Secret store components

Guidance on setting up different secret store components

Dapr integrates with secret stores to provide apps and other components with secure storage and access to secrets such as access keys and passwords. Each secret store component has a name and this name is used when accessing a secret.

As with other building block components, secret store components are extensible and can be found in the components-contrib repo.

A secret store in Dapr is described using a Component file with the following fields:

  1. apiVersion: dapr.io/v1alpha1
  2. kind: Component
  3. metadata:
  4.   name: secretstore
  5. spec:
  6.   type: secretstores.<NAME>
  7.   version: v1
  8.   metadata:
  9.   - name: <KEY>
  10.     value: <VALUE>
  11.   - name: <KEY>
  12.     value: <VALUE>
  13. ...

The type of secret store is determined by the type field, and things like connection strings and other metadata are put in the .metadata section.

Different supported secret stores will have different specific fields that would need to be configured. For example, when configuring a secret store which uses AWS Secrets Manager the file would look like this:

  1. apiVersion: dapr.io/v1alpha1
  2. kind: Component
  3. metadata:
  4.   name: awssecretmanager
  5. spec:
  6.   type: secretstores.aws.secretmanager
  7.   version: v1
  8.   metadata:
  9.   - name: region
  10.     value: "[aws_region]"
  11.   - name: accessKey
  12.     value: "[aws_access_key]"
  13.   - name: secretKey
  14.     value: "[aws_secret_key]"
  15.   - name: sessionToken
  16.     value: "[aws_session_token]"

Important

When running the Dapr sidecar (daprd) with your application on EKS (AWS Kubernetes), if you’re using a node/pod that has already been attached to an IAM policy defining access to AWS resources, you must not provide AWS access-key, secret-key, and tokens in the definition of the component spec you’re using.

Apply the configuration

Once you have created the component’s YAML file, follow these instructions to apply it based on your hosting environment:

To run locally, create a components dir containing the YAML file and provide the path to the dapr run command with the flag --resources-path.

To deploy in Kubernetes, assuming your component file is named secret-store.yaml, run:

  1. kubectl apply -f secret-store.yaml

Supported secret stores

Visit the secret stores reference for a full list of supported secret stores.

Last modified June 19, 2023: Merge pull request #3565 from dapr/aacrawfi/skip-secrets-close (b1763bf)