Skip to content

Commit 66b1cad

Browse files
artursouzaartursouza
authored
Support for GetSecret + ITs + sample. (dapr#249)
1 parent 98ddaf5 commit 66b1cad

File tree

24 files changed

+667
-17
lines changed

24 files changed

+667
-17
lines changed

‎.github/workflows/build.yml‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,15 +17,15 @@ jobs:
1717
build:
1818
runs-on: ubuntu-latest
1919
env:
20-
GOVER: 1.13.7
20+
GOVER: 1.14.0
2121
GOOS: linux
2222
GOARCH: amd64
2323
GOPROXY: https://proxy.golang.org
2424
JDK_VER: 13.0.x
2525
DAPR_RUNTIME_VER: 0.4.0-rc.1
2626
DAPR_INSTALL_URL: https://raw.githubusercontent.com/dapr/cli/f84566fb2bf5a599252ab9d6bd82fc78faf94dba/install/install.sh
27-
DAPR_CLI_REF:
28-
DAPR_REF:
27+
DAPR_CLI_REF: eb76cbf2200058f849814649f23212b3247a952c
28+
DAPR_REF: 034b82ebfbb7c76e5801ae6d90c2edd29f629df8
2929
OSSRH_USER_TOKEN: ${{ secrets.OSSRH_USER_TOKEN }}
3030
OSSRH_PWD_TOKEN: ${{ secrets.OSSRH_PWD_TOKEN }}
3131
GPG_KEY: ${{ secrets.GPG_KEY }}
@@ -40,7 +40,7 @@ jobs:
4040
run: wget -q ${{ env.DAPR_INSTALL_URL }} -O - | /bin/bash
4141
- name: Set up Go ${{ env.GOVER }}
4242
if: env.DAPR_REF != '' || env.DAPR_CLI_REF != ''
43-
uses: actions/setup-go@v1
43+
uses: actions/setup-go@v2-beta
4444
with:
4545
go-version: ${{ env.GOVER }}
4646
- name: Checkout Dapr CLI repo to override dapr command.
@@ -80,6 +80,12 @@ jobs:
8080
run: |
8181
docker-compose -f ./sdk-tests/deploy/local-test-kafka.yml up -d
8282
docker ps
83+
- name: Install Local Hashicorp Vault using docker-compose
84+
run: |
85+
docker-compose -f ./sdk-tests/deploy/local-test-vault.yml up -d
86+
docker ps
87+
- name: Setup Vault's test token
88+
run: echo myroot > /tmp/.hashicorp_vault_token
8389
- name: Clean up files
8490
run: mvn clean
8591
- name: Build sdk

‎examples/.hashicorp_vault_token‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
myroot

‎examples/components/hashicorp_vault.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: dapr.io/v1alpha1
2+
kind: Component
3+
metadata:
4+
name: vault
5+
spec:
6+
type: secretstores.hashicorp.vault
7+
metadata:
8+
- name: vaultAddr
9+
value: "http://127.0.0.1:8200"
10+
- name: skipVerify
11+
value : true
12+
- name: vaultTokenMountPath
13+
value : ".hashicorp_vault_token"
14+
- name: vaultKVPrefix
15+
value : "dapr"

‎examples/src/main/java/io/dapr/examples/secrets/README.md‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
# Dapr's Secret Store Sample
2+
3+
In this sample, we'll see how to retrieve a secret using Dapr's Java SDK.
4+
This sample includes two files:
5+
6+
* docker-compose-vault.yml (Starts Hashicorp's Vault as a container)
7+
* SecretClient.java (Reads a secret from Dapr's Secret Store)
8+
* Existing Dapr component file in `< repo dir >/examples/components/hashicorp_vault.yaml`
9+
* Existing token file in `< repo dir >/examples/.hashicorp_vault_token` (Consumed by `daprd`'s vault component above)
10+
11+
Visit [this](https://github.com/dapr/docs/tree/master/concepts/secrets) link for more information about secret stores in Dapr.
12+
13+
## Secret store sample using the Java-SDK
14+
15+
In this example, the component used is Hashicorp Vault, but others are also available.
16+
17+
Visit [this](https://github.com/dapr/components-contrib/tree/master/secretstores) link for more information about secret stores implementations.
18+
19+
20+
## Pre-requisites
21+
22+
* [Dapr and Dapr Cli](https://github.com/dapr/docs/blob/master/getting-started/environment-setup.md#environment-setup).
23+
* Java JDK 11 (or greater): [Oracle JDK](https://www.oracle.com/technetwork/java/javase/downloads/index.html#JDK11) or [OpenJDK](https://jdk.java.net/13/).
24+
* [Apache Maven](https://maven.apache.org/install.html) version 3.x.
25+
* Hashicorp's vault client [installed](https://www.vaultproject.io/docs/install/).
26+
27+
### Checking out the code
28+
29+
Clone this repository:
30+
31+
```sh
32+
git clone https://github.com/dapr/java-sdk.git
33+
cd java-sdk
34+
```
35+
36+
Then build the Maven project:
37+
38+
```sh
39+
# make sure you are in the `java-sdk` directory.
40+
mvn install
41+
```
42+
### Setting Vault locally
43+
44+
Before getting into the application code, follow these steps in order to setup a local instance of Vault. This is needed for the local instances. Steps are:
45+
46+
1. navigate to the [repo-root] with `cd java-sdk`
47+
2. Run `docker-compose -f ./examples/src/main/java/io/dapr/examples/secrets/docker-compose-vault.yml up -d` to run the container locally
48+
3. Run `docker ps` to see the container running locally:
49+
50+
```bash
51+
342d3522ca14 vault "docker-entrypoint.s…" 34 seconds ago Up About
52+
a minute 0.0.0.0:8200->8200/tcp secrets_hashicorp_vault_1
53+
```
54+
Click [here](https://hub.docker.com/_/vault/) for more information about the container image for Hashicorp's Vault.
55+
56+
### Create a secret in Vault
57+
Dapr's API for secret store only support read operations. For this sample to run, we will first create a secret via the Vault's cli commands:
58+
59+
1. Login:
60+
```bash
61+
vault login myroot
62+
```
63+
64+
2. Create secret (replace `[my favorite movie]` with a title of our choice):
65+
```bash
66+
vault kv put secret/dapr/movie title="[my favorite movie]"
67+
```
68+
69+
In the command above, `secret` means the secret engine in Hashicorp's Vault.
70+
Then, `dapr` is the prefix as defined in `< repo dir >/examples/components/hashicorp_vault.yaml`.
71+
Finally, `movie` is the secret name and then a `key=value` pair.
72+
73+
A secret in dapr is a dictionary. In this sample, only one key-value pair is used but more can be added as an exercise for the reader.
74+
75+
### Running the secret store sample
76+
77+
The example's main function is in `SecretClient.java`.
78+
79+
```java
80+
public class SecretClient {
81+
82+
private static final String SECRET_STORE_NAME = "vault";
83+
84+
///...
85+
86+
public static void main(String[] args) throws Exception {
87+
///...
88+
String secretKey = args[0];
89+
DaprClient client = (new DaprClientBuilder()).build();
90+
Map<String, String> secret = client.getSecret(SECRET_STORE_NAME, secretKey).block();
91+
System.out.println(JSON_SERIALIZER.writeValueAsString(secret));
92+
}
93+
///...
94+
}
95+
```
96+
The program receives one and only one argument: the secret's key to be fetched.
97+
After identifying the key to be fetched, it will retrieve it from the pre-defined secret store: `vault`.
98+
The secret store's name **must** match the component's name defined in `< repo dir >/examples/components/hashicorp_vault.yaml`.
99+
100+
Execute the follow script in order to run the example:
101+
```sh
102+
cd to [repo-root]/examples
103+
dapr run -- java -jar target/dapr-java-sdk-examples-exec.jar io.dapr.examples.secrets.SecretClient movie
104+
```
105+
106+
Once running, the program should print the output as follows:
107+
108+
```
109+
== APP == {"title":"[my favorite movie]"}
110+
```
111+
112+
Thanks for playing.

‎examples/src/main/java/io/dapr/examples/secrets/SecretClient.java‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
/*
2+
* Copyright (c) Microsoft Corporation.
3+
* Licensed under the MIT License.
4+
*/
5+
6+
package io.dapr.examples.secrets;
7+
8+
import com.fasterxml.jackson.databind.ObjectMapper;
9+
import io.dapr.client.DaprClient;
10+
import io.dapr.client.DaprClientBuilder;
11+
12+
import java.util.Map;
13+
14+
/**
15+
* 1. Build and install jars:
16+
* mvn clean install
17+
* 2. cd to [repo-root]/examples
18+
* 3. Add secret to vault:
19+
* vault kv put secret/dapr/movie title="[my favorite movie]"
20+
* 4. Read secret from example:
21+
* dapr run -- java -jar target/dapr-java-sdk-examples-exec.jar io.dapr.examples.secrets.SecretClient movie
22+
*/
23+
public class SecretClient {
24+
25+
/**
26+
* Identifier in Dapr for the secret store.
27+
*/
28+
private static final String SECRET_STORE_NAME = "vault";
29+
30+
/**
31+
* JSON Serializer to print output.
32+
*/
33+
private static final ObjectMapper JSON_SERIALIZER = new ObjectMapper();
34+
35+
/**
36+
* Client to read a secret.
37+
*
38+
* @param args Unused arguments.
39+
*/
40+
public static void main(String[] args) throws Exception {
41+
if (args.length != 1) {
42+
throw new IllegalArgumentException("Use one argument: secret's key to be retrieved.");
43+
}
44+
45+
String secretKey = args[0];
46+
DaprClient client = (new DaprClientBuilder()).build();
47+
Map<String, String> secret = client.getSecret(SECRET_STORE_NAME, secretKey).block();
48+
System.out.println(JSON_SERIALIZER.writeValueAsString(secret));
49+
}
50+
}

‎examples/src/main/java/io/dapr/examples/secrets/docker-compose-vault.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
version: '2'
2+
services:
3+
hashicorp_vault:
4+
image: vault
5+
ports:
6+
- "8200:8200"
7+
cap_add:
8+
- IPC_LOCK
9+
environment:
10+
VAULT_DEV_ROOT_TOKEN_ID: "myroot"

‎pom.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,8 @@
1717
<grpc.version>1.25.0</grpc.version>
1818
<protobuf.version>3.11.0</protobuf.version>
1919
<protoc.version>3.10.0</protoc.version>
20-
<dapr.proto.url>https://raw.githubusercontent.com/dapr/dapr/v0.4.0/pkg/proto/dapr/dapr.proto</dapr.proto.url>
21-
<dapr.client.proto.url>https://raw.githubusercontent.com/dapr/dapr/v0.4.0/pkg/proto/daprclient/daprclient.proto</dapr.client.proto.url>
20+
<dapr.proto.url>https://raw.githubusercontent.com/dapr/dapr/3b792de734594463f6a16ce8c952fe2ed96c0dc0/pkg/proto/dapr/dapr.proto</dapr.proto.url>
21+
<dapr.client.proto.url>https://raw.githubusercontent.com/dapr/dapr/3b792de734594463f6a16ce8c952fe2ed96c0dc0/pkg/proto/daprclient/daprclient.proto</dapr.client.proto.url>
2222
<os-maven-plugin.version>1.6.2</os-maven-plugin.version>
2323
<maven-dependency-plugin.version>3.1.1</maven-dependency-plugin.version>
2424
<maven-antrun-plugin.version>1.8</maven-antrun-plugin.version>

‎sdk-tests/components/vault.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
apiVersion: dapr.io/v1alpha1
2+
kind: Component
3+
metadata:
4+
name: vault
5+
spec:
6+
type: secretstores.hashicorp.vault
7+
metadata:
8+
- name: vaultAddr
9+
value: "http://127.0.0.1:8200"
10+
- name: skipVerify
11+
value : true
12+
- name: vaultTokenMountPath
13+
value : "/tmp/.hashicorp_vault_token"
14+
- name: vaultKVPrefix
15+
value : "dapr"

‎sdk-tests/deploy/local-test-vault.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
version: '2'
2+
services:
3+
hashicorp_vault:
4+
image: vault
5+
ports:
6+
- "8200:8200"
7+
cap_add:
8+
- IPC_LOCK
9+
environment:
10+
VAULT_DEV_ROOT_TOKEN_ID: "myroot"

‎sdk-tests/pom.xml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,13 @@
6565
<version>2.2.2.RELEASE</version>
6666
<scope>test</scope>
6767
</dependency>
68+
<dependency>
69+
<!-- This is need for us to programmatically add secrets in integration tests. -->
70+
<groupId>com.bettercloud</groupId>
71+
<artifactId>vault-java-driver</artifactId>
72+
<version>5.1.0</version>
73+
<scope>test</scope>
74+
</dependency>
6875
</dependencies>
6976

7077
<build>

0 commit comments

Comments
 (0)