You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: examples/src/main/java/io/dapr/examples/secrets/README.md
+51-6
Original file line number
Diff line number
Diff line change
@@ -41,7 +41,7 @@ mvn install
41
41
```
42
42
### Setting Vault locally
43
43
44
-
Before getting into the application code, follow these steps in order to setup a local instance of Vault. This is needed for the local instances. Steps are:
44
+
Before getting into the application code, follow these steps in order to set up a local instance of Vault. This is needed for the local instances. Steps are:
45
45
46
46
1. navigate to the [examples] with `cd examples`
47
47
2. Run `docker-compose -f ./src/main/java/io/dapr/examples/secrets/docker-compose-vault.yml up -d` to run the container locally
@@ -61,18 +61,23 @@ Dapr's API for secret store only support read operations. For this sample to run
61
61
vault login myroot
62
62
```
63
63
64
-
> Note: If you get `http: server gave HTTP response to HTTPS client` make sure the local vault address is set`export VAULT_ADDR=http://127.0.0.1:8200/`
64
+
> Note: If you get `http: server gave HTTP response to HTTPS client` make sure to set the local vault address as `export VAULT_ADDR=http://127.0.0.1:8200/`
65
65
66
66
2. Create secret (replace `[my favorite movie]` with a title of our choice):
67
67
```bash
68
68
vault kv put secret/dapr/movie title="[my favorite movie]"
69
69
```
70
70
71
+
3. Create random secret:
72
+
```bash
73
+
vault kv put secret/dapr/randomKey testVal="value"
74
+
```
75
+
71
76
In the command above, `secret` means the secret engine in Hashicorp's Vault.
72
77
Then, `dapr` is the prefix as defined in `< repo dir >/examples/components/hashicorp_vault.yaml`.
73
-
Finally, `movie`is the secret name and then a`key=value` pair.
78
+
Finally, `movie`and `randomKey` are the secret names with the value set in the form of`key=value` pair.
74
79
75
-
A secret in dapr is a dictionary. In this sample, only one key-value pair is used but more can be added as an exercise for the reader.
@@ -111,7 +123,7 @@ After identifying the key to be fetched, it will retrieve it from the pre-define
111
123
The secret store's name **must** match the component's name defined in `< repo dir >/examples/components/hashicorp_vault.yaml`.
112
124
The Dapr client is also within a try-with-resource block to properly close the client at the end.
113
125
114
-
Execute the follow script in order to run the example:
126
+
Execute the following script in order to run the example:
115
127
```sh
116
128
cd to [repo-root]/examples
117
129
dapr run --components-path ./components -- java -jar target/dapr-java-sdk-examples-exec.jar io.dapr.examples.secrets.SecretClient movie
@@ -121,11 +133,44 @@ Once running, the program should print the output as follows:
121
133
122
134
```
123
135
== APP == {"title":"[my favorite movie]"}
136
+
137
+
== APP == {"testVal":"value"}
124
138
```
125
139
126
140
To close the app, press CTRL+c.
127
141
128
-
To cleanup and bring the vault container down, run
142
+
The example's `config.yaml` is as follows:
143
+
```yaml
144
+
apiVersion: dapr.io/v1alpha1
145
+
kind: Configuration
146
+
metadata:
147
+
name: daprConfig
148
+
spec:
149
+
secrets:
150
+
scopes:
151
+
- storeName: "vault"
152
+
defaultAccess: "deny"
153
+
allowedSecrets: ["movie",]
154
+
```
155
+
156
+
The configuration defines, that the only allowed secret is `movie` and all other secrets are denied.
157
+
158
+
Execute the following script in order to run this example with additional secret scoping:
159
+
```sh
160
+
cd to [repo-root]/examples
161
+
dapr run --components-path ./components --config ./src/main/java/io/dapr/examples/secrets/config.yaml -- java -jar target/dapr-java-sdk-examples-exec.jar io.dapr.examples.secrets.SecretClient movie
162
+
```
163
+
Once running, the program should print the output as follows:
164
+
165
+
```
166
+
== APP == {"title":"[my favorite movie]"}
167
+
168
+
== APP == java.util.concurrent.ExecutionException: io.grpc.StatusRuntimeException: PERMISSION_DENIED: Access denied by policy to get randomKey from vault
169
+
```
170
+
171
+
To close the app, press CTRL+c.
172
+
173
+
To clean up and bring the vault container down, run
129
174
```sh
130
175
docker-compose -f ./src/main/java/io/dapr/examples/secrets/docker-compose-vault.yml down
// This is an example, so for simplicity we are just exiting here.
63
97
// Normally a dapr app would be a web service and not exit main.
@@ -66,7 +100,19 @@ public class StateClient {
66
100
}
67
101
}
68
102
```
69
-
The code uses the `DaprClient` created by the `DaprClientBuilder`. Notice that this builder uses default settings. Internally, it is using `DefaultObjectSerializer` for two properties: `objectSerializer` is for Dapr's sent and received objects, and `stateSerializer` is for objects to be persisted. This client performs three operations: `client.saveState(...)` for persisting an instance of `MyClass`, then uses the `client.getState(...)` operation in order to retrieve back the persisted state using the same key. `client.deleteState(...)` operation is used to remove the persisted state. Finally, the code tries to retrieve the deleted state, which should not be found. The Dapr client is also within a try-with-resource block to properly close the client at the end.
103
+
The code uses the `DaprClient` created by the `DaprClientBuilder`. Notice that this builder uses default settings. Internally, it is using `DefaultObjectSerializer` for two properties: `objectSerializer` is for Dapr's sent and received objects, and `stateSerializer` is for objects to be persisted.
104
+
105
+
This example performs multiple operations:
106
+
*`client.saveState(...)` for persisting an instance of `MyClass`.
107
+
*`client.getState(...)` operation in order to retrieve back the persisted state using the same key.
108
+
*`client.executeTransaction(...)` operation in order to update existing state and add new state.
109
+
*`client.getStates(...)` operation in order to retrieve back the persisted states using the same keys.
110
+
*`client.deleteState(...)` operation to remove one of the persisted states.
111
+
*`client.executeTransaction(...)` operation in order to remove the other persisted state.
112
+
113
+
Finally, the code tries to retrieve the deleted states, which should not be found.
114
+
115
+
The Dapr client is also within a try-with-resource block to properly close the client at the end.
0 commit comments