Frequently asked questions
Short answers, with links to the pages that cover each topic.
Why not use the default kong keyset?
In hybrid mode each data plane generates and caches its own keys in memory, so data planes sign with different keys, and there is no data plane endpoint that publishes them. See How it works.
Can Kong read the key from Vault directly?
No. Only the keyset client username and password fields accept Kong vault references; key material cannot be referenced. The keyset URL must return a JWK Set with private members, which neither the KV v2 API nor Vault's OIDC keys endpoint returns.
Can I use Vault Transit?
No. Transit keys are not exportable, and the plugin signs locally with the private key.
Does it work with Konnect?
Yes. Konnect data planes call the bridge like self-managed ones. See Konnect.
Can I use HS256?
No. A symmetric key cannot be published in a public JWKS; the bridge rejects HS* keys.
What happens when Vault is down?
Signing and verification continue with the last good snapshot. Readiness fails after max_stale, so alert on jwksbridge_snapshot_age_seconds. See Caching and Vault outages.
Does the bridge generate or rotate keys?
No. Operators or CI write keys to Vault with jwks-bridge keygen or examples/vault/rotate.sh; the bridge only reads them. See Key rotation.
Are other secret stores supported?
Vault KV v2 and local files today. The source interface is small; AWS Secrets Manager, GCP Secret Manager and Azure Key Vault are planned.