verify boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host str
- The hostname of your HashiCorp vault. Not Null
- kv str
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- login_
path str - The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
- mount str
- The mount point. Default: "secret"
- namespace str
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg_
ttl float - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- nonce str
- The nonce for AWS EC2 auth. Not Null
- port float
- The port number of your HashiCorp vault. Not Null
- protocol str
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect_
ttl float - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role str
- The role to use for AWS EC2 auth. Not Null
- ssl_
verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl float
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host String
- The hostname of your HashiCorp vault. Not Null
- kv String
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- login
Path String - The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
- mount String
- The mount point. Default: "secret"
- namespace String
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl Number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- nonce String
- The nonce for AWS EC2 auth. Not Null
- port Number
- The port number of your HashiCorp vault. Not Null
- protocol String
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl Number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role String
- The role to use for AWS EC2 auth. Not Null
- ssl
Verify Boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl Number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
AiGatewayVaultHcvConfigAwsIam, AiGatewayVaultHcvConfigAwsIamArgs
- Access
Key stringId - The AWS access key ID for IAM auth. If not provided, the default credentials provider chain is used.
If set,
secret_access_keymust also be set. - Assume
Role stringArn - The ARN of the role to assume for AWS IAM authentication.
If set,
role_session_namemust also be set. - Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Host string
- The hostname of your HashiCorp vault. Not Null
- Kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- Login
Path string - The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
- Mount string
- The mount point. Default: "secret"
- Namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- Neg
Ttl double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Port double
- The port number of your HashiCorp vault. Not Null
- Protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- Region string
- The AWS region for auth. Not Null
- Resurrect
Ttl double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Role string
- The role to use for AWS IAM auth. Not Null
- Role
Session stringName - The session name to use when assuming a role for AWS IAM authentication.
If set,
assume_role_arnmust also be set. - Secret
Access stringKey - The AWS secret access key for IAM auth. If not provided, the default credentials provider chain is used.
If set,
access_key_idmust also be set. - Ssl
Verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- Sts
Endpoint stringUrl - The AWS STS endpoint URL used by Kong Gateway when signing the GetCallerIdentity request for AWS IAM authentication. If not provided, defaults to the standard STS endpoint for the specified region. This setting only affects the STS endpoint that Kong Gateway itself contacts - it does not influence which STS endpoint HashiCorp Vault uses on its side.
- Ttl double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- Access
Key stringId - The AWS access key ID for IAM auth. If not provided, the default credentials provider chain is used.
If set,
secret_access_keymust also be set. - Assume
Role stringArn - The ARN of the role to assume for AWS IAM authentication.
If set,
role_session_namemust also be set. - Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Host string
- The hostname of your HashiCorp vault. Not Null
- Kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- Login
Path string - The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
- Mount string
- The mount point. Default: "secret"
- Namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- Neg
Ttl float64 - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Port float64
- The port number of your HashiCorp vault. Not Null
- Protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- Region string
- The AWS region for auth. Not Null
- Resurrect
Ttl float64 - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Role string
- The role to use for AWS IAM auth. Not Null
- Role
Session stringName - The session name to use when assuming a role for AWS IAM authentication.
If set,
assume_role_arnmust also be set. - Secret
Access stringKey - The AWS secret access key for IAM auth. If not provided, the default credentials provider chain is used.
If set,
access_key_idmust also be set. - Ssl
Verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- Sts
Endpoint stringUrl - The AWS STS endpoint URL used by Kong Gateway when signing the GetCallerIdentity request for AWS IAM authentication. If not provided, defaults to the standard STS endpoint for the specified region. This setting only affects the STS endpoint that Kong Gateway itself contacts - it does not influence which STS endpoint HashiCorp Vault uses on its side.
- Ttl float64
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- access_
key_ stringid - The AWS access key ID for IAM auth. If not provided, the default credentials provider chain is used.
If set,
secret_access_keymust also be set. - assume_
role_ stringarn - The ARN of the role to assume for AWS IAM authentication.
If set,
role_session_namemust also be set. - base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host string
- The hostname of your HashiCorp vault. Not Null
- kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- login_
path string - The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
- mount string
- The mount point. Default: "secret"
- namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg_
ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port number
- The port number of your HashiCorp vault. Not Null
- protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- region string
- The AWS region for auth. Not Null
- resurrect_
ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role string
- The role to use for AWS IAM auth. Not Null
- role_
session_ stringname - The session name to use when assuming a role for AWS IAM authentication.
If set,
assume_role_arnmust also be set. - secret_
access_ stringkey - The AWS secret access key for IAM auth. If not provided, the default credentials provider chain is used.
If set,
access_key_idmust also be set. - ssl_
verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- sts_
endpoint_ stringurl - The AWS STS endpoint URL used by Kong Gateway when signing the GetCallerIdentity request for AWS IAM authentication. If not provided, defaults to the standard STS endpoint for the specified region. This setting only affects the STS endpoint that Kong Gateway itself contacts - it does not influence which STS endpoint HashiCorp Vault uses on its side.
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- access
Key StringId - The AWS access key ID for IAM auth. If not provided, the default credentials provider chain is used.
If set,
secret_access_keymust also be set. - assume
Role StringArn - The ARN of the role to assume for AWS IAM authentication.
If set,
role_session_namemust also be set. - base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host String
- The hostname of your HashiCorp vault. Not Null
- kv String
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- login
Path String - The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
- mount String
- The mount point. Default: "secret"
- namespace String
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl Double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port Double
- The port number of your HashiCorp vault. Not Null
- protocol String
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- region String
- The AWS region for auth. Not Null
- resurrect
Ttl Double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role String
- The role to use for AWS IAM auth. Not Null
- role
Session StringName - The session name to use when assuming a role for AWS IAM authentication.
If set,
assume_role_arnmust also be set. - secret
Access StringKey - The AWS secret access key for IAM auth. If not provided, the default credentials provider chain is used.
If set,
access_key_idmust also be set. - ssl
Verify Boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- sts
Endpoint StringUrl - The AWS STS endpoint URL used by Kong Gateway when signing the GetCallerIdentity request for AWS IAM authentication. If not provided, defaults to the standard STS endpoint for the specified region. This setting only affects the STS endpoint that Kong Gateway itself contacts - it does not influence which STS endpoint HashiCorp Vault uses on its side.
- ttl Double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- access
Key stringId - The AWS access key ID for IAM auth. If not provided, the default credentials provider chain is used.
If set,
secret_access_keymust also be set. - assume
Role stringArn - The ARN of the role to assume for AWS IAM authentication.
If set,
role_session_namemust also be set. - base64Decode boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host string
- The hostname of your HashiCorp vault. Not Null
- kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- login
Path string - The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
- mount string
- The mount point. Default: "secret"
- namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port number
- The port number of your HashiCorp vault. Not Null
- protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- region string
- The AWS region for auth. Not Null
- resurrect
Ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role string
- The role to use for AWS IAM auth. Not Null
- role
Session stringName - The session name to use when assuming a role for AWS IAM authentication.
If set,
assume_role_arnmust also be set. - secret
Access stringKey - The AWS secret access key for IAM auth. If not provided, the default credentials provider chain is used.
If set,
access_key_idmust also be set. - ssl
Verify boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- sts
Endpoint stringUrl - The AWS STS endpoint URL used by Kong Gateway when signing the GetCallerIdentity request for AWS IAM authentication. If not provided, defaults to the standard STS endpoint for the specified region. This setting only affects the STS endpoint that Kong Gateway itself contacts - it does not influence which STS endpoint HashiCorp Vault uses on its side.
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- access_
key_ strid - The AWS access key ID for IAM auth. If not provided, the default credentials provider chain is used.
If set,
secret_access_keymust also be set. - assume_
role_ strarn - The ARN of the role to assume for AWS IAM authentication.
If set,
role_session_namemust also be set. - base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host str
- The hostname of your HashiCorp vault. Not Null
- kv str
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- login_
path str - The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
- mount str
- The mount point. Default: "secret"
- namespace str
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg_
ttl float - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port float
- The port number of your HashiCorp vault. Not Null
- protocol str
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- region str
- The AWS region for auth. Not Null
- resurrect_
ttl float - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role str
- The role to use for AWS IAM auth. Not Null
- role_
session_ strname - The session name to use when assuming a role for AWS IAM authentication.
If set,
assume_role_arnmust also be set. - secret_
access_ strkey - The AWS secret access key for IAM auth. If not provided, the default credentials provider chain is used.
If set,
access_key_idmust also be set. - ssl_
verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- sts_
endpoint_ strurl - The AWS STS endpoint URL used by Kong Gateway when signing the GetCallerIdentity request for AWS IAM authentication. If not provided, defaults to the standard STS endpoint for the specified region. This setting only affects the STS endpoint that Kong Gateway itself contacts - it does not influence which STS endpoint HashiCorp Vault uses on its side.
- ttl float
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- access
Key StringId - The AWS access key ID for IAM auth. If not provided, the default credentials provider chain is used.
If set,
secret_access_keymust also be set. - assume
Role StringArn - The ARN of the role to assume for AWS IAM authentication.
If set,
role_session_namemust also be set. - base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host String
- The hostname of your HashiCorp vault. Not Null
- kv String
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- login
Path String - The login path for AWS auth in HashiCorp Vault. Default: "/v1/auth/aws/login"
- mount String
- The mount point. Default: "secret"
- namespace String
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl Number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port Number
- The port number of your HashiCorp vault. Not Null
- protocol String
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- region String
- The AWS region for auth. Not Null
- resurrect
Ttl Number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role String
- The role to use for AWS IAM auth. Not Null
- role
Session StringName - The session name to use when assuming a role for AWS IAM authentication.
If set,
assume_role_arnmust also be set. - secret
Access StringKey - The AWS secret access key for IAM auth. If not provided, the default credentials provider chain is used.
If set,
access_key_idmust also be set. - ssl
Verify Boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- sts
Endpoint StringUrl - The AWS STS endpoint URL used by Kong Gateway when signing the GetCallerIdentity request for AWS IAM authentication. If not provided, defaults to the standard STS endpoint for the specified region. This setting only affects the STS endpoint that Kong Gateway itself contacts - it does not influence which STS endpoint HashiCorp Vault uses on its side.
- ttl Number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
AiGatewayVaultHcvConfigAzure, AiGatewayVaultHcvConfigAzureArgs
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Host string
- The hostname of your HashiCorp vault. Not Null
- Kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- Login
Path string - The login path for Azure auth in HashiCorp Vault. Default: "/v1/auth/azure/login"
- Mount string
- The mount point. Default: "secret"
- Namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- Neg
Ttl double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Port double
- The port number of your HashiCorp vault. Not Null
- Protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- Resurrect
Ttl double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Role string
- The role to use for Azure auth. Not Null
- Ssl
Verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- Ttl double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Host string
- The hostname of your HashiCorp vault. Not Null
- Kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- Login
Path string - The login path for Azure auth in HashiCorp Vault. Default: "/v1/auth/azure/login"
- Mount string
- The mount point. Default: "secret"
- Namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- Neg
Ttl float64 - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Port float64
- The port number of your HashiCorp vault. Not Null
- Protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- Resurrect
Ttl float64 - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Role string
- The role to use for Azure auth. Not Null
- Ssl
Verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- Ttl float64
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host string
- The hostname of your HashiCorp vault. Not Null
- kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- login_
path string - The login path for Azure auth in HashiCorp Vault. Default: "/v1/auth/azure/login"
- mount string
- The mount point. Default: "secret"
- namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg_
ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port number
- The port number of your HashiCorp vault. Not Null
- protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect_
ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role string
- The role to use for Azure auth. Not Null
- ssl_
verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host String
- The hostname of your HashiCorp vault. Not Null
- kv String
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- login
Path String - The login path for Azure auth in HashiCorp Vault. Default: "/v1/auth/azure/login"
- mount String
- The mount point. Default: "secret"
- namespace String
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl Double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port Double
- The port number of your HashiCorp vault. Not Null
- protocol String
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl Double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role String
- The role to use for Azure auth. Not Null
- ssl
Verify Boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl Double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host string
- The hostname of your HashiCorp vault. Not Null
- kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- login
Path string - The login path for Azure auth in HashiCorp Vault. Default: "/v1/auth/azure/login"
- mount string
- The mount point. Default: "secret"
- namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port number
- The port number of your HashiCorp vault. Not Null
- protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role string
- The role to use for Azure auth. Not Null
- ssl
Verify boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host str
- The hostname of your HashiCorp vault. Not Null
- kv str
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- login_
path str - The login path for Azure auth in HashiCorp Vault. Default: "/v1/auth/azure/login"
- mount str
- The mount point. Default: "secret"
- namespace str
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg_
ttl float - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port float
- The port number of your HashiCorp vault. Not Null
- protocol str
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect_
ttl float - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role str
- The role to use for Azure auth. Not Null
- ssl_
verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl float
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host String
- The hostname of your HashiCorp vault. Not Null
- kv String
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- login
Path String - The login path for Azure auth in HashiCorp Vault. Default: "/v1/auth/azure/login"
- mount String
- The mount point. Default: "secret"
- namespace String
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl Number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port Number
- The port number of your HashiCorp vault. Not Null
- protocol String
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl Number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role String
- The role to use for Azure auth. Not Null
- ssl
Verify Boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl Number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
AiGatewayVaultHcvConfigCert, AiGatewayVaultHcvConfigCertArgs
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Cert string
- The client certificate. Not Null
- Host string
- The hostname of your HashiCorp vault. Not Null
- Key string
- The key for the client certificate.
- Kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- Mount string
- The mount point. Default: "secret"
- Namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- Neg
Ttl double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Port double
- The port number of your HashiCorp vault. Not Null
- Protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- Resurrect
Ttl double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Role
Name string - The trusted certificate role name.
- Ssl
Verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- Ttl double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Cert string
- The client certificate. Not Null
- Host string
- The hostname of your HashiCorp vault. Not Null
- Key string
- The key for the client certificate.
- Kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- Mount string
- The mount point. Default: "secret"
- Namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- Neg
Ttl float64 - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Port float64
- The port number of your HashiCorp vault. Not Null
- Protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- Resurrect
Ttl float64 - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Role
Name string - The trusted certificate role name.
- Ssl
Verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- Ttl float64
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- cert string
- The client certificate. Not Null
- host string
- The hostname of your HashiCorp vault. Not Null
- key string
- The key for the client certificate.
- kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount string
- The mount point. Default: "secret"
- namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg_
ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port number
- The port number of your HashiCorp vault. Not Null
- protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect_
ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role_
name string - The trusted certificate role name.
- ssl_
verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- cert String
- The client certificate. Not Null
- host String
- The hostname of your HashiCorp vault. Not Null
- key String
- The key for the client certificate.
- kv String
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount String
- The mount point. Default: "secret"
- namespace String
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl Double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port Double
- The port number of your HashiCorp vault. Not Null
- protocol String
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl Double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role
Name String - The trusted certificate role name.
- ssl
Verify Boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl Double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- cert string
- The client certificate. Not Null
- host string
- The hostname of your HashiCorp vault. Not Null
- key string
- The key for the client certificate.
- kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount string
- The mount point. Default: "secret"
- namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port number
- The port number of your HashiCorp vault. Not Null
- protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role
Name string - The trusted certificate role name.
- ssl
Verify boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- cert str
- The client certificate. Not Null
- host str
- The hostname of your HashiCorp vault. Not Null
- key str
- The key for the client certificate.
- kv str
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount str
- The mount point. Default: "secret"
- namespace str
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg_
ttl float - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port float
- The port number of your HashiCorp vault. Not Null
- protocol str
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect_
ttl float - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role_
name str - The trusted certificate role name.
- ssl_
verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl float
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- cert String
- The client certificate. Not Null
- host String
- The hostname of your HashiCorp vault. Not Null
- key String
- The key for the client certificate.
- kv String
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount String
- The mount point. Default: "secret"
- namespace String
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl Number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port Number
- The port number of your HashiCorp vault. Not Null
- protocol String
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl Number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role
Name String - The trusted certificate role name.
- ssl
Verify Boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl Number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
AiGatewayVaultHcvConfigGcpGce, AiGatewayVaultHcvConfigGcpGceArgs
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Host string
- The hostname of your HashiCorp vault. Not Null
- Kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- Login
Path string - The login path for GCP auth in HashiCorp Vault. Default: "/v1/auth/gcp/login"
- Mount string
- The mount point. Default: "secret"
- Namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- Neg
Ttl double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Port double
- The port number of your HashiCorp vault. Not Null
- Protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- Resurrect
Ttl double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Role string
- The role to use for GCP GCE auth. Not Null
- Ssl
Verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- Ttl double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Host string
- The hostname of your HashiCorp vault. Not Null
- Kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- Login
Path string - The login path for GCP auth in HashiCorp Vault. Default: "/v1/auth/gcp/login"
- Mount string
- The mount point. Default: "secret"
- Namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- Neg
Ttl float64 - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Port float64
- The port number of your HashiCorp vault. Not Null
- Protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- Resurrect
Ttl float64 - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Role string
- The role to use for GCP GCE auth. Not Null
- Ssl
Verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- Ttl float64
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host string
- The hostname of your HashiCorp vault. Not Null
- kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- login_
path string - The login path for GCP auth in HashiCorp Vault. Default: "/v1/auth/gcp/login"
- mount string
- The mount point. Default: "secret"
- namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg_
ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port number
- The port number of your HashiCorp vault. Not Null
- protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect_
ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role string
- The role to use for GCP GCE auth. Not Null
- ssl_
verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host String
- The hostname of your HashiCorp vault. Not Null
- kv String
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- login
Path String - The login path for GCP auth in HashiCorp Vault. Default: "/v1/auth/gcp/login"
- mount String
- The mount point. Default: "secret"
- namespace String
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl Double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port Double
- The port number of your HashiCorp vault. Not Null
- protocol String
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl Double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role String
- The role to use for GCP GCE auth. Not Null
- ssl
Verify Boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl Double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host string
- The hostname of your HashiCorp vault. Not Null
- kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- login
Path string - The login path for GCP auth in HashiCorp Vault. Default: "/v1/auth/gcp/login"
- mount string
- The mount point. Default: "secret"
- namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port number
- The port number of your HashiCorp vault. Not Null
- protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role string
- The role to use for GCP GCE auth. Not Null
- ssl
Verify boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host str
- The hostname of your HashiCorp vault. Not Null
- kv str
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- login_
path str - The login path for GCP auth in HashiCorp Vault. Default: "/v1/auth/gcp/login"
- mount str
- The mount point. Default: "secret"
- namespace str
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg_
ttl float - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port float
- The port number of your HashiCorp vault. Not Null
- protocol str
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect_
ttl float - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role str
- The role to use for GCP GCE auth. Not Null
- ssl_
verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl float
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host String
- The hostname of your HashiCorp vault. Not Null
- kv String
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- login
Path String - The login path for GCP auth in HashiCorp Vault. Default: "/v1/auth/gcp/login"
- mount String
- The mount point. Default: "secret"
- namespace String
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl Number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port Number
- The port number of your HashiCorp vault. Not Null
- protocol String
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl Number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role String
- The role to use for GCP GCE auth. Not Null
- ssl
Verify Boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl Number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
AiGatewayVaultHcvConfigGcpIam, AiGatewayVaultHcvConfigGcpIamArgs
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Host string
- The hostname of your HashiCorp vault. Not Null
- Jwt
Exp double - The JWT expiration time in seconds for GCP auth (0-900). Not Null
- Kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- Mount string
- The mount point. Default: "secret"
- Namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- Neg
Ttl double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Port double
- The port number of your HashiCorp vault. Not Null
- Protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- Resurrect
Ttl double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Role string
- The role to use for GCP IAM auth. Not Null
- Service
Account string - The GCP service account for GCE auth. Not Null
- Ssl
Verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- Ttl double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Host string
- The hostname of your HashiCorp vault. Not Null
- Jwt
Exp float64 - The JWT expiration time in seconds for GCP auth (0-900). Not Null
- Kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- Mount string
- The mount point. Default: "secret"
- Namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- Neg
Ttl float64 - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Port float64
- The port number of your HashiCorp vault. Not Null
- Protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- Resurrect
Ttl float64 - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Role string
- The role to use for GCP IAM auth. Not Null
- Service
Account string - The GCP service account for GCE auth. Not Null
- Ssl
Verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- Ttl float64
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host string
- The hostname of your HashiCorp vault. Not Null
- jwt_
exp number - The JWT expiration time in seconds for GCP auth (0-900). Not Null
- kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount string
- The mount point. Default: "secret"
- namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg_
ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port number
- The port number of your HashiCorp vault. Not Null
- protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect_
ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role string
- The role to use for GCP IAM auth. Not Null
- service_
account string - The GCP service account for GCE auth. Not Null
- ssl_
verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host String
- The hostname of your HashiCorp vault. Not Null
- jwt
Exp Double - The JWT expiration time in seconds for GCP auth (0-900). Not Null
- kv String
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount String
- The mount point. Default: "secret"
- namespace String
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl Double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port Double
- The port number of your HashiCorp vault. Not Null
- protocol String
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl Double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role String
- The role to use for GCP IAM auth. Not Null
- service
Account String - The GCP service account for GCE auth. Not Null
- ssl
Verify Boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl Double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host string
- The hostname of your HashiCorp vault. Not Null
- jwt
Exp number - The JWT expiration time in seconds for GCP auth (0-900). Not Null
- kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount string
- The mount point. Default: "secret"
- namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port number
- The port number of your HashiCorp vault. Not Null
- protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role string
- The role to use for GCP IAM auth. Not Null
- service
Account string - The GCP service account for GCE auth. Not Null
- ssl
Verify boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host str
- The hostname of your HashiCorp vault. Not Null
- jwt_
exp float - The JWT expiration time in seconds for GCP auth (0-900). Not Null
- kv str
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount str
- The mount point. Default: "secret"
- namespace str
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg_
ttl float - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port float
- The port number of your HashiCorp vault. Not Null
- protocol str
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect_
ttl float - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role str
- The role to use for GCP IAM auth. Not Null
- service_
account str - The GCP service account for GCE auth. Not Null
- ssl_
verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl float
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host String
- The hostname of your HashiCorp vault. Not Null
- jwt
Exp Number - The JWT expiration time in seconds for GCP auth (0-900). Not Null
- kv String
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount String
- The mount point. Default: "secret"
- namespace String
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl Number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port Number
- The port number of your HashiCorp vault. Not Null
- protocol String
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl Number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role String
- The role to use for GCP IAM auth. Not Null
- service
Account String - The GCP service account for GCE auth. Not Null
- ssl
Verify Boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl Number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
AiGatewayVaultHcvConfigJwt, AiGatewayVaultHcvConfigJwtArgs
- Audiences string
- Comma-separated list of OAuth2 audiences.
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Client
Id string - The OAuth2 client ID. Not Null
- Client
Secret string - The OAuth2 client secret.
- Host string
- The hostname of your HashiCorp vault. Not Null
- Kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- Mount string
- The mount point. Default: "secret"
- Namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- Neg
Ttl double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Port double
- The port number of your HashiCorp vault. Not Null
- Protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- Resurrect
Ttl double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Role string
- The configured role name in HashiCorp Vault for JWT auth.
When creating the role in HashiCorp Vault, make sure that the
role_typeisjwtand thetoken_policieshave permissions to read the secrets. Not Null - Ssl
Verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- Token
Endpoint string - Ttl double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- Audiences string
- Comma-separated list of OAuth2 audiences.
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Client
Id string - The OAuth2 client ID. Not Null
- Client
Secret string - The OAuth2 client secret.
- Host string
- The hostname of your HashiCorp vault. Not Null
- Kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- Mount string
- The mount point. Default: "secret"
- Namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- Neg
Ttl float64 - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Port float64
- The port number of your HashiCorp vault. Not Null
- Protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- Resurrect
Ttl float64 - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Role string
- The configured role name in HashiCorp Vault for JWT auth.
When creating the role in HashiCorp Vault, make sure that the
role_typeisjwtand thetoken_policieshave permissions to read the secrets. Not Null - Ssl
Verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- Token
Endpoint string - Ttl float64
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- audiences string
- Comma-separated list of OAuth2 audiences.
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- client_
id string - The OAuth2 client ID. Not Null
- client_
secret string - The OAuth2 client secret.
- host string
- The hostname of your HashiCorp vault. Not Null
- kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount string
- The mount point. Default: "secret"
- namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg_
ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port number
- The port number of your HashiCorp vault. Not Null
- protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect_
ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role string
- The configured role name in HashiCorp Vault for JWT auth.
When creating the role in HashiCorp Vault, make sure that the
role_typeisjwtand thetoken_policieshave permissions to read the secrets. Not Null - ssl_
verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- token_
endpoint string - ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- audiences String
- Comma-separated list of OAuth2 audiences.
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- client
Id String - The OAuth2 client ID. Not Null
- client
Secret String - The OAuth2 client secret.
- host String
- The hostname of your HashiCorp vault. Not Null
- kv String
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount String
- The mount point. Default: "secret"
- namespace String
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl Double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port Double
- The port number of your HashiCorp vault. Not Null
- protocol String
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl Double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role String
- The configured role name in HashiCorp Vault for JWT auth.
When creating the role in HashiCorp Vault, make sure that the
role_typeisjwtand thetoken_policieshave permissions to read the secrets. Not Null - ssl
Verify Boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- token
Endpoint String - ttl Double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- audiences string
- Comma-separated list of OAuth2 audiences.
- base64Decode boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- client
Id string - The OAuth2 client ID. Not Null
- client
Secret string - The OAuth2 client secret.
- host string
- The hostname of your HashiCorp vault. Not Null
- kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount string
- The mount point. Default: "secret"
- namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port number
- The port number of your HashiCorp vault. Not Null
- protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role string
- The configured role name in HashiCorp Vault for JWT auth.
When creating the role in HashiCorp Vault, make sure that the
role_typeisjwtand thetoken_policieshave permissions to read the secrets. Not Null - ssl
Verify boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- token
Endpoint string - ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- audiences str
- Comma-separated list of OAuth2 audiences.
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- client_
id str - The OAuth2 client ID. Not Null
- client_
secret str - The OAuth2 client secret.
- host str
- The hostname of your HashiCorp vault. Not Null
- kv str
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount str
- The mount point. Default: "secret"
- namespace str
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg_
ttl float - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port float
- The port number of your HashiCorp vault. Not Null
- protocol str
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect_
ttl float - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role str
- The configured role name in HashiCorp Vault for JWT auth.
When creating the role in HashiCorp Vault, make sure that the
role_typeisjwtand thetoken_policieshave permissions to read the secrets. Not Null - ssl_
verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- token_
endpoint str - ttl float
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- audiences String
- Comma-separated list of OAuth2 audiences.
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- client
Id String - The OAuth2 client ID. Not Null
- client
Secret String - The OAuth2 client secret.
- host String
- The hostname of your HashiCorp vault. Not Null
- kv String
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount String
- The mount point. Default: "secret"
- namespace String
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl Number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port Number
- The port number of your HashiCorp vault. Not Null
- protocol String
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl Number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role String
- The configured role name in HashiCorp Vault for JWT auth.
When creating the role in HashiCorp Vault, make sure that the
role_typeisjwtand thetoken_policieshave permissions to read the secrets. Not Null - ssl
Verify Boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- token
Endpoint String - ttl Number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
AiGatewayVaultHcvConfigKubernetes, AiGatewayVaultHcvConfigKubernetesArgs
- Api
Token stringFile - Path to the Kubernetes service account token file. Default: "/run/secrets/kubernetes.io/serviceaccount/token"
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Host string
- The hostname of your HashiCorp vault. Not Null
- Kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- Mount string
- The mount point. Default: "secret"
- Namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- Neg
Ttl double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Path string
- Path for enabling the Kubernetes auth method. Single leading/trailing slashes are trimmed. Default: "kubernetes"
- Port double
- The port number of your HashiCorp vault. Not Null
- Protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- Resurrect
Ttl double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Role string
- Role assigned to the Kubernetes service account.
- Ssl
Verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- Ttl double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- Api
Token stringFile - Path to the Kubernetes service account token file. Default: "/run/secrets/kubernetes.io/serviceaccount/token"
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Host string
- The hostname of your HashiCorp vault. Not Null
- Kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- Mount string
- The mount point. Default: "secret"
- Namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- Neg
Ttl float64 - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Path string
- Path for enabling the Kubernetes auth method. Single leading/trailing slashes are trimmed. Default: "kubernetes"
- Port float64
- The port number of your HashiCorp vault. Not Null
- Protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- Resurrect
Ttl float64 - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Role string
- Role assigned to the Kubernetes service account.
- Ssl
Verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- Ttl float64
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- api_
token_ stringfile - Path to the Kubernetes service account token file. Default: "/run/secrets/kubernetes.io/serviceaccount/token"
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host string
- The hostname of your HashiCorp vault. Not Null
- kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount string
- The mount point. Default: "secret"
- namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg_
ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- path string
- Path for enabling the Kubernetes auth method. Single leading/trailing slashes are trimmed. Default: "kubernetes"
- port number
- The port number of your HashiCorp vault. Not Null
- protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect_
ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role string
- Role assigned to the Kubernetes service account.
- ssl_
verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- api
Token StringFile - Path to the Kubernetes service account token file. Default: "/run/secrets/kubernetes.io/serviceaccount/token"
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host String
- The hostname of your HashiCorp vault. Not Null
- kv String
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount String
- The mount point. Default: "secret"
- namespace String
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl Double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- path String
- Path for enabling the Kubernetes auth method. Single leading/trailing slashes are trimmed. Default: "kubernetes"
- port Double
- The port number of your HashiCorp vault. Not Null
- protocol String
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl Double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role String
- Role assigned to the Kubernetes service account.
- ssl
Verify Boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl Double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- api
Token stringFile - Path to the Kubernetes service account token file. Default: "/run/secrets/kubernetes.io/serviceaccount/token"
- base64Decode boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host string
- The hostname of your HashiCorp vault. Not Null
- kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount string
- The mount point. Default: "secret"
- namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- path string
- Path for enabling the Kubernetes auth method. Single leading/trailing slashes are trimmed. Default: "kubernetes"
- port number
- The port number of your HashiCorp vault. Not Null
- protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role string
- Role assigned to the Kubernetes service account.
- ssl
Verify boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- api_
token_ strfile - Path to the Kubernetes service account token file. Default: "/run/secrets/kubernetes.io/serviceaccount/token"
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host str
- The hostname of your HashiCorp vault. Not Null
- kv str
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount str
- The mount point. Default: "secret"
- namespace str
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg_
ttl float - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- path str
- Path for enabling the Kubernetes auth method. Single leading/trailing slashes are trimmed. Default: "kubernetes"
- port float
- The port number of your HashiCorp vault. Not Null
- protocol str
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect_
ttl float - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role str
- Role assigned to the Kubernetes service account.
- ssl_
verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl float
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- api
Token StringFile - Path to the Kubernetes service account token file. Default: "/run/secrets/kubernetes.io/serviceaccount/token"
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host String
- The hostname of your HashiCorp vault. Not Null
- kv String
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount String
- The mount point. Default: "secret"
- namespace String
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl Number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- path String
- Path for enabling the Kubernetes auth method. Single leading/trailing slashes are trimmed. Default: "kubernetes"
- port Number
- The port number of your HashiCorp vault. Not Null
- protocol String
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl Number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- role String
- Role assigned to the Kubernetes service account.
- ssl
Verify Boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- ttl Number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
AiGatewayVaultHcvConfigToken, AiGatewayVaultHcvConfigTokenArgs
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Host string
- The hostname of your HashiCorp vault. Not Null
- Kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- Mount string
- The mount point. Default: "secret"
- Namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- Neg
Ttl double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Port double
- The port number of your HashiCorp vault. Not Null
- Protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- Resurrect
Ttl double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Ssl
Verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- Token string
- The token string to be used for authentication.
- Ttl double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- Base64Decode bool
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- Host string
- The hostname of your HashiCorp vault. Not Null
- Kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- Mount string
- The mount point. Default: "secret"
- Namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- Neg
Ttl float64 - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- Port float64
- The port number of your HashiCorp vault. Not Null
- Protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- Resurrect
Ttl float64 - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- Ssl
Verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- Token string
- The token string to be used for authentication.
- Ttl float64
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host string
- The hostname of your HashiCorp vault. Not Null
- kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount string
- The mount point. Default: "secret"
- namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg_
ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port number
- The port number of your HashiCorp vault. Not Null
- protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect_
ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- ssl_
verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- token string
- The token string to be used for authentication.
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host String
- The hostname of your HashiCorp vault. Not Null
- kv String
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount String
- The mount point. Default: "secret"
- namespace String
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl Double - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port Double
- The port number of your HashiCorp vault. Not Null
- protocol String
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl Double - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- ssl
Verify Boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- token String
- The token string to be used for authentication.
- ttl Double
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host string
- The hostname of your HashiCorp vault. Not Null
- kv string
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount string
- The mount point. Default: "secret"
- namespace string
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port number
- The port number of your HashiCorp vault. Not Null
- protocol string
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- ssl
Verify boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- token string
- The token string to be used for authentication.
- ttl number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64_
decode bool - Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host str
- The hostname of your HashiCorp vault. Not Null
- kv str
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount str
- The mount point. Default: "secret"
- namespace str
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg_
ttl float - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port float
- The port number of your HashiCorp vault. Not Null
- protocol str
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect_
ttl float - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- ssl_
verify bool - Whether to verify the TLS certificate of the vault when connecting. Default: true
- token str
- The token string to be used for authentication.
- ttl float
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
- base64Decode Boolean
- Decode all secrets in this vault as base64. Useful for binary data. If some of the secrets in the vault are not base64-encoded, an error will occur when using them. We recommend creating a separate vault for base64 secrets.
- host String
- The hostname of your HashiCorp vault. Not Null
- kv String
- The secrets engine version. possible known values include one of ["v1", "v2"]; Default: "v1"
- mount String
- The mount point. Default: "secret"
- namespace String
- Namespace for the Vault. Vault Enterprise requires a namespace to connect successfully.
- neg
Ttl Number - Time-to-live (in seconds) for caching failed secret lookups. A value of 0 disables negative caching. Kong will retry fetching the secret after neg_ttl expires. Default: 0
- port Number
- The port number of your HashiCorp vault. Not Null
- protocol String
- The protocol to connect with. possible known values include one of ["http", "https"]; Default: "https"
- resurrect
Ttl Number - Time (in seconds) that secrets remain in use after expiration (config.ttl ends). Useful if the vault is unreachable or the secret is deleted but not yet replaced. Kong continues to retry for resurrect_ttl seconds before giving up. The default is ~3 years to support uninterrupted service during outages. Default: 100000000
- ssl
Verify Boolean - Whether to verify the TLS certificate of the vault when connecting. Default: true
- token String
- The token string to be used for authentication.
- ttl Number
- Time-to-live (in seconds) for a cached secret. A value of 0 disables rotation. For non-zero values, use a minimum of 60 seconds. Default: 0
AiGatewayVaultKonnect, AiGatewayVaultKonnectArgs
- Config
Ai
Gateway Vault Konnect Config - Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Description string
- The description of the Vault. Default: ""
- Id string
- Contains a unique identifier used for this resource.
- Labels Dictionary<string, string>
- Public labels store information about an entity that can be used for filtering a list of objects.
- Managed
By Dictionary<string, string> - Name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- Config
Ai
Gateway Vault Konnect Config - Not Null
- Created
At string - An ISO-8601 timestamp representation of entity creation date.
- Description string
- The description of the Vault. Default: ""
- Id string
- Contains a unique identifier used for this resource.
- Labels map[string]string
- Public labels store information about an entity that can be used for filtering a list of objects.
- Managed
By map[string]string - Name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- Updated
At string - An ISO-8601 timestamp representation of entity update date.
- config object
- Not Null
- created_
at string - An ISO-8601 timestamp representation of entity creation date.
- description string
- The description of the Vault. Default: ""
- id string
- Contains a unique identifier used for this resource.
- labels map(string)
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed_
by map(string) - name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated_
at string - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Vault Konnect Config - Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- description String
- The description of the Vault. Default: ""
- id String
- Contains a unique identifier used for this resource.
- labels Map<String,String>
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By Map<String,String> - name String
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Vault Konnect Config - Not Null
- created
At string - An ISO-8601 timestamp representation of entity creation date.
- description string
- The description of the Vault. Default: ""
- id string
- Contains a unique identifier used for this resource.
- labels {[key: string]: string}
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By {[key: string]: string} - name string
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At string - An ISO-8601 timestamp representation of entity update date.
- config
Ai
Gateway Vault Konnect Config - Not Null
- created_
at str - An ISO-8601 timestamp representation of entity creation date.
- description str
- The description of the Vault. Default: ""
- id str
- Contains a unique identifier used for this resource.
- labels Mapping[str, str]
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed_
by Mapping[str, str] - name str
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated_
at str - An ISO-8601 timestamp representation of entity update date.
- config Property Map
- Not Null
- created
At String - An ISO-8601 timestamp representation of entity creation date.
- description String
- The description of the Vault. Default: ""
- id String
- Contains a unique identifier used for this resource.
- labels Map<String>
- Public labels store information about an entity that can be used for filtering a list of objects.
- managed
By Map<String> - name String
- A user-defined unique identifier for this vault instance, used as a stable human-readable reference. This value is immutable after creation. The name is used to load the right Vault configuration and implementation when referencing secrets with the other entities.
- updated
At String - An ISO-8601 timestamp representation of entity update date.
AiGatewayVaultKonnectConfig, AiGatewayVaultKonnectConfigArgs
- Config
Store stringId - The ID of the Konnect Config Store that contains the secrets. Not Null
- Config
Store stringId - The ID of the Konnect Config Store that contains the secrets. Not Null
- config_
store_ stringid - The ID of the Konnect Config Store that contains the secrets. Not Null
- config
Store StringId - The ID of the Konnect Config Store that contains the secrets. Not Null
- config
Store stringId - The ID of the Konnect Config Store that contains the secrets. Not Null
- config_
store_ strid - The ID of the Konnect Config Store that contains the secrets. Not Null
- config
Store StringId - The ID of the Konnect Config Store that contains the secrets. Not Null
Import
In Terraform v1.5.0 and later, the import block can be used with the id attribute, for example:
terraform
import {
to = konnect_ai_gateway_vault.my_konnect_ai_gateway_vault
id = jsonencode({
gateway_id = "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7"
id = "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7"
})
}
The pulumi import command can be used, for example:
$ pulumi import konnect:index/aiGatewayVault:AiGatewayVault my_konnect_ai_gateway_vault '{"gateway_id": "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7", "id": "5f9fd312-a987-4628-b4c5-bb4f4fddd5f7"}'
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- konnect kong/terraform-provider-konnect
- License
- Notes
- This Pulumi package is based on the
konnectTerraform Provider.
published on Friday, Sep 18, 2026 by kong