You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
title: Connect to other Azure or third-party services via Dapr components
3
+
description: Learn more about connecting Dapr components with Azure and external services.
4
+
ms.author: hannahhunter
5
+
author: hhunter-ms
6
+
ms.service: azure-container-apps
7
+
ms.custom: build-2023
8
+
ms.topic: conceptual
9
+
ms.date: 12/10/2024
10
+
---
11
+
12
+
# Connect to other Azure or third-party services via Dapr components
13
+
14
+
Securely establish connections to Azure and third-party services for Dapr components using managed identity or Azure Key Vault secret stores.
15
+
16
+
Before getting started, [learn more about the offered support for Dapr components.][supported-dapr-components]
17
+
18
+
## Recommendations
19
+
20
+
Whenever possible, it's recommended that you use Azure components that provide managed identity support for the most secure connection. Use Azure Key Vault secret stores *only* when managed identity authentication isn't supported.
21
+
22
+
| Service type | Recommendation |
23
+
| ------------ | -------------- |
24
+
| Azure component with managed identity support |[Use the managed identity flow (recommended)](#using-managed-identity-recommended)|
25
+
| Azure component without managed identity support |[Use an Azure Key Vault secret store](#azure-key-vault-secret-stores)|
26
+
| Non-Azure components |[Use an Azure Key Vault secret store](#azure-key-vault-secret-stores)|
27
+
28
+
29
+
## Using managed identity (recommended)
30
+
31
+
For Azure-hosted services, Dapr can use [the managed identity of the scoped container apps][aca-managed-id] to authenticate to the backend service provider. When using managed identity, you don't need to include secret information in a component manifest. **Using managed identity is recommended** as it eliminates storage of sensitive input in components and doesn't require managing a secret store.
32
+
33
+
> [!NOTE]
34
+
> The `azureClientId` metadata field (the client ID of the managed identity) is **required** for any component authenticating with user-assigned managed identity.
35
+
36
+
## Using a Dapr secret store component reference
37
+
38
+
When you create Dapr components for non-Entra ID enabled services or components that don't support managed identity authentication, certain metadata fields require sensitive input values. For this approach, retrieve these secrets by referencing an existing Dapr secret store component that securely accesses secret information.
39
+
40
+
To set up a reference:
41
+
42
+
1.[Create a Dapr secret store component using the Azure Container Apps schema.](#creating-a-dapr-secret-store-component) The component type for all supported Dapr secret stores begins with `secretstores.`.
43
+
1.[Create extra components (as needed) which reference the Dapr secret store component](#referencing-dapr-secret-store-components) you created to retrieve the sensitive metadata input.
44
+
45
+
### Creating a Dapr secret store component
46
+
47
+
When creating a secret store component in Azure Container Apps, you can provide sensitive information in the metadata section in either of the following ways:
48
+
49
+
-[For an **Azure Key Vault secret store**,](#using-managed-identity-recommended) use managed identity to establish the connection.
50
+
-[For **non-Azure secret stores**,](#platform-managed-kubernetes-secrets) use platform-managed Kubernetes secrets that are defined directly as part of the component manifest.
51
+
52
+
#### Azure Key Vault secret stores
53
+
54
+
The following component schema showcases the simplest possible secret store configuration using an Azure Key Vault secret store. `publisher-app` and `subscriber-app` are configured to both have a system or user-assigned managed identity with appropriate permissions on the Azure Key Vault instance.
55
+
56
+
```yaml
57
+
componentType: secretstores.azure.keyvault
58
+
version: v1
59
+
metadata:
60
+
- name: vaultName
61
+
value: [your_keyvault_name]
62
+
- name: azureEnvironment
63
+
value: "AZUREPUBLICCLOUD"
64
+
- name: azureClientId # Only required for authenticating user-assigned managed identity
65
+
value: [your_managed_identity_client_id]
66
+
scopes:
67
+
- publisher-app
68
+
- subscriber-app
69
+
```
70
+
71
+
#### Platform-managed Kubernetes secrets
72
+
73
+
As an alternative to Kubernetes secrets, Local environment variables, and Local file Dapr secret stores, Azure Container Apps provides a platform-managed approach for creating and leveraging Kubernetes secrets. This approach can be used to connect to non-Azure services or in dev/test scenarios for quickly deploying components via the CLI without setting up a secret store or managed identity.
74
+
75
+
This component configuration defines the sensitive value as a secret parameter that can be referenced from the metadata section.
76
+
77
+
```yaml
78
+
componentType: secretstores.azure.keyvault
79
+
version: v1
80
+
metadata:
81
+
- name: vaultName
82
+
value: [your_keyvault_name]
83
+
- name: azureEnvironment
84
+
value: "AZUREPUBLICCLOUD"
85
+
- name: azureTenantId
86
+
value: "[your_tenant_id]"
87
+
- name: azureClientId
88
+
value: "[your_client_id]"
89
+
- name: azureClientSecret
90
+
secretRef: azClientSecret
91
+
secrets:
92
+
- name: azClientSecret
93
+
value: "[your_client_secret]"
94
+
scopes:
95
+
- publisher-app
96
+
- subscriber-app
97
+
```
98
+
99
+
### Referencing Dapr secret store components
100
+
101
+
Once you [create a Dapr secret store using one of the previous approaches](#creating-a-dapr-secret-store-component), you can reference that secret store from other Dapr components in the same environment. The following example demonstrates using Entra ID authentication.
# Connect to Azure services via Dapr components in the Azure portal
14
14
15
-
You can easily connect Dapr APIs to backing Azure services using a combination of [Service Connector](../service-connector/overview.md) and [Dapr](https://docs.dapr.io/). This feature creates Dapr components on your behalf with valid metadata and authenticated identity to access the Azure service.
15
+
You can easily connect Dapr APIs to [backing Azure services](./dapr-overview.md#dapr-components) using a combination of [Service Connector](../service-connector/overview.md) and [Dapr](https://docs.dapr.io/). This feature creates Dapr components on your behalf with valid metadata and authenticated identity to access the Azure service.
16
16
17
-
In this guide, you'll connect Dapr Pub/Sub API to an Azure Service Bus by:
17
+
In this guide, you connect Dapr Pub/Sub API to an Azure Service Bus by:
18
18
> [!div class="checklist"]
19
19
> - Select pub/sub as the API
20
20
> - Specify Azure Service Bus as the service and required properties like namespace, queue name, and identity
@@ -45,7 +45,7 @@ For example, for a pub/sub Azure Service Bus component, you'll start with the fo
45
45
46
46
| Field | Example | Description |
47
47
| ----- | ------- | ----------- |
48
-
| Component name | mycomponent | Enter a name for your Dapr component. The name must match the component referenced in your application code. |
48
+
| Component name |`mycomponent`| Enter a name for your Dapr component. The name must match the component referenced in your application code. |
49
49
| Building block | Pub/sub | Select the [building block/API](https://docs.dapr.io/developing-applications/building-blocks/) for your component from the drop-down. |
50
50
| Component type | Service Bus | Select a component type from the drop-down. |
51
51
@@ -54,9 +54,9 @@ The component creation pane populates with different fields depending on the bui
54
54
| Field | Example | Description |
55
55
| ----- | ------- | ----------- |
56
56
| Subscription | My subscription | Select your Azure subscription |
57
-
| Namespace | mynamespace | Select the Service Bus namespace |
57
+
| Namespace |`mynamespace`| Select the Service Bus namespace |
58
58
| Authentication | User assigned managed identity | Select the subscription that contains the component you're looking for. Recommended: User assigned managed identity. |
59
-
| User assigned managed identity | testidentity | Select an existing identity from the drop-down. If you don’t already have one, you can create a new managed identity client ID. |
59
+
| User assigned managed identity |`testidentity`| Select an existing identity from the drop-down. If you don’t already have one, you can create a new managed identity client ID. |
60
60
61
61
:::image type="content" source="media/dapr-component-connection/add-pubsub-component.png" alt-text="Screenshot of the Azure platform showing the Basics tab of adding a Dapr Pub/sub component.":::
62
62
@@ -101,10 +101,10 @@ You can then check the YAML/Bicep artifact into a repo and recreate it outside o
101
101
102
102
## Next steps
103
103
104
-
[Enable Dapr on your container apps.](./enable-dapr.md)
104
+
[Learn how to set Dapr component resiliency.](./dapr-component-resiliency.md)
105
105
106
106
## Related links
107
107
108
108
Learn more about:
109
109
-[Using Dapr with Azure Container Apps](./dapr-overview.md)
110
-
-[Connecting to cloud services using Service Connector](./service-connector.md)
110
+
-[Connecting to cloud services using Service Connector](./service-connector.md)
For Azure-hosted services, Dapr can use [the managed identity of the scoped container apps][aca-managed-id] to authenticate to the backend service provider. When using managed identity, you don't need to include secret information in a component manifest. Using managed identity is preferred as it eliminates storage of sensitive input in components and doesn't require managing a secret store.
88
-
89
-
> [!NOTE]
90
-
> The `azureClientId` metadata field (the client ID of the managed identity) is **required** for any component authenticating with user-assigned managed identity.
91
-
92
-
### Using a Dapr secret store component reference
93
-
94
-
When you create Dapr components for non-Entra ID enabled services, certain metadata fields require sensitive input values. The recommended approach for retrieving these secrets is to reference an existing Dapr secret store component that securely accesses secret information.
95
-
96
-
To set up a reference:
97
-
98
-
1. [Create a Dapr secret store component using the Azure Container Apps schema.](#creating-a-dapr-secret-store-component) The component type for all supported Dapr secret stores begins with `secretstores.`.
99
-
1. [Create extra components (as needed) which reference the Dapr secret store component](#referencing-dapr-secret-store-components) you created to retrieve the sensitive metadata input.
100
-
101
-
#### Creating a Dapr secret store component
102
-
103
-
When creating a secret store component in Azure Container Apps, you can provide sensitive information in the metadata section in either of the following ways:
104
-
105
-
- [For an **Azure Key Vault secret store**,](#using-managed-identity) use managed identity to establish the connection.
106
-
- [For **non-Azure secret stores**,](#platform-managed-kubernetes-secrets) use platform-managed Kubernetes secrets that are defined directly as part of the component manifest.
107
-
108
-
##### Azure Key Vault secret stores
109
-
110
-
The following component showcases the simplest possible secret store configuration using an Azure Key Vault secret store. In this example, publisher and subscriber applications are configured to both have a system or user-assigned managed identity with appropriate permissions on the Azure Key Vault instance.
111
-
112
-
```yaml
113
-
componentType: secretstores.azure.keyvault
114
-
version: v1
115
-
metadata:
116
-
- name: vaultName
117
-
value: [your_keyvault_name]
118
-
- name: azureEnvironment
119
-
value: "AZUREPUBLICCLOUD"
120
-
- name: azureClientId # Only required for authenticating user-assigned managed identity
121
-
value: [your_managed_identity_client_id]
122
-
scopes:
123
-
- publisher-app
124
-
- subscriber-app
125
-
```
126
-
127
-
##### Platform-managed Kubernetes secrets
128
-
129
-
Kubernetes secrets, Local environment variables, and Local file Dapr secret stores aren't supported in Azure Container Apps. As an alternative for the upstream Dapr default Kubernetes secret store, Azure Container Apps provides a platform-managed approach for creating and leveraging Kubernetes secrets.
130
-
131
-
This component configuration defines the sensitive value as a secret parameter that can be referenced from the metadata section. This approach can be used to connect to non-Azure services or in dev/test scenarios for quickly deploying components via the CLI without setting up a secret store or managed identity.
132
-
133
-
```yaml
134
-
componentType: secretstores.azure.keyvault
135
-
version: v1
136
-
metadata:
137
-
- name: vaultName
138
-
value: [your_keyvault_name]
139
-
- name: azureEnvironment
140
-
value: "AZUREPUBLICCLOUD"
141
-
- name: azureTenantId
142
-
value: "[your_tenant_id]"
143
-
- name: azureClientId
144
-
value: "[your_client_id]"
145
-
- name: azureClientSecret
146
-
secretRef: azClientSecret
147
-
secrets:
148
-
- name: azClientSecret
149
-
value: "[your_client_secret]"
150
-
scopes:
151
-
- publisher-app
152
-
- subscriber-app
153
-
```
154
-
155
-
#### Referencing Dapr secret store components
156
-
157
-
Once you [create a Dapr secret store using one of the previous approaches](#creating-a-dapr-secret-store-component), you can reference that secret store from other Dapr components in the same environment. The following example demonstrates using Entra ID authentication.
0 commit comments