How-To: Install certificates in the Dapr sidecar

Configure the Dapr sidecar container to trust certificates

The Dapr sidecar can be configured to trust certificates for communicating with external services. This is useful in scenarios where a self-signed certificate needs to be trusted, such as:

  • Using an HTTP binding
  • Configuring an outbound proxy for the sidecar

Both certificate authority (CA) certificates and leaf certificates are supported.


You can make the following configurations when the sidecar is running as a container.

  1. Configure certificates to be available to the sidecar container using volume mounts.
  2. Point the environment variable SSL_CERT_DIR in the sidecar container to the directory containing the certificates.

Note: For Windows containers, make sure the container is running with administrator privileges so it can install the certificates.

The following example uses Docker Compose to install certificates (present locally in the ./certificates directory) in the sidecar container:

version: '3'
services:
  dapr-sidecar:
    image: "daprio/daprd:edge" # dapr version must be at least v1.8
    command: [
      "./daprd",
     "-app-id", "myapp",
     "-app-port", "3000",
     ]
    volumes:
        - "./components/:/components"
        - "./certificates:/certificates" # (STEP 1) Mount the certificates folder to the sidecar container
    environment:
      - "SSL_CERT_DIR=/certificates" # (STEP 2) Set the environment variable to the path of the certificates folder
    # Uncomment the line below for Windows containers
    # user: ContainerAdministrator

Note: When the sidecar is not running inside a container, certificates must be directly installed on the host operating system.


On Kubernetes:

  1. Configure certificates to be available to the sidecar container using a volume mount.
  2. Point the environment variable SSL_CERT_DIR in the sidecar container to the directory containing the certificates.

The following example YAML shows a deployment that:

  • Attaches a pod volume to the sidecar
  • Sets SSL_CERT_DIR to install the certificates
apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
  namespace: default
  labels:
    app: myapp
spec:
  replicas: 1
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
      annotations:
        dapr.io/enabled: "true"
        dapr.io/app-id: "myapp"
        dapr.io/app-port: "8000"
        dapr.io/volume-mounts: "certificates-vol:/tmp/certificates" # (STEP 1) Mount the certificates folder to the sidecar container
        dapr.io/env: "SSL_CERT_DIR=/tmp/certificates" # (STEP 2) Set the environment variable to the path of the certificates folder
    spec:
      volumes:
        - name: certificates-vol
          hostPath:
            path: /certificates
#...

Note: When using Windows containers, the sidecar container is started with admin privileges, which is required to install the certificates. This does not apply to Linux containers.

After following these steps, all the certificates in the directory pointed by SSL_CERT_DIR are installed.

Demo

Watch the demo on using installing SSL certificates and securely using the HTTP binding in community call 64:

Next steps

Enable preview features

Last modified August 8, 2024: finish freshness pass (31830bfe)