Azure Key Vault secret store

Component format

To setup Azure Key Vault secret store create a component of type secretstores.azure.keyvault. See this guide on how to create and apply a secretstore configuration. See this guide on referencing secrets to retrieve and use the secret with Dapr components.

See also configure the component guide in this page.

apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
  name: azurekeyvault
  namespace: default
spec:
  type: secretstores.azure.keyvault
  version: v1
  metadata:
  - name: vaultName
    value: [your_keyvault_name]
  - name: spnTenantId
    value: "[your_service_principal_tenant_id]"
  - name: spnClientId
    value: "[your_service_principal_app_id]"
    value : "[pfx_certificate_contents]"
  - name: spnCertificateFile
    value : "[pfx_certificate_file_fully_qualified_local_path]"

Spec metadata fields

Self-Hosted

Kubernetes

Setup Key Vault and service principal

Prerequisites

• Azure Subscription
• Azure CLI

Steps

1. Login to Azure and set the default subscription

   # Log in Azure
   az login
   
   # Set your subscription to the default subscription
   az account set -s [your subscription id]
   

2. Create an Azure Key Vault in a region

   az keyvault create --location [region] --name [your_keyvault] --resource-group [your resource group]
   

3. Create a service principal

   Create a service principal with a new certificate and store the 1-year certificate inside your keyvault’s certificate vault. You can skip this step if you want to use an existing service principal for keyvault instead of creating new one

   az ad sp create-for-rbac --name [your_service_principal_name] --create-cert --cert [certificate_name] --keyvault [your_keyvault] --skip-assignment --years 1
   
   {
      "appId": "a4f90000-0000-0000-0000-00000011d000",
      "displayName": "[your_service_principal_name]",
      "name": "http://[your_service_principal_name]",
      "password": null,
      "tenant": "34f90000-0000-0000-0000-00000011d000"
   }
   

   Save both the appId and tenant from the output which will be used in the next step

4. Get the Object Id for [your_service_principal_name]

   az ad sp show --id [service_principal_app_id]
   
   {
       ...
       "objectId": "[your_service_principal_object_id]",
       "objectType": "ServicePrincipal",
       ...
   }
   

5. Grant the service principal the GET permission to your Azure Key Vault

   az keyvault set-policy --name [your_keyvault] --object-id [your_service_principal_object_id] --secret-permissions get
   

   Now that your service principal has access to your keyvault you are ready to configure the secret store component to use secrets stored in your keyvault to access other components securely.

6. Download the certificate in PFX format from your Azure Key Vault either using the Azure portal or the Azure CLI:

• Using the Azure portal:

  Go to your key vault on the Azure portal and navigate to the Certificates tab under Settings. Find the certificate that was created during the service principal creation, named [certificate_name] and click on it.

  Click Download in PFX/PEM format to download the certificate.

• Using the Azure CLI:

  az keyvault secret download --vault-name [your_keyvault] --name [certificate_name] --encoding base64 --file [certificate_name].pfx
  

Configure the component

• Self-Hosted
• Kubernetes

apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
  name: azurekeyvault
  namespace: default
spec:
  type: secretstores.azure.keyvault
  version: v1
  metadata:
  - name: vaultName
    value: [your_keyvault_name]
  - name: spnTenantId
    value: "[your_service_principal_tenant_id]"
  - name: spnClientId
    value: "[your_service_principal_app_id]"
  - name: spnCertificate
    secretKeyRef:
      name: [your_k8s_spn_secret_name]
      key: [your_k8s_spn_secret_key]
auth:
    secretStore: kubernetes

kubectl apply -f azurekeyvault.yaml

References

• Azure CLI Keyvault CLI
• Create an Azure service principal with Azure CLI
• Secrets building block
• How-To: Retrieve a secret
• How-To: Reference secrets in Dapr components
• Secrets API reference