Secret store component specs on Dapr Docs

AlibabaCloud OOS Parameter Store

Mon, 01 Jan 0001 00:00:00 +0000

Component format

To setup AlibabaCloud OOS Parameter Store secret store create a component of type secretstores.alicloud.parameterstore. See this guide on how to create and apply a secretstore configuration. See this guide on referencing secrets to retrieve and use the secret with Dapr components.

apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
 name: alibabacloudparameterstore
spec:
 type: secretstores.alicloud.parameterstore
 version: v1
 metadata:
 - name: regionId
 value: "[alicloud_region_id]"
 - name: accessKeyId 
 value: "[alicloud_access_key_id]"
 - name: accessKeySecret
 value: "[alicloud_access_key_secret]"
 - name: securityToken
 value: "[alicloud_security_token]"

Warning

The above example uses secrets as plain strings. It is recommended to use a local secret store such as Kubernetes secret store or a local file to bootstrap secure key storage.

Spec metadata fields

Field	Required	Details	Example
regionId	Y	The specific region the AlibabaCloud OOS Parameter Store instance is deployed in	`"cn-hangzhou"`
accessKeyId	Y	The AlibabaCloud Access Key ID to access this resource	`"accessKeyId"`
accessKeySecret	Y	The AlibabaCloud Access Key Secret to access this resource	`"accessKeySecret"`
securityToken	N	The AlibabaCloud Security Token to use	`"securityToken"`

Optional per-request metadata properties

The following optional query parameters can be provided when retrieving secrets from this secret store:

AWS Secrets Manager

Mon, 01 Jan 0001 00:00:00 +0000

Component format

To setup AWS Secrets Manager secret store create a component of type secretstores.aws.secretmanager. See this guide on how to create and apply a secretstore configuration. See this guide on referencing secrets to retrieve and use the secret with Dapr components.

See Authenticating to AWS for information about authentication-related attributes.

apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
 name: awssecretmanager
spec:
 type: secretstores.aws.secretmanager
 version: v1
 metadata:
 - name: region
 value: "[aws_region]"
 - name: accessKey
 value: "[aws_access_key]"
 - name: secretKey
 value: "[aws_secret_key]"
 - name: sessionToken
 value: "[aws_session_token]"
 - name: multipleKeyValuesPerSecret
 value: "false"

Warning

The above example uses secrets as plain strings. It is recommended to use a local secret store such as Kubernetes secret store or a local file to bootstrap secure key storage.

Spec metadata fields

Field	Required	Details	Example
region	Y	The specific AWS region the AWS Secrets Manager instance is deployed in	`"us-east-1"`
accessKey	Y	The AWS Access Key to access this resource	`"key"`
secretKey	Y	The AWS Secret Access Key to access this resource	`"secretAccessKey"`
sessionToken	N	The AWS session token to use	`"sessionToken"`
multipleKeyValuesPerSecret	N	When set to `"true"` allows for multiple key value pairs to be stored in a single secret. Defaults to `"false"`	`"true"`

Important

When running the Dapr sidecar (daprd) with your application on EKS (AWS Kubernetes), if you’re using a node/pod that has already been attached to an IAM policy defining access to AWS resources, you must not provide AWS access-key, secret-key, and tokens in the definition of the component spec you’re using.

Optional per-request metadata properties

The following optional query parameters can be provided when retrieving secrets from this secret store:

AWS SSM Parameter Store

Mon, 01 Jan 0001 00:00:00 +0000

Component format

To setup AWS SSM Parameter Store secret store create a component of type secretstores.aws.parameterstore. See this guide on how to create and apply a secretstore configuration. See this guide on referencing secrets to retrieve and use the secret with Dapr components.

See Authenticating to AWS for information about authentication-related attributes.

apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
 name: awsparameterstore
spec:
 type: secretstores.aws.parameterstore
 version: v1
 metadata:
 - name: region
 value: "[aws_region]"
 - name: accessKey
 value: "[aws_access_key]"
 - name: secretKey
 value: "[aws_secret_key]"
 - name: sessionToken
 value: "[aws_session_token]"
 - name: prefix
 value: "[secret_name]"

Warning

The above example uses secrets as plain strings. It is recommended to use a local secret store such as Kubernetes secret store or a local file to bootstrap secure key storage.

Spec metadata fields

Field	Required	Details	Example
region	Y	The specific AWS region the AWS SSM Parameter Store instance is deployed in	`"us-east-1"`
accessKey	Y	The AWS Access Key to access this resource	`"key"`
secretKey	Y	The AWS Secret Access Key to access this resource	`"secretAccessKey"`
sessionToken	N	The AWS session token to use	`"sessionToken"`
prefix	N	Allows you to specify more than one SSM parameter store secret store component.	`"prefix"`

Important

Create an AWS SSM Parameter Store instance

Setup AWS SSM Parameter Store using the AWS documentation: https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html.

Azure Key Vault secret store

Mon, 01 Jan 0001 00:00:00 +0000

Component format

To setup Azure Key Vault secret store, create a component of type secretstores.azure.keyvault.

See the secret store components guide on how to create and apply a secret store configuration.
See the guide on referencing secrets to retrieve and use the secret with Dapr components.
See the Configure the component section below.

apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
 name: azurekeyvault
spec:
 type: secretstores.azure.keyvault
 version: v1
 metadata:
 - name: vaultName # Required
 value: [your_keyvault_name]
 - name: azureEnvironment # Optional, defaults to AZUREPUBLICCLOUD
 value: "AZUREPUBLICCLOUD"
 # See authentication section below for all options
 - name: azureTenantId
 value: "[your_service_principal_tenant_id]"
 - name: azureClientId
 value: "[your_service_principal_app_id]"
 - name: azureCertificateFile
 value : "[pfx_certificate_file_fully_qualified_local_path]"

Authenticating with Microsoft Entra ID

The Azure Key Vault secret store component supports authentication with Microsoft Entra ID only. Before you enable this component:

GCP Secret Manager

Mon, 01 Jan 0001 00:00:00 +0000

Component format

To setup GCP Secret Manager secret store create a component of type secretstores.gcp.secretmanager. See this guide on how to create and apply a secretstore configuration. See this guide on referencing secrets to retrieve and use the secret with Dapr components.

apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
 name: gcpsecretmanager
spec:
 type: secretstores.gcp.secretmanager
 version: v1
 metadata:
 - name: type
 value: <replace-with-account-type>
 - name: project_id
 value: <replace-with-project-id>
 - name: private_key_id
 value: <replace-with-private-key-id>
 - name: client_email
 value: <replace-with-email>
 - name: client_id
 value: <replace-with-client-id>
 - name: auth_uri
 value: <replace-with-auth-uri>
 - name: token_uri
 value: <replace-with-token-uri>
 - name: auth_provider_x509_cert_url
 value: <replace-with-auth-provider-cert-url>
 - name: client_x509_cert_url
 value: <replace-with-client-cert-url>
 - name: private_key
 value: <replace-with-private-key>

Warning

The above example uses secrets as plain strings. It is recommended to use a local secret store such as Kubernetes secret store or a local file to bootstrap secure key storage.

Spec metadata fields

Field	Required	Details	Example
`project_id`	Y	The project ID associated with this component.	`"project_id"`
`type`	N	The type of the account.	`"service_account"`
`private_key_id`	N	If using explicit credentials, this field should contain the `private_key_id` field from the service account json document	`"privateKeyId"`
`private_key`	N	If using explicit credentials, this field should contain the `private_key` field from the service account json. Replace with x509 cert	`12345-12345`
`client_email`	N	If using explicit credentials, this field should contain the `client_email` field from the service account json	`"client@email.com"`
`client_id`	N	If using explicit credentials, this field should contain the `client_id` field from the service account json	`0123456789-0123456789`
`auth_uri`	N	If using explicit credentials, this field should contain the `auth_uri` field from the service account json	`https://accounts.google.com/o/oauth2/auth`
`token_uri`	N	If using explicit credentials, this field should contain the `token_uri` field from the service account json	`https://oauth2.googleapis.com/token`
`auth_provider_x509_cert_url`	N	If using explicit credentials, this field should contain the `auth_provider_x509_cert_url` field from the service account json	`https://www.googleapis.com/oauth2/v1/certs`
`client_x509_cert_url`	N	If using explicit credentials, this field should contain the `client_x509_cert_url` field from the service account json	`https://www.googleapis.com/robot/v1/metadata/x509/<PROJECT_NAME>.iam.gserviceaccount.com`

GCP Credentials

Since the GCP Secret Manager component uses the GCP Go Client Libraries, by default it authenticates using Application Default Credentials. This is explained further in the Authenticate to GCP Cloud services using client libraries guide. Also, see how to Set up Application Default Credentials.

HashiCorp Vault

Mon, 01 Jan 0001 00:00:00 +0000

Create the Vault component

To setup HashiCorp Vault secret store create a component of type secretstores.hashicorp.vault. See this guide on how to create and apply a secretstore configuration. See this guide on referencing secrets to retrieve and use the secret with Dapr components.

apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
 name: vault
spec:
 type: secretstores.hashicorp.vault
 version: v1
 metadata:
 - name: vaultAddr
 value: [vault_address] # Optional. Default: "https://127.0.0.1:8200"
 - name: caCert # Optional. This or caPath or caPem
 value: "[ca_cert]"
 - name: caPath # Optional. This or CaCert or caPem
 value: "[path_to_ca_cert_file]"
 - name: caPem # Optional. This or CaCert or CaPath
 value : "[encoded_ca_cert_pem]"
 - name: skipVerify # Optional. Default: false
 value : "[skip_tls_verification]"
 - name: tlsServerName # Optional.
 value : "[tls_config_server_name]"
 - name: vaultTokenMountPath # Required if vaultToken not provided. Path to token file.
 value : "[path_to_file_containing_token]"
 - name: vaultToken # Required if vaultTokenMountPath not provided. Token value.
 value : "[path_to_file_containing_token]"
 - name: vaultKVPrefix # Optional. Default: "dapr"
 value : "[vault_prefix]"
 - name: vaultKVUsePrefix # Optional. default: "true"
 value: "[true/false]"
 - name: enginePath # Optional. default: "secret"
 value: "secret"
 - name: vaultValueType # Optional. default: "map"
 value: "map"

Warning

The above example uses secrets as plain strings. It is recommended to use a local secret store such as Kubernetes secret store or a local file to bootstrap secure key storage.

Spec metadata fields

Field	Required	Details	Example
vaultAddr	N	The address of the Vault server. Defaults to `"https://127.0.0.1:8200"`	`"https://127.0.0.1:8200"`
caPem	N	The inlined contents of the CA certificate to use, in PEM format. If defined, takes precedence over `caPath` and `caCert`.	See below
caPath	N	The path to a folder holding the CA certificate file to use, in PEM format. If the folder contains multiple files, only the first file found will be used. If defined, takes precedence over `caCert`.	`"path/to/cacert/holding/folder"`
caCert	N	The path to the CA certificate to use, in PEM format.	`""path/to/cacert.pem"`
skipVerify	N	Skip TLS verification. Defaults to `"false"`	`"true"`, `"false"`
tlsServerName	N	The name of the server requested during TLS handshake in order to support virtual hosting. This value is also used to verify the TLS certificate presented by Vault server.	`"tls-server"`
vaultTokenMountPath	Y	Path to file containing token	`"path/to/file"`
vaultToken	Y	Token for authentication within Vault.	`"tokenValue"`
vaultKVPrefix	N	The prefix in vault. Defaults to `"dapr"`	`"dapr"`, `"myprefix"`
vaultKVUsePrefix	N	If false, vaultKVPrefix is forced to be empty. If the value is not given or set to true, vaultKVPrefix is used when accessing the vault. Setting it to false is needed to be able to use the BulkGetSecret method of the store.	`"true"`, `"false"`
enginePath	N	The engine path in vault. Defaults to `"secret"`	`"kv"`, `"any"`
vaultValueType	N	Vault value type. `map` means to parse the value into `map[string]string`, `text` means to use the value as a string. ‘map’ sets the `multipleKeyValuesPerSecret` behavior. `text` makes Vault behave as a secret store with name/value semantics. Defaults to `"map"`	`"map"`, `"text"`

Optional per-request metadata properties

The following optional query parameters can be provided to Hashicorp Vault secret store component:

HuaweiCloud Cloud Secret Management Service (CSMS)

Mon, 01 Jan 0001 00:00:00 +0000

Component format

To setup HuaweiCloud Cloud Secret Management Service (CSMS) secret store create a component of type secretstores.huaweicloud.csms. See this guide on how to create and apply a secretstore configuration. See this guide on referencing secrets to retrieve and use the secret with Dapr components.

apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
 name: huaweicloudcsms
spec:
 type: secretstores.huaweicloud.csms
 version: v1
 metadata:
 - name: region
 value: "[huaweicloud_region]"
 - name: accessKey
 value: "[huaweicloud_access_key]"
 - name: secretAccessKey
 value: "[huaweicloud_secret_access_key]"

Warning

The above example uses secrets as plain strings. It is recommended to use a local secret store such as Kubernetes secret store or a local file to bootstrap secure key storage.

Spec metadata fields

Field	Required	Details	Example
region	Y	The specific region the HuaweiCloud CSMS instance is deployed in	`"cn-north-4"`
accessKey	Y	The HuaweiCloud Access Key to access this resource	`"accessKey"`
secretAccessKey	Y	The HuaweiCloud Secret Access Key to access this resource	`"secretAccessKey"`

Optional per-request metadata properties

The following optional query parameters can be provided when retrieving secrets from this secret store:

Kubernetes secrets

Mon, 01 Jan 0001 00:00:00 +0000

Default Kubernetes secret store component

When Dapr is deployed to a Kubernetes cluster, a secret store with the name kubernetes is automatically provisioned. This pre-provisioned secret store allows you to use the native Kubernetes secret store with no need to author, deploy or maintain a component configuration file for the secret store and is useful for developers looking to simply access secrets stored natively in a Kubernetes cluster.

A custom component definition file for a Kubernetes secret store can still be configured (See below for details). Using a custom definition decouples referencing the secret store in your code from the hosting platform as the store name is not fixed and can be customized, keeping your code more generic and portable. Additionally, by explicitly defining a Kubernetes secret store component you can connect to a Kubernetes secret store from a local Dapr self-hosted installation. This requires a valid kubeconfig file.

Local environment variables (for Development)

Mon, 01 Jan 0001 00:00:00 +0000

This Dapr secret store component uses locally defined environment variable and does not use authentication.

Warning

This approach to secret management is not recommended for production environments.

Component format

To setup local environment variables secret store create a component of type secretstores.local.env. Create a file with the following content in your ./components directory:

apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
 name: envvar-secret-store
spec:
 type: secretstores.local.env
 version: v1
 metadata:
 # - name: prefix
 # value: "MYAPP_"

Spec metadata fields

Field	Required	Details	Example
`prefix`	N	If set, limits operations to environment variables with the given prefix. The prefix is removed from the returned secrets’ names. The matching is case-insensitive on Windows and case-sensitive on all other operating systems.	`"MYAPP_"`

Notes

For security reasons, this component cannot be used to access these environment variables:

Local file (for Development)

Mon, 01 Jan 0001 00:00:00 +0000

This Dapr secret store component reads plain text JSON from a given file and does not use authentication.

Warning

This approach to secret management is not recommended for production environments.

Component format

To setup local file based secret store create a component of type secretstores.local.file. Create a file with the following content in your ./components directory:

apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
 name: local-secret-store
spec:
 type: secretstores.local.file
 version: v1
 metadata:
 - name: secretsFile
 value: [path to the JSON file]
 - name: nestedSeparator
 value: ":"
 - name: multiValued
 value: "false"

Spec metadata fields

Field	Required	Details	Example
secretsFile	Y	The path to the file where secrets are stored	`"path/to/file.json"`
nestedSeparator	N	Used by the store when flattening the JSON hierarchy to a map. Defaults to `":"`	`":"`
multiValued	N	`"true"` sets the `multipleKeyValuesPerSecret` behavior. Allows one level of multi-valued key/value pairs before flattening JSON hierarchy. Defaults to `"false"`	`"true"`

Setup JSON file to hold the secrets

Given the following JSON loaded from secretsFile:

OpenBao

Mon, 01 Jan 0001 00:00:00 +0000

Usage

Currently, there is no dedicated OpenBao Secrets Store. However, you can utilize the secretstores.hashicorp.vault component, which has been tested and confirmed to work effectively.

For instructions on how to set up and configure a secret store, refer to the HashiCorp Vault guide. The same metadata fields are compatible with OpenBao.

Example Component

---
apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
 name: openbao
spec:
 # Use the secrets store provider
 # from vault
 type: secretstores.hashicorp.vault
 version: v1
 metadata:
 - name: vaultAddr
 value: http://openbao.openbao.svc.cluster.local:8200
 - name: skipVerify # Optional. Default: false
 value: true
 - name: vaultToken
 secretKeyRef:
 name: roottoken
 key: token
 - name: enginePath # Optional. default: "secret"
 value: "secrets"
 - name: vaultValueType # Optional. default: "map"
 value: "map"

Further Information

Tencent Cloud Secrets Manager (SSM)

Mon, 01 Jan 0001 00:00:00 +0000

Component format

To setup Tencent Cloud Secrets Manager (SSM) secret store create a component of type secretstores.tencentcloud.ssm. See this guide on how to create and apply a secretstore configuration. See this guide on referencing secrets to retrieve and use the secret with Dapr components.

apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
 name: tencentcloudssm
spec:
 type: secretstores.tencentcloud.ssm
 version: v1
 metadata:
 - name: region
 value: "[tencentcloud_region]"
 - name: secretId
 value: "[tencentcloud_secret_id]"
 - name: secretKey
 value: "[tencentcloud_secret_key]"
 - name: token
 value: "[tencentcloud_secret_token]"

Warning

The above example uses secrets as plain strings. It is recommended to use a local secret store such as Kubernetes secret store or a local file to bootstrap secure key storage.

Spec metadata fields

Field	Required	Details	Example
region	Y	The specific region the Tencent SSM instance is deployed in	`"ap-beijing-3"`
secretId	Y	The SecretId of the Tencent Cloud account	`"xyz"`
secretKey	Y	The SecretKey of the Tencent Cloud account	`"xyz"`
token	N	The Token of the Tencent Cloud account. This is required only if using temporary credentials	`""`

Optional per-request metadata properties

The following optional query parameters can be provided when retrieving secrets from this secret store: