jwks-bridge
Sign tokens with a key stored in HashiCorp Vault on every Kong data plane, and publish the public JWKS through Kong for your backends.
Free and MIT licensed. For the Kong Gateway Enterprise jwt-signer plugin, in hybrid mode or Konnect.
Sign tokens with a key stored in HashiCorp Vault on every Kong data plane, and publish the public JWKS through Kong for your backends.
Free and MIT licensed. For the Kong Gateway Enterprise jwt-signer plugin, in hybrid mode or Konnect.
With Homebrew, the container image ghcr.io/bcollard/jwks-bridge, or the Helm chart oci://ghcr.io/bcollard/charts/jwks-bridge.
$ brew tap bcollard/jwks-bridge
$ brew install --cask jwks-bridgeData planes load the private keyset directly from the bridge. Backends fetch the public JWKS through a Kong Route.
secret/jwks-bridge/defaulthttps://jwks-bridge:8443/keysethttps://kong/.well-known/jwks.jsonhttp://jwks-bridge:9090/metricsEvery data plane signs with the same key, without a database on the data plane.
Stage, promote, retire, remove. Verified end to end with no failed verification under load.
In-memory snapshots keep serving the last good keyset; readiness reports staleness.
Separate TLS listener, mTLS or Basic auth, strict validation of every Vault write.
Prometheus metrics, and OpenTelemetry spans that continue the W3C trace context from Kong to Vault.
Replicas, PodDisruptionBudget, NetworkPolicy, ServiceMonitor and a hardened distroless image.