Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. HashiCorp Vault Provider
  4. API Docs
  5. KerberosAuthBackendConfig
Viewing docs for HashiCorp Vault v7.12.0
published on Saturday, Aug 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

vault.KerberosAuthBackendConfig

vault logo vault logo
Viewing docs for HashiCorp Vault v7.12.0
published on Saturday, Aug 15, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-vault

    Manages the configuration of a Kerberos Auth Backend in Vault.

    This resource configures the Kerberos authentication method by providing the keytab and service account information required for Vault to authenticate users via Kerberos.

    For more information, see the Vault docs.

    Important The keytabWo field is write-only and is not stored in Terraform state. It is only sent to Vault when the keytabWoVersion changes or during initial creation. See the main provider documentation for more details.

    Note Vault does not support deleting auth backend configurations via the API. When this resource is destroyed or replaced (e.g., when changing the mount), it is only removed from Terraform state. The configuration remains in Vault until the auth mount itself is deleted.

    Example Usage

    Basic Configuration

    import * as pulumi from "@pulumi/pulumi";
import * as std from "@pulumi/std";
import * as vault from "@pulumi/vault";

const kerberos = new vault.AuthBackend("kerberos", {
    type: "kerberos",
    path: "kerberos",
});
const config = new vault.KerberosAuthBackendConfig("config", {
    mount: kerberos.path,
    keytabWo: std.filebase64({
        input: "/path/to/vault.keytab",
    }).then(invoke => invoke.result),
    keytabWoVersion: 1,
    serviceAccount: "vault/localhost@EXAMPLE.COM",
});

    import pulumi
import pulumi_std as std
import pulumi_vault as vault

kerberos = vault.AuthBackend("kerberos",
    type="kerberos",
    path="kerberos")
config = vault.KerberosAuthBackendConfig("config",
    mount=kerberos.path,
    keytab_wo=std.filebase64(input="/path/to/vault.keytab").result,
    keytab_wo_version=1,
    service_account="vault/localhost@EXAMPLE.COM")

    package main

import (
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		kerberos, err := vault.NewAuthBackend(ctx, "kerberos", &vault.AuthBackendArgs{
			Type: pulumi.String("kerberos"),
			Path: pulumi.String("kerberos"),
		})
		if err != nil {
			return err
		}
		invokeFilebase64, err := std.Filebase64(ctx, &std.Filebase64Args{
			Input: "/path/to/vault.keytab",
		}, nil)
		if err != nil {
			return err
		}
		_, err = vault.NewKerberosAuthBackendConfig(ctx, "config", &vault.KerberosAuthBackendConfigArgs{
			Mount:           kerberos.Path,
			KeytabWo:        pulumi.String(invokeFilebase64.Result),
			KeytabWoVersion: pulumi.Int(1),
			ServiceAccount:  pulumi.String("vault/localhost@EXAMPLE.COM"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Std = Pulumi.Std;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var kerberos = new Vault.AuthBackend("kerberos", new()
    {
        Type = "kerberos",
        Path = "kerberos",
    });

    var config = new Vault.KerberosAuthBackendConfig("config", new()
    {
        Mount = kerberos.Path,
        KeytabWo = Std.Filebase64.Invoke(new()
        {
            Input = "/path/to/vault.keytab",
        }).Apply(invoke => invoke.Result),
        KeytabWoVersion = 1,
        ServiceAccount = "vault/localhost@EXAMPLE.COM",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.AuthBackend;
import com.pulumi.vault.AuthBackendArgs;
import com.pulumi.vault.KerberosAuthBackendConfig;
import com.pulumi.vault.KerberosAuthBackendConfigArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.Filebase64Args;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var kerberos = new AuthBackend("kerberos", AuthBackendArgs.builder()
            .type("kerberos")
            .path("kerberos")
            .build());

        var config = new KerberosAuthBackendConfig("config", KerberosAuthBackendConfigArgs.builder()
            .mount(kerberos.path())
            .keytabWo(StdFunctions.filebase64(Filebase64Args.builder()
                .input("/path/to/vault.keytab")
                .build()).result())
            .keytabWoVersion(1)
            .serviceAccount("vault/localhost@EXAMPLE.COM")
            .build());

    }
}

    resources:
  kerberos:
    type: vault:AuthBackend
    properties:
      type: kerberos
      path: kerberos
  config:
    type: vault:KerberosAuthBackendConfig
    properties:
      mount: ${kerberos.path}
      keytabWo:
        fn::invoke:
          function: std:filebase64
          arguments:
            input: /path/to/vault.keytab
          return: result
      keytabWoVersion: 1
      serviceAccount: vault/localhost@EXAMPLE.COM

    pulumi {
  required_providers {
    std = {
      source = "pulumi/std"
    }
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_authbackend" "kerberos" {
  type = "kerberos"
  path = "kerberos"
}
resource "vault_kerberosauthbackendconfig" "config" {
  mount             = vault_authbackend.kerberos.path
  keytab_wo         = filebase64("/path/to/vault.keytab")
  keytab_wo_version = 1
  service_account   = "vault/localhost@EXAMPLE.COM"
}

    Full Configuration with All Options

    import * as pulumi from "@pulumi/pulumi";
import * as std from "@pulumi/std";
import * as vault from "@pulumi/vault";

const kerberos = new vault.AuthBackend("kerberos", {
    type: "kerberos",
    path: "kerberos",
});
const config = new vault.KerberosAuthBackendConfig("config", {
    mount: kerberos.path,
    keytabWo: std.filebase64({
        input: "/path/to/vault.keytab",
    }).then(invoke => invoke.result),
    keytabWoVersion: 1,
    serviceAccount: "vault/localhost@EXAMPLE.COM",
    removeInstanceName: true,
    addGroupAliases: true,
});

    import pulumi
import pulumi_std as std
import pulumi_vault as vault

kerberos = vault.AuthBackend("kerberos",
    type="kerberos",
    path="kerberos")
config = vault.KerberosAuthBackendConfig("config",
    mount=kerberos.path,
    keytab_wo=std.filebase64(input="/path/to/vault.keytab").result,
    keytab_wo_version=1,
    service_account="vault/localhost@EXAMPLE.COM",
    remove_instance_name=True,
    add_group_aliases=True)

    package main

import (
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		kerberos, err := vault.NewAuthBackend(ctx, "kerberos", &vault.AuthBackendArgs{
			Type: pulumi.String("kerberos"),
			Path: pulumi.String("kerberos"),
		})
		if err != nil {
			return err
		}
		invokeFilebase64, err := std.Filebase64(ctx, &std.Filebase64Args{
			Input: "/path/to/vault.keytab",
		}, nil)
		if err != nil {
			return err
		}
		_, err = vault.NewKerberosAuthBackendConfig(ctx, "config", &vault.KerberosAuthBackendConfigArgs{
			Mount:              kerberos.Path,
			KeytabWo:           pulumi.String(invokeFilebase64.Result),
			KeytabWoVersion:    pulumi.Int(1),
			ServiceAccount:     pulumi.String("vault/localhost@EXAMPLE.COM"),
			RemoveInstanceName: pulumi.Bool(true),
			AddGroupAliases:    pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Std = Pulumi.Std;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var kerberos = new Vault.AuthBackend("kerberos", new()
    {
        Type = "kerberos",
        Path = "kerberos",
    });

    var config = new Vault.KerberosAuthBackendConfig("config", new()
    {
        Mount = kerberos.Path,
        KeytabWo = Std.Filebase64.Invoke(new()
        {
            Input = "/path/to/vault.keytab",
        }).Apply(invoke => invoke.Result),
        KeytabWoVersion = 1,
        ServiceAccount = "vault/localhost@EXAMPLE.COM",
        RemoveInstanceName = true,
        AddGroupAliases = true,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.AuthBackend;
import com.pulumi.vault.AuthBackendArgs;
import com.pulumi.vault.KerberosAuthBackendConfig;
import com.pulumi.vault.KerberosAuthBackendConfigArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.Filebase64Args;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var kerberos = new AuthBackend("kerberos", AuthBackendArgs.builder()
            .type("kerberos")
            .path("kerberos")
            .build());

        var config = new KerberosAuthBackendConfig("config", KerberosAuthBackendConfigArgs.builder()
            .mount(kerberos.path())
            .keytabWo(StdFunctions.filebase64(Filebase64Args.builder()
                .input("/path/to/vault.keytab")
                .build()).result())
            .keytabWoVersion(1)
            .serviceAccount("vault/localhost@EXAMPLE.COM")
            .removeInstanceName(true)
            .addGroupAliases(true)
            .build());

    }
}

    resources:
  kerberos:
    type: vault:AuthBackend
    properties:
      type: kerberos
      path: kerberos
  config:
    type: vault:KerberosAuthBackendConfig
    properties:
      mount: ${kerberos.path}
      keytabWo:
        fn::invoke:
          function: std:filebase64
          arguments:
            input: /path/to/vault.keytab
          return: result
      keytabWoVersion: 1
      serviceAccount: vault/localhost@EXAMPLE.COM
      removeInstanceName: true
      addGroupAliases: true

    pulumi {
  required_providers {
    std = {
      source = "pulumi/std"
    }
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_authbackend" "kerberos" {
  type = "kerberos"
  path = "kerberos"
}
resource "vault_kerberosauthbackendconfig" "config" {
  mount                = vault_authbackend.kerberos.path
  keytab_wo            = filebase64("/path/to/vault.keytab")
  keytab_wo_version    = 1
  service_account      = "vault/localhost@EXAMPLE.COM"
  remove_instance_name = true
  add_group_aliases    = true
}

    Using Namespace (Vault Enterprise)

    import * as pulumi from "@pulumi/pulumi";
import * as std from "@pulumi/std";
import * as vault from "@pulumi/vault";

const example = new vault.Namespace("example", {path: "example-namespace"});
const kerberos = new vault.AuthBackend("kerberos", {
    namespace: example.path,
    type: "kerberos",
    path: "kerberos",
});
const config = new vault.KerberosAuthBackendConfig("config", {
    namespace: example.path,
    mount: kerberos.path,
    keytabWo: std.filebase64({
        input: "/path/to/vault.keytab",
    }).then(invoke => invoke.result),
    keytabWoVersion: 1,
    serviceAccount: "vault/localhost@EXAMPLE.COM",
});

    import pulumi
import pulumi_std as std
import pulumi_vault as vault

example = vault.Namespace("example", path="example-namespace")
kerberos = vault.AuthBackend("kerberos",
    namespace=example.path,
    type="kerberos",
    path="kerberos")
config = vault.KerberosAuthBackendConfig("config",
    namespace=example.path,
    mount=kerberos.path,
    keytab_wo=std.filebase64(input="/path/to/vault.keytab").result,
    keytab_wo_version=1,
    service_account="vault/localhost@EXAMPLE.COM")

    package main

import (
	"github.com/pulumi/pulumi-std/sdk/go/std"
	"github.com/pulumi/pulumi-vault/sdk/v7/go/vault"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := vault.NewNamespace(ctx, "example", &vault.NamespaceArgs{
			Path: pulumi.String("example-namespace"),
		})
		if err != nil {
			return err
		}
		kerberos, err := vault.NewAuthBackend(ctx, "kerberos", &vault.AuthBackendArgs{
			Namespace: example.Path,
			Type:      pulumi.String("kerberos"),
			Path:      pulumi.String("kerberos"),
		})
		if err != nil {
			return err
		}
		invokeFilebase64, err := std.Filebase64(ctx, &std.Filebase64Args{
			Input: "/path/to/vault.keytab",
		}, nil)
		if err != nil {
			return err
		}
		_, err = vault.NewKerberosAuthBackendConfig(ctx, "config", &vault.KerberosAuthBackendConfigArgs{
			Namespace:       example.Path,
			Mount:           kerberos.Path,
			KeytabWo:        pulumi.String(invokeFilebase64.Result),
			KeytabWoVersion: pulumi.Int(1),
			ServiceAccount:  pulumi.String("vault/localhost@EXAMPLE.COM"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Std = Pulumi.Std;
using Vault = Pulumi.Vault;

return await Deployment.RunAsync(() => 
{
    var example = new Vault.Namespace("example", new()
    {
        Path = "example-namespace",
    });

    var kerberos = new Vault.AuthBackend("kerberos", new()
    {
        Namespace = example.Path,
        Type = "kerberos",
        Path = "kerberos",
    });

    var config = new Vault.KerberosAuthBackendConfig("config", new()
    {
        Namespace = example.Path,
        Mount = kerberos.Path,
        KeytabWo = Std.Filebase64.Invoke(new()
        {
            Input = "/path/to/vault.keytab",
        }).Apply(invoke => invoke.Result),
        KeytabWoVersion = 1,
        ServiceAccount = "vault/localhost@EXAMPLE.COM",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Namespace;
import com.pulumi.vault.NamespaceArgs;
import com.pulumi.vault.AuthBackend;
import com.pulumi.vault.AuthBackendArgs;
import com.pulumi.vault.KerberosAuthBackendConfig;
import com.pulumi.vault.KerberosAuthBackendConfigArgs;
import com.pulumi.std.StdFunctions;
import com.pulumi.std.inputs.Filebase64Args;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Namespace("example", NamespaceArgs.builder()
            .path("example-namespace")
            .build());

        var kerberos = new AuthBackend("kerberos", AuthBackendArgs.builder()
            .namespace(example.path())
            .type("kerberos")
            .path("kerberos")
            .build());

        var config = new KerberosAuthBackendConfig("config", KerberosAuthBackendConfigArgs.builder()
            .namespace(example.path())
            .mount(kerberos.path())
            .keytabWo(StdFunctions.filebase64(Filebase64Args.builder()
                .input("/path/to/vault.keytab")
                .build()).result())
            .keytabWoVersion(1)
            .serviceAccount("vault/localhost@EXAMPLE.COM")
            .build());

    }
}

    resources:
  example:
    type: vault:Namespace
    properties:
      path: example-namespace
  kerberos:
    type: vault:AuthBackend
    properties:
      namespace: ${example.path}
      type: kerberos
      path: kerberos
  config:
    type: vault:KerberosAuthBackendConfig
    properties:
      namespace: ${example.path}
      mount: ${kerberos.path}
      keytabWo:
        fn::invoke:
          function: std:filebase64
          arguments:
            input: /path/to/vault.keytab
          return: result
      keytabWoVersion: 1
      serviceAccount: vault/localhost@EXAMPLE.COM

    pulumi {
  required_providers {
    std = {
      source = "pulumi/std"
    }
    vault = {
      source = "pulumi/vault"
    }
  }
}

resource "vault_namespace" "example" {
  path = "example-namespace"
}
resource "vault_authbackend" "kerberos" {
  namespace = vault_namespace.example.path
  type      = "kerberos"
  path      = "kerberos"
}
resource "vault_kerberosauthbackendconfig" "config" {
  namespace         = vault_namespace.example.path
  mount             = vault_authbackend.kerberos.path
  keytab_wo         = filebase64("/path/to/vault.keytab")
  keytab_wo_version = 1
  service_account   = "vault/localhost@EXAMPLE.COM"
}

    Create KerberosAuthBackendConfig Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new KerberosAuthBackendConfig(name: string, args: KerberosAuthBackendConfigArgs, opts?: CustomResourceOptions);
    @overload
def KerberosAuthBackendConfig(resource_name: str,
                              args: KerberosAuthBackendConfigArgs,
                              opts: Optional[ResourceOptions] = None)

@overload
def KerberosAuthBackendConfig(resource_name: str,
                              opts: Optional[ResourceOptions] = None,
                              keytab_wo: Optional[str] = None,
                              keytab_wo_version: Optional[int] = None,
                              mount: Optional[str] = None,
                              service_account: Optional[str] = None,
                              add_group_aliases: Optional[bool] = None,
                              namespace: Optional[str] = None,
                              remove_instance_name: Optional[bool] = None)
    func NewKerberosAuthBackendConfig(ctx *Context, name string, args KerberosAuthBackendConfigArgs, opts ...ResourceOption) (*KerberosAuthBackendConfig, error)
    public KerberosAuthBackendConfig(string name, KerberosAuthBackendConfigArgs args, CustomResourceOptions? opts = null)
    public KerberosAuthBackendConfig(String name, KerberosAuthBackendConfigArgs args)
public KerberosAuthBackendConfig(String name, KerberosAuthBackendConfigArgs args, CustomResourceOptions options)

    type: vault:KerberosAuthBackendConfig
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "vault_kerberos_auth_backend_config" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args KerberosAuthBackendConfigArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args KerberosAuthBackendConfigArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args KerberosAuthBackendConfigArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args KerberosAuthBackendConfigArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args KerberosAuthBackendConfigArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var kerberosAuthBackendConfigResource = new Vault.KerberosAuthBackendConfig("kerberosAuthBackendConfigResource", new()
{
    KeytabWo = "string",
    KeytabWoVersion = 0,
    Mount = "string",
    ServiceAccount = "string",
    AddGroupAliases = false,
    Namespace = "string",
    RemoveInstanceName = false,
});

    example, err := vault.NewKerberosAuthBackendConfig(ctx, "kerberosAuthBackendConfigResource", &vault.KerberosAuthBackendConfigArgs{
	KeytabWo:           pulumi.String("string"),
	KeytabWoVersion:    pulumi.Int(0),
	Mount:              pulumi.String("string"),
	ServiceAccount:     pulumi.String("string"),
	AddGroupAliases:    pulumi.Bool(false),
	Namespace:          pulumi.String("string"),
	RemoveInstanceName: pulumi.Bool(false),
})

    resource "vault_kerberos_auth_backend_config" "kerberosAuthBackendConfigResource" {
  lifecycle {
    create_before_destroy = true
  }
  keytab_wo            = "string"
  keytab_wo_version    = 0
  mount                = "string"
  service_account      = "string"
  add_group_aliases    = false
  namespace            = "string"
  remove_instance_name = false
}

    var kerberosAuthBackendConfigResource = new KerberosAuthBackendConfig("kerberosAuthBackendConfigResource", KerberosAuthBackendConfigArgs.builder()
    .keytabWo("string")
    .keytabWoVersion(0)
    .mount("string")
    .serviceAccount("string")
    .addGroupAliases(false)
    .namespace("string")
    .removeInstanceName(false)
    .build());

    kerberos_auth_backend_config_resource = vault.KerberosAuthBackendConfig("kerberosAuthBackendConfigResource",
    keytab_wo="string",
    keytab_wo_version=0,
    mount="string",
    service_account="string",
    add_group_aliases=False,
    namespace="string",
    remove_instance_name=False)

    const kerberosAuthBackendConfigResource = new vault.KerberosAuthBackendConfig("kerberosAuthBackendConfigResource", {
    keytabWo: "string",
    keytabWoVersion: 0,
    mount: "string",
    serviceAccount: "string",
    addGroupAliases: false,
    namespace: "string",
    removeInstanceName: false,
});

    type: vault:KerberosAuthBackendConfig
properties:
    addGroupAliases: false
    keytabWo: string
    keytabWoVersion: 0
    mount: string
    namespace: string
    removeInstanceName: false
    serviceAccount: string

    KerberosAuthBackendConfig Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The KerberosAuthBackendConfig resource accepts the following input properties:

    KeytabWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded keytab file content. This is a write-only field and is not stored in Terraform state. The keytab must contain an entry matching the serviceAccount.
    KeytabWoVersion int
    Version identifier for keytab updates. Increment this value to trigger a keytab update in Vault. This allows you to rotate the keytab without forcing resource replacement.
    Mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    ServiceAccount string
    The Kerberos service account associated with the keytab entry (e.g., vault/localhost@EXAMPLE.COM or vaultSvc).
    AddGroupAliases bool
    Adds group aliases during authentication. When enabled, Vault will create entity aliases for each group the user belongs to. Defaults to false.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    RemoveInstanceName bool
    Removes instance names from Kerberos service principal names during authentication. This can be useful when the instance name is not relevant for authentication. Defaults to false.
    KeytabWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded keytab file content. This is a write-only field and is not stored in Terraform state. The keytab must contain an entry matching the serviceAccount.
    KeytabWoVersion int
    Version identifier for keytab updates. Increment this value to trigger a keytab update in Vault. This allows you to rotate the keytab without forcing resource replacement.
    Mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    ServiceAccount string
    The Kerberos service account associated with the keytab entry (e.g., vault/localhost@EXAMPLE.COM or vaultSvc).
    AddGroupAliases bool
    Adds group aliases during authentication. When enabled, Vault will create entity aliases for each group the user belongs to. Defaults to false.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    RemoveInstanceName bool
    Removes instance names from Kerberos service principal names during authentication. This can be useful when the instance name is not relevant for authentication. Defaults to false.
    keytab_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded keytab file content. This is a write-only field and is not stored in Terraform state. The keytab must contain an entry matching the serviceAccount.
    keytab_wo_version number
    Version identifier for keytab updates. Increment this value to trigger a keytab update in Vault. This allows you to rotate the keytab without forcing resource replacement.
    mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    service_account string
    The Kerberos service account associated with the keytab entry (e.g., vault/localhost@EXAMPLE.COM or vaultSvc).
    add_group_aliases bool
    Adds group aliases during authentication. When enabled, Vault will create entity aliases for each group the user belongs to. Defaults to false.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    remove_instance_name bool
    Removes instance names from Kerberos service principal names during authentication. This can be useful when the instance name is not relevant for authentication. Defaults to false.
    keytabWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded keytab file content. This is a write-only field and is not stored in Terraform state. The keytab must contain an entry matching the serviceAccount.
    keytabWoVersion Integer
    Version identifier for keytab updates. Increment this value to trigger a keytab update in Vault. This allows you to rotate the keytab without forcing resource replacement.
    mount String
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    serviceAccount String
    The Kerberos service account associated with the keytab entry (e.g., vault/localhost@EXAMPLE.COM or vaultSvc).
    addGroupAliases Boolean
    Adds group aliases during authentication. When enabled, Vault will create entity aliases for each group the user belongs to. Defaults to false.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    removeInstanceName Boolean
    Removes instance names from Kerberos service principal names during authentication. This can be useful when the instance name is not relevant for authentication. Defaults to false.
    keytabWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded keytab file content. This is a write-only field and is not stored in Terraform state. The keytab must contain an entry matching the serviceAccount.
    keytabWoVersion number
    Version identifier for keytab updates. Increment this value to trigger a keytab update in Vault. This allows you to rotate the keytab without forcing resource replacement.
    mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    serviceAccount string
    The Kerberos service account associated with the keytab entry (e.g., vault/localhost@EXAMPLE.COM or vaultSvc).
    addGroupAliases boolean
    Adds group aliases during authentication. When enabled, Vault will create entity aliases for each group the user belongs to. Defaults to false.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    removeInstanceName boolean
    Removes instance names from Kerberos service principal names during authentication. This can be useful when the instance name is not relevant for authentication. Defaults to false.
    keytab_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded keytab file content. This is a write-only field and is not stored in Terraform state. The keytab must contain an entry matching the serviceAccount.
    keytab_wo_version int
    Version identifier for keytab updates. Increment this value to trigger a keytab update in Vault. This allows you to rotate the keytab without forcing resource replacement.
    mount str
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    service_account str
    The Kerberos service account associated with the keytab entry (e.g., vault/localhost@EXAMPLE.COM or vaultSvc).
    add_group_aliases bool
    Adds group aliases during authentication. When enabled, Vault will create entity aliases for each group the user belongs to. Defaults to false.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    remove_instance_name bool
    Removes instance names from Kerberos service principal names during authentication. This can be useful when the instance name is not relevant for authentication. Defaults to false.
    keytabWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded keytab file content. This is a write-only field and is not stored in Terraform state. The keytab must contain an entry matching the serviceAccount.
    keytabWoVersion Number
    Version identifier for keytab updates. Increment this value to trigger a keytab update in Vault. This allows you to rotate the keytab without forcing resource replacement.
    mount String
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    serviceAccount String
    The Kerberos service account associated with the keytab entry (e.g., vault/localhost@EXAMPLE.COM or vaultSvc).
    addGroupAliases Boolean
    Adds group aliases during authentication. When enabled, Vault will create entity aliases for each group the user belongs to. Defaults to false.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    removeInstanceName Boolean
    Removes instance names from Kerberos service principal names during authentication. This can be useful when the instance name is not relevant for authentication. Defaults to false.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the KerberosAuthBackendConfig resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.
    id string
    The provider-assigned unique ID for this managed resource.
    id str
    The provider-assigned unique ID for this managed resource.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing KerberosAuthBackendConfig Resource

    Get an existing KerberosAuthBackendConfig resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: KerberosAuthBackendConfigState, opts?: CustomResourceOptions): KerberosAuthBackendConfig
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        add_group_aliases: Optional[bool] = None,
        keytab_wo: Optional[str] = None,
        keytab_wo_version: Optional[int] = None,
        mount: Optional[str] = None,
        namespace: Optional[str] = None,
        remove_instance_name: Optional[bool] = None,
        service_account: Optional[str] = None) -> KerberosAuthBackendConfig
    func GetKerberosAuthBackendConfig(ctx *Context, name string, id IDInput, state *KerberosAuthBackendConfigState, opts ...ResourceOption) (*KerberosAuthBackendConfig, error)
    public static KerberosAuthBackendConfig Get(string name, Input<string> id, KerberosAuthBackendConfigState? state, CustomResourceOptions? opts = null)
    public static KerberosAuthBackendConfig get(String name, Output<String> id, KerberosAuthBackendConfigState state, CustomResourceOptions options)
    resources:  _:    type: vault:KerberosAuthBackendConfig    get:      id: ${id}
    import {
  to = vault_kerberos_auth_backend_config.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AddGroupAliases bool
    Adds group aliases during authentication. When enabled, Vault will create entity aliases for each group the user belongs to. Defaults to false.
    KeytabWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded keytab file content. This is a write-only field and is not stored in Terraform state. The keytab must contain an entry matching the serviceAccount.
    KeytabWoVersion int
    Version identifier for keytab updates. Increment this value to trigger a keytab update in Vault. This allows you to rotate the keytab without forcing resource replacement.
    Mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    RemoveInstanceName bool
    Removes instance names from Kerberos service principal names during authentication. This can be useful when the instance name is not relevant for authentication. Defaults to false.
    ServiceAccount string
    The Kerberos service account associated with the keytab entry (e.g., vault/localhost@EXAMPLE.COM or vaultSvc).
    AddGroupAliases bool
    Adds group aliases during authentication. When enabled, Vault will create entity aliases for each group the user belongs to. Defaults to false.
    KeytabWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded keytab file content. This is a write-only field and is not stored in Terraform state. The keytab must contain an entry matching the serviceAccount.
    KeytabWoVersion int
    Version identifier for keytab updates. Increment this value to trigger a keytab update in Vault. This allows you to rotate the keytab without forcing resource replacement.
    Mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    Namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    RemoveInstanceName bool
    Removes instance names from Kerberos service principal names during authentication. This can be useful when the instance name is not relevant for authentication. Defaults to false.
    ServiceAccount string
    The Kerberos service account associated with the keytab entry (e.g., vault/localhost@EXAMPLE.COM or vaultSvc).
    add_group_aliases bool
    Adds group aliases during authentication. When enabled, Vault will create entity aliases for each group the user belongs to. Defaults to false.
    keytab_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded keytab file content. This is a write-only field and is not stored in Terraform state. The keytab must contain an entry matching the serviceAccount.
    keytab_wo_version number
    Version identifier for keytab updates. Increment this value to trigger a keytab update in Vault. This allows you to rotate the keytab without forcing resource replacement.
    mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    remove_instance_name bool
    Removes instance names from Kerberos service principal names during authentication. This can be useful when the instance name is not relevant for authentication. Defaults to false.
    service_account string
    The Kerberos service account associated with the keytab entry (e.g., vault/localhost@EXAMPLE.COM or vaultSvc).
    addGroupAliases Boolean
    Adds group aliases during authentication. When enabled, Vault will create entity aliases for each group the user belongs to. Defaults to false.
    keytabWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded keytab file content. This is a write-only field and is not stored in Terraform state. The keytab must contain an entry matching the serviceAccount.
    keytabWoVersion Integer
    Version identifier for keytab updates. Increment this value to trigger a keytab update in Vault. This allows you to rotate the keytab without forcing resource replacement.
    mount String
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    removeInstanceName Boolean
    Removes instance names from Kerberos service principal names during authentication. This can be useful when the instance name is not relevant for authentication. Defaults to false.
    serviceAccount String
    The Kerberos service account associated with the keytab entry (e.g., vault/localhost@EXAMPLE.COM or vaultSvc).
    addGroupAliases boolean
    Adds group aliases during authentication. When enabled, Vault will create entity aliases for each group the user belongs to. Defaults to false.
    keytabWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded keytab file content. This is a write-only field and is not stored in Terraform state. The keytab must contain an entry matching the serviceAccount.
    keytabWoVersion number
    Version identifier for keytab updates. Increment this value to trigger a keytab update in Vault. This allows you to rotate the keytab without forcing resource replacement.
    mount string
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    namespace string
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    removeInstanceName boolean
    Removes instance names from Kerberos service principal names during authentication. This can be useful when the instance name is not relevant for authentication. Defaults to false.
    serviceAccount string
    The Kerberos service account associated with the keytab entry (e.g., vault/localhost@EXAMPLE.COM or vaultSvc).
    add_group_aliases bool
    Adds group aliases during authentication. When enabled, Vault will create entity aliases for each group the user belongs to. Defaults to false.
    keytab_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded keytab file content. This is a write-only field and is not stored in Terraform state. The keytab must contain an entry matching the serviceAccount.
    keytab_wo_version int
    Version identifier for keytab updates. Increment this value to trigger a keytab update in Vault. This allows you to rotate the keytab without forcing resource replacement.
    mount str
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    namespace str
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    remove_instance_name bool
    Removes instance names from Kerberos service principal names during authentication. This can be useful when the instance name is not relevant for authentication. Defaults to false.
    service_account str
    The Kerberos service account associated with the keytab entry (e.g., vault/localhost@EXAMPLE.COM or vaultSvc).
    addGroupAliases Boolean
    Adds group aliases during authentication. When enabled, Vault will create entity aliases for each group the user belongs to. Defaults to false.
    keytabWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Base64-encoded keytab file content. This is a write-only field and is not stored in Terraform state. The keytab must contain an entry matching the serviceAccount.
    keytabWoVersion Number
    Version identifier for keytab updates. Increment this value to trigger a keytab update in Vault. This allows you to rotate the keytab without forcing resource replacement.
    mount String
    Path where the Kerberos auth method is mounted. Changing this will force a new resource to be created.
    namespace String
    The namespace to provision the resource in. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.
    removeInstanceName Boolean
    Removes instance names from Kerberos service principal names during authentication. This can be useful when the instance name is not relevant for authentication. Defaults to false.
    serviceAccount String
    The Kerberos service account associated with the keytab entry (e.g., vault/localhost@EXAMPLE.COM or vaultSvc).

    Import

    Kerberos auth backend configurations can be imported using the path, e.g.

    $ pulumi import vault:index/kerberosAuthBackendConfig:KerberosAuthBackendConfig config auth/kerberos/config

    Note The keytabWo field cannot be imported as it is write-only and not stored in state. You will need to provide it in your configuration after import.

    Importing with Namespace (Vault Enterprise)

    For Vault Enterprise with namespaces, set the TERRAFORM_VAULT_NAMESPACE_IMPORT environment variable before importing:

    $ export TERRAFORM_VAULT_NAMESPACE_IMPORT=example-namespace
$ terraform import vault_kerberos_auth_backend_config.config auth/kerberos/config

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    Vault pulumi/pulumi-vault
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the vault Terraform Provider.
    vault logo vault logo
    Viewing docs for HashiCorp Vault v7.12.0
    published on Saturday, Aug 15, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-vault

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial