Skip to content

Commit e2d4d1e

Browse files
fackeezjx244729mukundansundar
authored
replace vault to local (dapr#719)
* replace vault to local Signed-off-by: zjx244729 <[email protected]> * change secret store name style Signed-off-by: zjx244729 <[email protected]> * delete vault token file Signed-off-by: zjx244729 <[email protected]> * remove vault int validate.yml Signed-off-by: zjx244729 <[email protected]> * fix it secret case Signed-off-by: zjx244729 <[email protected]> * replace vault to local Signed-off-by: zjx244729 <[email protected]> * change secret store name style Signed-off-by: zjx244729 <[email protected]> * delete vault token file Signed-off-by: zjx244729 <[email protected]> * remove vault int validate.yml Signed-off-by: zjx244729 <[email protected]> * fix it secret case Signed-off-by: zjx244729 <[email protected]> * fix it dead loop Signed-off-by: zjx244729 <[email protected]> Co-authored-by: zjx244729 <[email protected]> Co-authored-by: Mukundan Sundararajan <[email protected]>
1 parent 65936ee commit e2d4d1e

File tree

15 files changed

+166
-285
lines changed

15 files changed

+166
-285
lines changed

‎.github/workflows/build.yml

-4
Original file line numberDiff line numberDiff line change
@@ -87,10 +87,6 @@ jobs:
8787
run: |
8888
docker-compose -f ./sdk-tests/deploy/local-test-kafka.yml up -d
8989
docker ps
90-
- name: Install Local Hashicorp Vault using docker-compose
91-
run: |
92-
docker-compose -f ./sdk-tests/deploy/local-test-vault.yml up -d
93-
docker ps
9490
- name: Install Local mongo database using docker-compose
9591
run: |
9692
docker-compose -f ./sdk-tests/deploy/local-test-mongo.yml up -d

‎.github/workflows/validate.yml

-9
Original file line numberDiff line numberDiff line change
@@ -99,15 +99,6 @@ jobs:
9999
echo "PATH=$PATH:$HOME/.local/bin" >> $GITHUB_ENV
100100
pip3 install setuptools wheel
101101
pip3 install mechanical-markdown
102-
- name: Install Vault CLI
103-
run: |
104-
# From the installtion page of vault https://learn.hashicorp.com/tutorials/vault/getting-started-install?in=vault/getting-started
105-
curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo apt-key add -
106-
sudo apt-add-repository "deb [arch=amd64] https://apt.releases.hashicorp.com $(lsb_release -cs) main"
107-
sudo apt-get update
108-
sudo apt-get install vault
109-
# Verify vault is installed
110-
vault -h
111102
- name: Install Local mongo database using docker-compose
112103
run: |
113104
docker-compose -f ./sdk-tests/deploy/local-test-mongo.yml up -d

‎examples/.hashicorp_vault_token

-1
This file was deleted.

‎examples/components/secrets/hashicorp_vault.yaml

-16
This file was deleted.

‎examples/components/secrets/local_file.yaml

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: dapr.io/v1alpha1
2+
kind: Component
3+
metadata:
4+
name: localSecretStore
5+
namespace: default
6+
spec:
7+
type: secretstores.local.file
8+
version: v1
9+
metadata:
10+
- name: secretsFile
11+
value: "./components/secrets/secret.json"
12+
- name: nestedSeparator
13+
value: ":"
14+
- name: multiValued
15+
value: "false"

‎examples/src/main/java/io/dapr/examples/secrets/README.md

+61-145
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,28 @@
11
# Dapr's Secret Store Sample
22

3-
In this sample, we'll see how to retrieve a secret using Dapr's Java SDK.
3+
In this sample, we'll see how to retrieve a secret using Dapr's Java SDK.
44
This sample includes two files:
55

6-
* docker-compose-vault.yml (Starts Hashicorp's Vault as a container)
76
* SecretClient.java (Reads a secret from Dapr's Secret Store)
8-
* Existing Dapr component file in `< repo dir >/examples/components/hashicorp_vault.yaml`
9-
* Existing token file in `< repo dir >/examples/.hashicorp_vault_token` (Consumed by `daprd`'s vault component above)
7+
* Existing Dapr component file in `< repo dir >/examples/components/local_file.yaml`
108

119
Visit [this](https://docs.dapr.io/developing-applications/building-blocks/secrets/secrets-overview/) link for more information about secret stores in Dapr.
12-
10+
1311
## Secret store sample using the Java-SDK
1412

15-
In this example, the component used is Hashicorp Vault, but others are also available.
13+
In this example, the component used is local file(not recommended for production use), but others are also available.
1614

17-
Visit [this](https://github.com/dapr/components-contrib/tree/master/secretstores) link for more information about secret stores implementations.
15+
Visit [this](https://github.com/dapr/components-contrib/tree/master/secretstores) link for more information about secret store implementations.
1816

1917

2018
## Pre-requisites
2119

2220
* [Dapr and Dapr Cli](https://docs.dapr.io/getting-started/install-dapr/).
2321
* Java JDK 11 (or greater):
24-
* [Microsoft JDK 11](https://docs.microsoft.com/en-us/java/openjdk/download#openjdk-11)
25-
* [Oracle JDK 11](https://www.oracle.com/technetwork/java/javase/downloads/index.html#JDK11)
26-
* [OpenJDK 11](https://jdk.java.net/11/)
22+
* [Microsoft JDK 11](https://docs.microsoft.com/en-us/java/openjdk/download#openjdk-11)
23+
* [Oracle JDK 11](https://www.oracle.com/technetwork/java/javase/downloads/index.html#JDK11)
24+
* [OpenJDK 11](https://jdk.java.net/11/)
2725
* [Apache Maven](https://maven.apache.org/install.html) version 3.x.
28-
* Hashicorp's vault client [installed](https://www.vaultproject.io/docs/install/).
2926

3027
### Checking out the code
3128

@@ -49,167 +46,89 @@ Then get into the examples directory:
4946
cd examples
5047
```
5148

52-
### Setting Vault locally
53-
54-
Before getting into the application code, follow these steps in order to set up a local instance of Vault. This is needed for the local instances. Steps are:
55-
56-
1. To run the vault container locally run:
57-
<!-- Docker is writing output to stderr ... -->
58-
59-
<!-- STEP
60-
name: Start vault
61-
expected_stderr_lines:
62-
- 'Creating network "secrets_default" with the default driver'
63-
sleep: 10
64-
-->
65-
66-
```bash
67-
docker-compose -f ./src/main/java/io/dapr/examples/secrets/docker-compose-vault.yml up -d
68-
```
69-
70-
<!-- END_STEP -->
71-
72-
2. Run `docker ps` to see the container running locally:
73-
74-
```bash
75-
342d3522ca14 vault "docker-entrypoint.s…" 34 seconds ago Up About
76-
a minute 0.0.0.0:8200->8200/tcp secrets_hashicorp_vault_1
77-
```
78-
Click [here](https://hub.docker.com/_/vault/) for more information about the container image for Hashicorp's Vault.
79-
80-
### Create a secret in Vault
81-
Dapr's API for secret store only support read operations. For this sample to run, we will first create a secret via the Vault's cli commands:
82-
83-
Export the `VAULT_ADDR` for vault CLI:
84-
```bash
85-
export VAULT_ADDR=http://127.0.0.1:8200/
86-
```
87-
88-
Login to Hashicorp's Vault:
89-
90-
<!-- STEP
91-
name: Vault login
92-
expected_stdout_lines:
93-
- "Success! You are now authenticated. The token information displayed below"
94-
- "token myroot"
95-
env:
96-
VAULT_ADDR: "http://127.0.0.1:8200/"
97-
-->
98-
99-
```bash
100-
vault login myroot
101-
```
102-
103-
<!-- END_STEP -->
104-
105-
Create secret (replace `$MY_FAVORITE_MOVIE` with a title of our choice):
106-
107-
<!-- STEP
108-
name: Create movie vault secret
109-
expected_stdout_lines:
110-
- "version 1"
111-
env:
112-
VAULT_ADDR: "http://127.0.0.1:8200/"
113-
MY_FAVORITE_MOVIE: "Star Wars"
114-
-->
115-
116-
```bash
117-
vault kv put secret/dapr/movie title="$MY_FAVORITE_MOVIE"
118-
```
119-
120-
<!-- END_STEP -->
49+
### Creating a JSON secret file locally
12150

122-
Create random secret:
51+
Dapr's API for secret store only support read operations. For this sample to run, we will first create a secret file with a JSON string that contains two keys: `redisPassword` and `randomKey`.
12352

12453
<!-- STEP
125-
name: Create random vault secret
126-
expected_stdout_lines:
127-
- "version 1"
128-
env:
129-
VAULT_ADDR: "http://127.0.0.1:8200/"
54+
name: create local file
13055
-->
13156

13257
```bash
133-
vault kv put secret/dapr/randomKey testVal="value"
58+
echo '{"redisPassword":"root123","randomKey":"value"}' > ./components/secrets/secret.json
13459
```
13560

13661
<!-- END_STEP -->
13762

138-
In the command above, `secret` means the secret engine in Hashicorp's Vault.
139-
Then, `dapr` is the prefix as defined in `< repo dir >/examples/components/hashicorp_vault.yaml`.
140-
Finally, `movie` and `randomKey` are the secret names with the value set in the form of `key=value` pair.
141-
142-
A secret in Dapr is a dictionary.
143-
14463
### Running the secret store sample
14564

14665
The example's main function is in `SecretClient.java`.
14766

14867
```java
14968
public class SecretClient {
150-
/**
151-
* Identifier in Dapr for the secret store.
152-
*/
153-
private static final String SECRET_STORE_NAME = "vault";
154-
69+
15570
/**
15671
* JSON Serializer to print output.
15772
*/
15873
private static final ObjectMapper JSON_SERIALIZER = new ObjectMapper();
159-
160-
///...
161-
162-
public static void main(String[] args) throws Exception {
163-
if (args.length != 1) {
164-
throw new IllegalArgumentException("Use one argument: secret's key to be retrieved.");
165-
}
166-
167-
String secretKey = args[0];
168-
try (DaprClient client = (new DaprClientBuilder()).build()) {
169-
Map<String, String> secret = client.getSecret(SECRET_STORE_NAME, secretKey).block();
170-
System.out.println(JSON_SERIALIZER.writeValueAsString(secret));
171-
172-
try {
173-
secret = client.getSecret(SECRET_STORE_NAME, "randomKey").block();
174-
System.out.println(JSON_SERIALIZER.writeValueAsString(secret));
74+
75+
/**
76+
* Client to read a secret.
77+
*
78+
* @param args Unused arguments.
79+
*/
80+
public static void main(String[] args) throws Exception {
81+
if (args.length < 2) {
82+
throw new IllegalArgumentException("Required two argument at least: "
83+
+ "one's the secret store name, and the others are secret keys.");
84+
}
85+
86+
final String secretStoreName = args[0];
87+
try (DaprClient client = (new DaprClientBuilder()).build()) {
88+
89+
for (int i = 1; i < args.length; i++) {
90+
String secretKey = args[i];
91+
92+
try {
93+
Map<String, String> secret = client.getSecret(secretStoreName, secretKey).block();
94+
System.out.println(JSON_SERIALIZER.writeValueAsString(secret));
95+
} catch (Exception ex) {
96+
System.out.println(ex.getMessage());
97+
}
98+
}
17599
} catch (Exception ex) {
176-
System.out.println(ex.getMessage());
100+
System.out.println(ex.getMessage());
177101
}
178-
}
179102
}
180-
///...
181103
}
182104
```
183-
The program receives one and only one argument: the secret's key to be fetched.
184-
After identifying the key to be fetched, it will retrieve it from the pre-defined secret store: `vault`.
185-
The secret store's name **must** match the component's name defined in `< repo dir >/examples/components/hashicorp_vault.yaml`.
105+
The program receives two arguments at least: one's the secret store name and the others are secret's keys to be fetched.
106+
After identifying the secret store name that created and the keys to be fetched, it will retrieve them from the pre-defined secret store: `< repo dir >/examples/components/secrets/secret.json`.
107+
The secret store's name **must** match the component's name defined in `< repo dir >/examples/components/secrets/local_file.yaml`.
186108
The Dapr client is also within a try-with-resource block to properly close the client at the end.
187109

188-
Execute the following script in order to run the example:
110+
Execute the following script in order to run the example:
189111

190112
<!-- STEP
191113
name: Validate normal run
192114
expected_stdout_lines:
193-
- '== APP == {"title":"Star Wars"}'
194-
- '== APP == {"testVal":"value"}'
195-
env:
196-
VAULT_ADDR: "http://127.0.0.1:8200/"
115+
- '== APP == {"redisPassword":"root123"}'
116+
- '== APP == {"randomKey":"value"}'
197117
background: true
198118
sleep: 5
199119
-->
200120

201121
```bash
202-
dapr run --components-path ./components/secrets --app-id secrets1 -- java -jar target/dapr-java-sdk-examples-exec.jar io.dapr.examples.secrets.SecretClient movie
122+
dapr run --components-path ./components/secrets --app-id secrets1 -- java -jar target/dapr-java-sdk-examples-exec.jar io.dapr.examples.secrets.SecretClient localSecretStore redisPassword randomKey
203123
```
204124

205125
<!-- END_STEP -->
206126

207127
Once running, the program should print the output as follows:
208128

209129
```
210-
== APP == {"title":"$MY_FAVORITE_MOVIE"}
211-
212-
== APP == {"testVal":"value"}
130+
== APP == {"redisPassword":"root123"}
131+
== APP == {"randomKey":"value"}
213132
```
214133

215134
To close the app either press `CTRL+C` or run
@@ -225,7 +144,7 @@ dapr stop --app-id secrets1
225144
<!-- END_STEP -->
226145

227146

228-
The example's `config.yaml` is as follows:
147+
The example's `config.yaml` is as follows:
229148
```yaml
230149
apiVersion: dapr.io/v1alpha1
231150
kind: Configuration
@@ -234,38 +153,35 @@ metadata:
234153
spec:
235154
secrets:
236155
scopes:
237-
- storeName: "vault"
156+
- storeName: "localSecretStore"
238157
defaultAccess: "deny"
239-
allowedSecrets: ["movie",]
158+
allowedSecrets: ["redisPassword",]
240159
```
241160
242-
The configuration defines, that the only allowed secret is `movie` and all other secrets are denied.
161+
The configuration defines, that the only allowed secret is `redisPassword` and all other secrets are denied.
243162

244-
Execute the following script in order to run this example with additional secret scoping:
163+
Execute the following script in order to run this example with additional secret scoping:
245164

246165
<!-- STEP
247166
name: Validate error on querying random secret
248167
expected_stdout_lines:
249-
- '== APP == {"title":"Star Wars"}'
250-
- '== APP == PERMISSION_DENIED: access denied by policy to get "randomKey" from "vault"'
251-
env:
252-
VAULT_ADDR: "http://127.0.0.1:8200/"
168+
- '== APP == {"redisPassword":"root123"}'
169+
- '== APP == PERMISSION_DENIED: access denied by policy to get "randomKey" from "localSecretStore"'
253170
background: true
254171
sleep: 5
255172
-->
256173

257174
```sh
258-
dapr run --components-path ./components/secrets --config ./src/main/java/io/dapr/examples/secrets/config.yaml --app-id secrets2 -- java -jar target/dapr-java-sdk-examples-exec.jar io.dapr.examples.secrets.SecretClient movie
175+
dapr run --components-path ./components/secrets --config ./src/main/java/io/dapr/examples/secrets/config.yaml --app-id secrets2 -- java -jar target/dapr-java-sdk-examples-exec.jar io.dapr.examples.secrets.SecretClient localSecretStore redisPassword randomKey
259176
```
260177

261178
<!-- END_STEP -->
262179

263180
Once running, the program should print the output as follows:
264181

265182
```
266-
== APP == {"title":"$MY_FAVORITE_MOVIE"}
267-
268-
== APP == PERMISSION_DENIED: access denied by policy to get "randomKey" from "vault"
183+
== APP == {"redisPassword":"root123"}
184+
== APP == PERMISSION_DENIED: access denied by policy to get "randomKey" from "localSecretStore"
269185
```
270186

271187
To close the app either press `CTRL+C` or run
@@ -281,14 +197,14 @@ dapr stop --app-id secrets2
281197
<!-- END_STEP -->
282198

283199

284-
To clean up and bring the vault container down, run
200+
To clean up the local secret file
285201

286202
<!-- STEP
287-
name: Cleanup vault container
203+
name: Cleanup local secret file
288204
-->
289205

290206
```sh
291-
docker-compose -f ./src/main/java/io/dapr/examples/secrets/docker-compose-vault.yml down
207+
rm -rf ./components/secrets/secret.json
292208
```
293209

294210
<!-- END_STEP -->

0 commit comments

Comments
 (0)