Overview
General overview on set up of secret stores for Dapr
Dapr integrates with secret stores to provide apps and other components with secure store and access to secrets such as access keys and passwords. Each secret store component has a name and this name is used when accessing a secret.
As with other building block components, secret store components are extensible and can be found in the components-contrib repo.
A secret store in Dapr is described using a Component
file with the following fields:
apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
name: secretstore
namespace: default
spec:
type: secretstores.<NAME>
version: v1
metadata:
- name: <KEY>
value: <VALUE>
- name: <KEY>
value: <VALUE>
...
The type of secret store is determined by the type
field, and things like connection strings and other metadata are put in the .metadata
section.
Different supported secret stores will have different specific fields that would need to be configured. For example, when configuring a secret store which uses AWS Secrets Manager the file would look like this:
apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
name: awssecretmanager
namespace: default
spec:
type: secretstores.aws.secretmanager
version: v1
metadata:
- name: region
value: "[aws_region]"
- name: accessKey
value: "[aws_access_key]"
- name: secretKey
value: "[aws_secret_key]"
- name: sessionToken
value: "[aws_session_token]"
Once you have created the component’s YAML file, follow these instructions to apply it based on your hosting environment:
To run locally, create a components
dir containing the YAML file and provide the path to the dapr run
command with the flag --components-path
.
To deploy in Kubernetes, assuming your component file is named secret-store.yaml
, run:
kubectl apply -f secret-store.yaml
Related links
Last modified February 16, 2021: Merge pull request #1235 from dapr/update-v0.11 (b4e9fbb)