How-To: Install certificates in the Dapr sidecar

Configure the Dapr sidecar container to trust certificates

The Dapr sidecar can be configured to trust certificates for communicating with external services. This is useful in scenarios where a self-signed certificate needs to be trusted, such as:

• Using an HTTP binding
• Configuring an outbound proxy for the sidecar

Both certificate authority (CA) certificates and leaf certificates are supported.

• Self-hosted
• Kubernetes

You can make the following configurations when the sidecar is running as a container.

1. Configure certificates to be available to the sidecar container using volume mounts.
2. Point the environment variable SSL_CERT_DIR in the sidecar container to the directory containing the certificates.

Note: For Windows containers, make sure the container is running with administrator privileges so it can install the certificates.

The following example uses Docker Compose to install certificates (present locally in the ./certificates directory) in the sidecar container:

version: '3'
services:
  dapr-sidecar:
    image: "daprio/daprd:edge" # dapr version must be at least v1.8
    command: [
      "./daprd",
     "-app-id", "myapp",
     "-app-port", "3000",
     ]
    volumes:
        - "./components/:/components"
        - "./certificates:/certificates" # (STEP 1) Mount the certificates folder to the sidecar container
    environment:
      - "SSL_CERT_DIR=/certificates" # (STEP 2) Set the environment variable to the path of the certificates folder
    # Uncomment the line below for Windows containers
    # user: ContainerAdministrator

Note: When the sidecar is not running inside a container, certificates must be directly installed on the host operating system.

On Kubernetes:

1. Configure certificates to be available to the sidecar container using a volume mount.
2. Point the environment variable SSL_CERT_DIR in the sidecar container to the directory containing the certificates.

The following example YAML shows a deployment that:

• Attaches a pod volume to the sidecar
• Sets SSL_CERT_DIR to install the certificates

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  namespace: default
  labels:
    app: myapp
spec:
  replicas: 1
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
      annotations:
        dapr.io/enabled: "true"
        dapr.io/app-id: "myapp"
        dapr.io/app-port: "8000"
        dapr.io/volume-mounts: "certificates-vol:/tmp/certificates" # (STEP 1) Mount the certificates folder to the sidecar container
        dapr.io/env: "SSL_CERT_DIR=/tmp/certificates" # (STEP 2) Set the environment variable to the path of the certificates folder
    spec:
      volumes:
        - name: certificates-vol
          hostPath:
            path: /certificates
#...

Note: When using Windows containers, the sidecar container is started with admin privileges, which is required to install the certificates. This does not apply to Linux containers.

After following these steps, all the certificates in the directory pointed by SSL_CERT_DIR are installed.

• On Linux containers: All the certificate extensions supported by OpenSSL are supported. Learn more.
• On Windows container: All the certificate extensions supported by certoc.exe are supported. See certoc.exe present in Windows Server Core.

Demo

Watch the demo on using installing SSL certificates and securely using the HTTP binding in community call 64:

Related links

• HTTP binding spec
• (Kubernetes) How-to: Mount Pod volumes to the Dapr sidecar
• Dapr Kubernetes pod annotations spec

Next steps

Enable preview features

Last modified October 11, 2024: Fixed typo (#4389) (fe17926)