Skip to content

Commit 9cd23fd

Browse files
committed
Raj review
Signed-off-by: Hannah Hunter <[email protected]>
1 parent 6114135 commit 9cd23fd

File tree

4 files changed

+28
-19
lines changed

4 files changed

+28
-19
lines changed

articles/container-apps/TOC.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -278,9 +278,9 @@
278278
href: dapr-functions-extension.md
279279
- name: Dapr components
280280
items:
281-
- name: Overview
281+
- name: Dapr components overview
282282
href: dapr-components.md
283-
- name: Connect to external services
283+
- name: Connect to Azure or third-party services
284284
href: dapr-component-connect-services.md
285285
- name: Connect to Azure services via Azure portal
286286
href: dapr-component-connection.md

articles/container-apps/dapr-component-connect-services.md

Lines changed: 21 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,39 @@
11
---
2-
title: Connect to external services via Dapr components
2+
title: Connect to other Azure or third-party services via Dapr components
33
description: Learn more about connecting Dapr components with Azure and external services.
44
ms.author: hannahhunter
55
author: hhunter-ms
66
ms.service: azure-container-apps
77
ms.custom: build-2023
88
ms.topic: conceptual
9-
ms.date: 09/23/2024
9+
ms.date: 12/03/2024
1010
---
1111

12-
# Connect to external services via Dapr components
12+
# Connect to other Azure or third-party services via Dapr components
1313

14-
Securely establish connections to Azure and external services for Dapr components using any of the following approaches.
14+
Securely establish connections to Azure and third-party services for Dapr components using managed identity or Azure Key Vault secret stores. Before you get started, [learn more about the Tier 1 and Tier 2 levels of support for Dapr components.][dapr-tiers]
1515

16-
1. [Using managed identity](#using-managed-identity)
17-
1. Using a Dapr secret store component reference by creating either:
18-
- [An Azure Key Vault secret store](#azure-key-vault-secret-stores), which uses managed identity, or
19-
- [Platform-Managed Kubernetes secrets](#platform-managed-kubernetes-secrets)
16+
## Recommendations
2017

21-
## Using managed identity
18+
Whenever possible, we recommend using Azure components that provide managed identity support for the most secure connection. Use Azure Key Vault secret stores *only* when managed identity authentication isn't supported.
2219

23-
For Azure-hosted services, Dapr can use [the managed identity of the scoped container apps][aca-managed-id] to authenticate to the backend service provider. When using managed identity, you don't need to include secret information in a component manifest. Using managed identity is preferred as it eliminates storage of sensitive input in components and doesn't require managing a secret store.
20+
| Service type | Recommendation |
21+
| ------------ | -------------- |
22+
| Azure component with managed identity support | [Use the managed identity flow (recommended)](#using-managed-identity-recommended) |
23+
| Azure component without managed identity support | [Use an Azure Key Vault secret store](#azure-key-vault-secret-stores) |
24+
| Non-Azure components | [Use an Azure Key Vault secret store](#azure-key-vault-secret-stores) |
25+
26+
27+
## Using managed identity (recommended)
28+
29+
For Azure-hosted services, Dapr can use [the managed identity of the scoped container apps][aca-managed-id] to authenticate to the backend service provider. When using managed identity, you don't need to include secret information in a component manifest. **Using managed identity is recommended** as it eliminates storage of sensitive input in components and doesn't require managing a secret store.
2430

2531
> [!NOTE]
2632
> The `azureClientId` metadata field (the client ID of the managed identity) is **required** for any component authenticating with user-assigned managed identity.
2733
2834
## Using a Dapr secret store component reference
2935

30-
When you create Dapr components for non-Entra ID enabled services, certain metadata fields require sensitive input values. The recommended approach for retrieving these secrets is to reference an existing Dapr secret store component that securely accesses secret information.
36+
When you create Dapr components for non-Entra ID enabled services or components that don't support managed identity authentication, certain metadata fields require sensitive input values. For this approach, retrieve these secrets by referencing an existing Dapr secret store component that securely accesses secret information.
3137

3238
To set up a reference:
3339

@@ -43,7 +49,7 @@ When creating a secret store component in Azure Container Apps, you can provide
4349

4450
#### Azure Key Vault secret stores
4551

46-
The following component showcases the simplest possible secret store configuration using an Azure Key Vault secret store. In this example, publisher and subscriber applications are configured to both have a system or user-assigned managed identity with appropriate permissions on the Azure Key Vault instance.
52+
The following component schema showcases the simplest possible secret store configuration using an Azure Key Vault secret store. `publisher-app` and `subscriber-app` are configured to both have a system or user-assigned managed identity with appropriate permissions on the Azure Key Vault instance.
4753

4854
```yaml
4955
componentType: secretstores.azure.keyvault
@@ -62,9 +68,9 @@ scopes:
6268
6369
#### Platform-managed Kubernetes secrets
6470
65-
Kubernetes secrets, Local environment variables, and Local file Dapr secret stores aren't supported in Azure Container Apps. As an alternative for the upstream Dapr default Kubernetes secret store, Azure Container Apps provides a platform-managed approach for creating and leveraging Kubernetes secrets.
71+
As an alternative to Kubernetes secrets, Local environment variables, and Local file Dapr secret stores, Azure Container Apps provides a platform-managed approach for creating and leveraging Kubernetes secrets. This approach can be used to connect to non-Azure services or in dev/test scenarios for quickly deploying components via the CLI without setting up a secret store or managed identity.
6672
67-
This component configuration defines the sensitive value as a secret parameter that can be referenced from the metadata section. This approach can be used to connect to non-Azure services or in dev/test scenarios for quickly deploying components via the CLI without setting up a secret store or managed identity.
73+
This component configuration defines the sensitive value as a secret parameter that can be referenced from the metadata section.
6874
6975
```yaml
7076
componentType: secretstores.azure.keyvault
@@ -123,6 +129,7 @@ scopes:
123129
[aca-managed-id]: ./managed-identity.md
124130
[dapr-resiliency]: ./dapr-component-resiliency.md
125131
[dapr-components-connect-services]: ./dapr-component-connect-services.md
132+
[dapr-tiers]: ./dapr-overview.md#tier-1-versus-tier-2-components
126133
127134
<!-- Links External -->
128135

articles/container-apps/dapr-components.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: hhunter-ms
66
ms.service: azure-container-apps
77
ms.custom: build-2023
88
ms.topic: conceptual
9-
ms.date: 12/02/2024
9+
ms.date: 12/03/2024
1010
---
1111

1212
# Dapr components in Azure Container Apps
@@ -71,7 +71,7 @@ scopes:
7171
```
7272

7373
> [!NOTE]
74-
> Dapr component scopes correspond to the Dapr application ID of a container app, not the container app name.
74+
> Dapr component scopes provide better security measures and correspond to the Dapr application ID of a container app, not the container app name.
7575

7676
## Component examples
7777

@@ -183,8 +183,8 @@ This resource defines a Dapr component called `dapr-pubsub` via ARM.
183183
[aca-managed-id]: ./managed-identity.md
184184
[dapr-resiliency]: ./dapr-component-resiliency.md
185185
[dapr-components-connect-services]: ./dapr-component-connect-services.md
186+
[dapr-component]: ./dapr-overview.md#tier-1-versus-tier-2-components
186187

187188
<!-- Links External -->
188189

189-
[dapr-component]: https://docs.dapr.io/concepts/components-concept/
190190
[dapr-component-spec]: https://docs.dapr.io/reference/resource-specs/

articles/container-apps/dapr-overview.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,8 @@ Dapr's latest client SDK packages are compatible with Azure Container Apps. You
6464
6565
[!INCLUDE [component-support](~/reusable-content/ce-skilling/azure/includes/dapr-in-azure/dapr-support-policy.md)]
6666

67+
[Learn more about how to use the supported Dapr components in Azure Container Apps.][dapr-components]
68+
6769
### Tooling
6870

6971
Azure Container Apps ensures compatibility with Dapr open source tooling, such as SDKs and the CLI.

0 commit comments

Comments
 (0)