DEV Community

Siri Varma Vegiraju
Siri Varma Vegiraju

Posted on

Enabling mTLS with Dapr Sidecar communication

#cloudcomputing #cloud #cloudnative

Dapr mTLS Setup and Configuration Summary

Overview

Dapr supports in-transit encryption between Dapr instances using the Sentry service, which acts as a central Certificate Authority (CA). You can either bring your own certificates or let Dapr automatically create self-signed certificates.

Key Features:

  • Automatic self-signed certificate generation (valid for 1 year)
  • Support for custom certificates
  • Certificate rotation capabilities
  • Monitoring and alerting for certificate expiration

Configuration Structure

Control Plane Configuration

mTLS is configured through a Dapr Configuration resource:

apiVersion: dapr.io/v1alpha1
kind: Configuration
metadata:
  name: daprsystem
  namespace: default
spec:
  mtls:
    enabled: true
    workloadCertTTL: "24h"
    allowedClockSkew: "15m"
Enter fullscreen mode Exit fullscreen mode

Kubernetes Deployment

Default Setup

  • mTLS enabled by default when deploying Dapr to Kubernetes
  • Certificates persisted to Kubernetes secrets in the Dapr system namespace
  • Sentry service installed via Helm or Dapr CLI

Configuration Management

View current configuration:

kubectl get configurations/daprsystem --namespace <DAPR_NAMESPACE> -o yaml
Enter fullscreen mode Exit fullscreen mode

Edit configuration:

kubectl edit configurations/daprsystem --namespace <DAPR_NAMESPACE>
Enter fullscreen mode Exit fullscreen mode

Restart control plane after changes:

kubectl rollout restart deploy/dapr-sentry -n <DAPR_NAMESPACE>
kubectl rollout restart deploy/dapr-operator -n <DAPR_NAMESPACE>
kubectl rollout restart statefulsets/dapr-placement-server -n <DAPR_NAMESPACE>
Enter fullscreen mode Exit fullscreen mode

Disabling mTLS

Via Helm:

kubectl create ns dapr-system
helm install \
  --set global.mtls.enabled=false \
  --namespace dapr-system \
  dapr \
  dapr/dapr
Enter fullscreen mode Exit fullscreen mode

Via CLI:

dapr init --kubernetes --enable-mtls=false
Enter fullscreen mode Exit fullscreen mode

Bring Your Own Certificates

Generate certificates using OpenSSL:

  1. Create configuration files (root.conf and issuer.conf)
  2. Generate root certificate and key: 
openssl ecparam -genkey -name prime256v1 | openssl ec -out root.key
openssl req -new -nodes -sha256 -key root.key -out root.csr -config root.conf -extensions v3_req
openssl x509 -req -sha256 -days 365 -in root.csr -signkey root.key -outform PEM -out root.pem -extfile root.conf -extensions v3_req
Enter fullscreen mode Exit fullscreen mode
  1. Generate issuer certificate and key: 
openssl ecparam -genkey -name prime256v1 | openssl ec -out issuer.key
openssl req -new -sha256 -key issuer.key -out issuer.csr -config issuer.conf -extensions v3_req
openssl x509 -req -in issuer.csr -CA root.pem -CAkey root.key -CAcreateserial -outform PEM -out issuer.pem -days 365 -sha256 -extfile issuer.conf -extensions v3_req
Enter fullscreen mode Exit fullscreen mode

Install with custom certificates:

kubectl create ns dapr-system
helm install \
  --set-file dapr_sentry.tls.issuer.certPEM=issuer.pem \
  --set-file dapr_sentry.tls.issuer.keyPEM=issuer.key \
  --set-file dapr_sentry.tls.root.certPEM=root.pem \
  --namespace dapr-system \
  dapr \
  dapr/dapr
Enter fullscreen mode Exit fullscreen mode

Certificate Renewal

CLI-based renewal (Recommended):

Generate new certificates:

# Brand new certificates with new root key
dapr mtls renew-certificate -k --valid-until <days> --restart

# New certificates with existing root key (no downtime)
dapr mtls renew-certificate -k --private-key <private_key_file_path> --valid-until <days>

# Using custom certificates
dapr mtls renew-certificate -k --ca-root-certificate <ca.crt> --issuer-private-key <issuer.key> --issuer-public-certificate <issuer.crt> --restart
Enter fullscreen mode Exit fullscreen mode

Manual certificate rotation:

# Update certificates via Helm
helm upgrade \
  --set-file dapr_sentry.tls.issuer.certPEM=issuer.pem \
  --set-file dapr_sentry.tls.issuer.keyPEM=issuer.key \
  --set-file dapr_sentry.tls.root.certPEM=root.pem \
  --namespace dapr-system \
  dapr \
  dapr/dapr
Enter fullscreen mode Exit fullscreen mode

Avoiding Downtime

  • Critical: Always sign new certificates with the same private root key
  • If using different root key, restart Sentry service and all control plane components
  • Restart application deployments: kubectl rollout restart deploy/myapp

Self-Hosted Deployment

Setup Requirements

  • mTLS disabled by default in self-hosted mode
  • Manual configuration required

Running Sentry Service 

# Create certificate directory
mkdir -p $HOME/.dapr/certs

# Run Sentry service
./sentry --issuer-credentials $HOME/.dapr/certs --trust-domain cluster.local
Enter fullscreen mode Exit fullscreen mode

Dapr Instance Configuration

Configuration file:

apiVersion: dapr.io/v1alpha1
kind: Configuration
metadata:
  name: daprsystem
  namespace: default
spec:
  mtls:
    enabled: true
Enter fullscreen mode Exit fullscreen mode

Environment variables (Linux/Mac):

export DAPR_TRUST_ANCHORS=`cat $HOME/.dapr/certs/ca.crt`
export DAPR_CERT_CHAIN=`cat $HOME/.dapr/certs/issuer.crt`
export DAPR_CERT_KEY=`cat $HOME/.dapr/certs/issuer.key`
export NAMESPACE=default
Enter fullscreen mode Exit fullscreen mode

Environment variables (Windows):

$env:DAPR_TRUST_ANCHORS=$(Get-Content -raw $env:USERPROFILE\.dapr\certs\ca.crt)
$env:DAPR_CERT_CHAIN=$(Get-Content -raw $env:USERPROFILE\.dapr\certs\issuer.crt)
$env:DAPR_CERT_KEY=$(Get-Content -raw $env:USERPROFILE\.dapr\certs\issuer.key)
$env:NAMESPACE="default"
Enter fullscreen mode Exit fullscreen mode

Run Dapr with mTLS:

# Using Dapr CLI
dapr run --app-id myapp --config ./config.yaml node myapp.js

# Using daprd directly
daprd --app-id myapp --enable-mtls --sentry-address localhost:50001 --config=./config.yaml
Enter fullscreen mode Exit fullscreen mode

Custom Certificates (Self-Hosted)

Using step tool:

# Create root certificate
step certificate create cluster.local ca.crt ca.key --profile root-ca --no-password --insecure

# Create issuer certificate
step certificate create cluster.local issuer.crt issuer.key --ca ca.crt --ca-key ca.key --profile intermediate-ca --not-after 8760h --no-password --insecure

# Launch Sentry with custom certificates
./sentry --issuer-credentials $HOME/.dapr/certs --trust-domain cluster.local
Enter fullscreen mode Exit fullscreen mode

Monitoring and Alerting

Certificate Expiration Monitoring

  • Warning logs: Emitted 30 days before certificate expiration
  • Log format: Hourly warnings in Sentry service logs
  • CLI status: Shows certificate expiration when running dapr status -k

Example warning log:

{
  "instance": "dapr-sentry-68cbf79bb9-gdqdv",
  "level": "warning",
  "msg": "Dapr root certificate expiration warning: certificate expires in 2 days and 15 hours",
  "scope": "dapr.sentry",
  "time": "2022-04-01T23:43:35.931825236Z",
  "type": "log",
  "ver": "1.6.0"
}
Enter fullscreen mode Exit fullscreen mode

View Sentry logs:

kubectl logs --selector=app=dapr-sentry --namespace <DAPR_NAMESPACE>
Enter fullscreen mode Exit fullscreen mode

Advanced Features

Token Validators

JWKS Validator Configuration:

kind: Configuration
apiVersion: dapr.io/v1alpha1
metadata:
  name: sentryconfig
spec:
  mtls:
    enabled: true
    tokenValidators:
      - name: jwks
        options:
          minRefreshInterval: 2m
          requestTimeout: 1m
          source: "https://localhost:1234/"
          caCertificate: "<optional ca certificate bundle string>"
Enter fullscreen mode Exit fullscreen mode

Static JWKS Configuration:

kind: Configuration
apiVersion: dapr.io/v1alpha1
metadata:
  name: sentryconfig
spec:
  mtls:
    enabled: true
    tokenValidators:
      - name: jwks
        options:
          minRefreshInterval: 2m
          requestTimeout: 1m
          source: |
            {"keys":[ "12345.." ]}
Enter fullscreen mode Exit fullscreen mode

Best Practices

Certificate Management

  • Always use the same private root key when rotating certificates to avoid downtime
  • Monitor certificate expiration 30 days in advance
  • Set up automated alerts for certificate expiration warnings
  • Test certificate rotation in non-production environments first

Production Considerations

  • Configure monitoring for Sentry service logs
  • Implement automated certificate renewal where possible
  • Plan maintenance windows for certificate rotation if downtime is unavoidable
  • Document certificate rotation procedures for your team

Security

  • Protect private keys with appropriate file permissions
  • Use strong certificate validity periods (not too short, not too long)
  • Regular certificate rotation as part of security hygiene
  • Audit certificate usage and access patterns

Reference: https://docs.dapr.io/operations/security/mtls/

Top comments (0)

Some comments may only be visible to logged-in visitors. Sign in to view all comments.