Skip to content

Commit

Permalink
updates per mark and alessandro review
Browse files Browse the repository at this point in the history
Signed-off-by: Hannah Hunter <hannahhunter@microsoft.com>
  • Loading branch information
hhunter-ms committed Jun 5, 2023
1 parent 627b835 commit 27bb5c2
Show file tree
Hide file tree
Showing 5 changed files with 14 additions and 5 deletions.
Expand Up @@ -50,7 +50,7 @@ The Dapr cryptography building block incldues two kinds of components:
- **Components that allow interacting with management services or vaults ("key vaults").**
Similar to how Dapr offers an "abstraction layer" on top of various secret stores or state stores, these components allow interacting with various key vaults such as Azure Key Vault (with more coming in future Dapr releases). With these components, cryptographic operations on the private keys are performed within the vaults and Dapr never sees your private keys.

- **Components based on Dapr's own cryptographic engine with keys stored on files.**
- **Components based on Dapr's own cryptographic engine.**
When key vaults are not available, you can leverage components based on Dapr's own cryptographic engine. These components, which have `.dapr.` in the name, perform cryptographic operations within the Dapr sidecar, with keys stored on files, Kubernetes secrets, or other sources. Although the private keys are known by Dapr, they are still not available to your applications.

Both kinds of components, either those leveraging key vaults or using the cryptopgrahic engine in Dapr, offer the same abstraction layer. This allows your solution to switch between various vaults and/or cryptography components as needed. For example, you can use a locally-stored key during development, and a cloud vault in production.
Expand Down
Expand Up @@ -44,8 +44,8 @@ The Azure Key Vault cryptography component supports authentication with Azure AD

| Field | Required | Details | Example |
|--------------------|:--------:|---------|---------|
| vaultName | Y | Azure Key Vault name | `"mykeyvault"` |
| Auth metadata | Y | See [Authenticating to Azure]({{< ref "authenticating-azure.md" >}}) for more information | |
| `vaultName` | Y | Azure Key Vault name | `"mykeyvault"` |
| Auth metadata | Y | See [Authenticating to Azure]({{< ref "authenticating-azure.md" >}}) for more information | |

## Related links
- [Cryptography building block]({{< ref cryptography >}})
Expand Down
Expand Up @@ -7,7 +7,7 @@ description: Detailed information on the Kubernetes secret cryptography componen

## Component format

The purpose of this component is to load keys that are stored as Kubernetes secrets.
The purpose of this component is to load the Kubernetes secret named after the key name.

{{% alert title="Note" color="primary" %}}
This component uses the cryptographic engine in Dapr to perform operations. Although keys are never exposed to your application, Dapr has access to the raw key material.
Expand Down
Expand Up @@ -46,7 +46,16 @@ The above example uses secrets as plain strings. It is recommended to use a secr

| Field | Required | Details | Example |
|--------------------|:--------:|---------|---------|
| `path` | Y | Folder containing the keys to be loaded. When loading a key, the name of the key will be used as name of the file in this folder. | `/path/to/folder`
| `path` | Y | Folder containing the keys to be loaded. When loading a key, the name of the key will be used as name of the file in this folder. | `/path/to/folder` |

**Example**

Let's say you've set `path=/mnt/keys`, which contains the following files:

- `/mnt/keys/mykey1.pem`
- `/mnt/keys/mykey2`

When using the component, you can reference the keys as `mykey1.pm` and `mykey2`.

## Related links
[Cryptography building block]({{< ref cryptography >}})
Binary file modified daprdocs/static/images/cryptography-overview.png
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.

0 comments on commit 27bb5c2

Please sign in to comment.