How-To: Install certificates in the Dapr sidecar

Configure the Dapr sidecar container to trust certificates

The Dapr sidecar can be configured to trust certificates for communicating with external services. This is useful in scenarios where a self-signed certificate needs to be trusted. For example, using an HTTP binding or configuring an outbound proxy for the sidecar. Both certificate authority (CA) certificates and leaf certificates are supported.

When the sidecar is not running inside a container, certificates must be directly installed on the host operating system.

When the sidecar is running as a container:

  1. Certificates must be available to the sidecar container. This can be configured using volume mounts.
  2. The environment variable SSL_CERT_DIR must be set in the sidecar container, pointing to the directory containing the certificates.
  3. For Windows containers, the container needs to run with administrator privileges to be able to install the certificates.

Below is an example that uses Docker Compose to install certificates (present locally in the ./certificates directory) in the sidecar container:

  1. version: '3'
  2. services:
  3.   dapr-sidecar:
  4.     image: "daprio/daprd:edge" # dapr version must be at least v1.8
  5.     command: [
  6.       "./daprd",
  7.      "-app-id", "myapp",
  8.      "-app-port", "3000",
  9.      ]
  10.     volumes:
  11.         - "./components/:/components"
  12.         - "./certificates:/certificates" # (STEP 1) Mount the certificates folder to the sidecar container
  13.     environment:
  14.       - "SSL_CERT_DIR=/certificates" # (STEP 2) Set the environment variable to the path of the certificates folder
  15.     # Uncomment the line below for Windows containers
  16.     # user: ContainerAdministrator

On Kubernetes:

  1. Certificates must be available to the sidecar container using a volume mount.
  2. The environment variable SSL_CERT_DIR must be set in the sidecar container, pointing to the directory containing the certificates.

The YAML below is an example of a deployment that attaches a pod volume to the sidecar, and sets SSL_CERT_DIR to install the certificates.

  1. apiVersion: apps/v1
  2. kind: Deployment
  3. metadata:
  4.   name: myapp
  5.   namespace: default
  6.   labels:
  7.     app: myapp
  8. spec:
  9.   replicas: 1
  10.   selector:
  11.     matchLabels:
  12.       app: myapp
  13.   template:
  14.     metadata:
  15.       labels:
  16.         app: myapp
  17.       annotations:
  18.         dapr.io/enabled: "true"
  19.         dapr.io/app-id: "myapp"
  20.         dapr.io/app-port: "8000"
  21.         dapr.io/volume-mounts: "certificates-vol:/tmp/certificates" # (STEP 1) Mount the certificates folder to the sidecar container
  22.         dapr.io/env: "SSL_CERT_DIR=/tmp/certificates" # (STEP 2) Set the environment variable to the path of the certificates folder
  23.     spec:
  24.       volumes:
  25.         - name: certificates-vol
  26.           hostPath:
  27.             path: /certificates
  28. ...

Note: When using Windows containers, the sidecar container is started with admin privileges, which is required to install the certificates. This does not apply to Linux containers.

All the certificates in the directory pointed by SSL_CERT_DIR are installed.

  1. On Linux containers, all the certificate extensions supported by OpenSSL are supported. For more information, see https://www.openssl.org/docs/man1.1.1/man1/openssl-rehash.html
  2. On Windows container, all the certificate extensions supported by certoc.exe are supported. For more information, see certoc.exe present in Windows Server Core

Example

Watch the demo on using installing SSL certificates and securely using the HTTP binding in community call 64: