dapr · jjcollinge · Apr 12, 2025 · Apr 13, 2025 · Apr 13, 2025 · Apr 13, 2025
@@ -448,7 +448,6 @@ func hashFilesInDir(basePath string, ignores *gitignore.GitIgnore) ([]string, er
 		files = append(files, checksum)
 		return nil
 	})
-
 	if err != nil {
 		return nil, err
 	}

@@ -137,6 +137,11 @@ spec:
         - name: debug
           containerPort: {{ .Values.debug.port }}
           protocol: TCP
+{{- end }}
+{{- if .Values.oidc.enabled }}
+        - name: oidc
+          containerPort: 9080
+          protocol: TCP
 {{- end }}
         resources:
 {{ toYaml .Values.resources | indent 10 }}
@@ -188,6 +193,52 @@ spec:
         - "--issuer-key-filename"
         - "{{ .key }}"
 {{- end }}
+        - "--jwt-enabled={{ .Values.jwt.enabled }}"
+{{- if .Values.jwt.keyFilename }}
+        - "--jwt-key-filename={{ .Values.jwt.keyFilename }}"
+{{- end }}
+{{- if .Values.jwt.jwksFilename }}
+        - "--jwks-filename={{ .Values.jwt.jwksFilename }}"
+{{- end }}
+{{- if .Values.jwt.issuer }}
+        - "--jwt-issuer={{ .Values.jwt.issuer }}"
+{{- end }}
+{{- if .Values.jwt.signingAlgorithm }}
+        - "--jwt-signing-algorithm={{ .Values.jwt.signingAlgorithm }}"
+{{- end }}
+{{- if .Values.jwt.keyID }}
+        - "--jwt-key-id={{ .Values.jwt.keyID }}"
+{{- end }}
+{{- if .Values.oidc.enabled }}
+        - "--oidc-enabled=true"
+{{- else }}
+        - "--oidc-enabled=false"
+{{- end }}
+{{- if and .Values.oidc.server .Values.oidc.server.port }}
+        - "--oidc-server-listen-port={{ .Values.oidc.server.port }}"
+{{- end }}
+{{- if and .Values.oidc.server .Values.oidc.server.address }}
+        - "--oidc-server-address={{ .Values.oidc.server.address }}"
+{{- end }}
+{{- if .Values.oidc.jwksURI }}
+        - "--oidc-jwks-uri={{ .Values.oidc.jwksURI }}"
+{{- end }}
+{{- if .Values.oidc.pathPrefix }}
+        - "--oidc-path-prefix={{ .Values.oidc.pathPrefix }}"
+{{- end }}
+{{- if .Values.oidc.allowedHosts }}
+        - "--oidc-allowed-hosts={{ join "," .Values.oidc.allowedHosts }}"
+{{- end }}
+{{- if .Values.oidc.tls.certFile }}
+        - "--oidc-server-tls-cert-file={{ .Values.oidc.tls.certFile }}"
+{{- end }}
+{{- if .Values.oidc.tls.keyFile }}
+        - "--oidc-server-tls-key-file={{ .Values.oidc.tls.keyFile }}"
+{{- end }}
+{{- if .Values.oidc.tls.enabled }}
+        - "--oidc-server-tls-enabled={{ .Values.oidc.tls.enabled }}"
+{{- end }}
+
       serviceAccountName: dapr-sentry
       volumes:
         - name: credentials

@@ -33,3 +33,9 @@ spec:
     targetPort: {{ .Values.global.prometheus.port }}
     protocol: TCP
 {{- end}}
+{{- if .Values.oidc.enabled }}
+  - name: oidc
+    port: {{ .Values.oidc.server.port }}
+    targetPort: 9080
+    protocol: TCP
+{{- end }}
@@ -30,6 +30,40 @@ tls:
     certPEM: ""
   trustDomain: cluster.local
 
+jwt:
+  # Enable JWT token issuance by Sentry
+  enabled: false
+  # JWT signing key filename
+  keyFilename: ""
+  # JWKS (JSON Web Key Set) filename
+  jwksFilename: ""
+  # Issuer value for JWT tokens (no issuer if empty)
+  issuer: ""
+  # Algorithm used for JWT signing (e.g., ES256, RS256)
+  signingAlgorithm: ""
+  # Key ID (kid) used for JWT signing
+  keyID: ""
+
+
+oidc:
+  enabled: false
+  server:
+    # Port for the OIDC HTTP server
+    port: 9080
+  # Custom URI where the JWKS can be accessed externally
+  jwksURI: ""
+  # Path prefix to add to OIDC HTTP endpoints
+  pathPrefix: ""
+  # List of allowed hosts for OIDC HTTP endpoint requests
+  allowedHosts: []
+  tls:
+    # Enable TLS for the OIDC HTTP server
+    enabled: true
+    # TLS certificate file for the OIDC HTTP server (required when OIDC HTTP server is enabled)
+    certFile: ""
+    # TLS certificate file for the OIDC HTTP server (required when OIDC HTTP server is enabled)
+    keyFile: ""
+
 livenessProbe:
   initialDelaySeconds: 3
   periodSeconds: 3

@@ -123,6 +123,7 @@ func Run() {
 		MTLSEnabled:             opts.EnableMTLS,
 		Mode:                    modes.DaprMode(opts.Mode),
 		Healthz:                 healthz,
+		JwtAudiences:            opts.JwtAudiences,
 	})
 	if err != nil {
 		log.Fatal(err)

@@ -81,6 +81,7 @@ type Options struct {
 	DisableBuiltinK8sSecretStore  bool
 	AppHealthCheckPath            string
 	AppChannelAddress             string
+	JwtAudiences                  []string
 	Logger                        logger.Options
 	Metrics                       *metrics.FlagOptions
 }
@@ -138,6 +139,7 @@ func New(origArgs []string) (*Options, error) {
 	fs.StringVar(&opts.SentryAddress, "sentry-address", "", "Address for the Sentry CA service")
 	fs.StringVar(&opts.ControlPlaneTrustDomain, "control-plane-trust-domain", "localhost", "Trust domain of the Dapr control plane")
 	fs.StringVar(&opts.ControlPlaneNamespace, "control-plane-namespace", "default", "Namespace of the Dapr control plane")
+	fs.StringSliceVar(&opts.JwtAudiences, "jwt-audiences", nil, "JWT audience list for certificate signing requests. If not specified, the trust domain will be used")
 	fs.StringVar(&opts.AllowedOrigins, "allowed-origins", cors.DefaultAllowedOrigins, "Allowed HTTP origins")
 	fs.BoolVar(&opts.EnableProfiling, "enable-profiling", false, "Enable profiling")
 	fs.BoolVar(&opts.RuntimeVersion, "version", false, "Prints the runtime version")

@@ -15,6 +15,7 @@ package app
 
 import (
 	"context"
+	"crypto/tls"
 	"os"
 	"path/filepath"
 	"time"
@@ -67,30 +68,49 @@ func Run() {
 		mngr        = concurrency.NewRunnerManager()
 	)
 
-	issuerCertPath := filepath.Join(opts.IssuerCredentialsPath, opts.IssuerCertFilename)
-	if filepath.IsAbs(opts.IssuerCertFilename) {
-		log.Debugf("Using user provided issuer cert path: %s", opts.IssuerCertFilename)
-		issuerCertPath = opts.IssuerCertFilename
+	issuerCertPath := filepath.Join(opts.IssuerCredentialsPath, opts.X509.IssuerCertFilename)
+	if filepath.IsAbs(opts.X509.IssuerCertFilename) {
+		log.Debugf("Using user provided issuer cert path: %s", opts.X509.IssuerCertFilename)
+		issuerCertPath = opts.X509.IssuerCertFilename
 	}
-	issuerKeyPath := filepath.Join(opts.IssuerCredentialsPath, opts.IssuerKeyFilename)
-	if filepath.IsAbs(opts.IssuerKeyFilename) {
-		log.Debugf("Using user provided issuer key path: %s", opts.IssuerKeyFilename)
-		issuerKeyPath = opts.IssuerKeyFilename
+	issuerKeyPath := filepath.Join(opts.IssuerCredentialsPath, opts.X509.IssuerKeyFilename)
+	if filepath.IsAbs(opts.X509.IssuerKeyFilename) {
+		log.Debugf("Using user provided issuer key path: %s", opts.X509.IssuerKeyFilename)
+		issuerKeyPath = opts.X509.IssuerKeyFilename
 	}
-	rootCertPath := filepath.Join(opts.IssuerCredentialsPath, opts.RootCAFilename)
-	if filepath.IsAbs(opts.RootCAFilename) {
-		log.Debugf("Using user provided root cert path: %s", opts.RootCAFilename)
-		rootCertPath = opts.RootCAFilename
+	rootCertPath := filepath.Join(opts.IssuerCredentialsPath, opts.X509.RootCAFilename)
+	if filepath.IsAbs(opts.X509.RootCAFilename) {
+		log.Debugf("Using user provided root cert path: %s", opts.X509.RootCAFilename)
+		rootCertPath = opts.X509.RootCAFilename
+	}
+	jwtKeyPath := filepath.Join(opts.IssuerCredentialsPath, config.DefaultJWTSigningKeyFilename)
+	if filepath.IsAbs(opts.JWT.SigningKeyFilename) {
+		log.Debugf("Using user provided JWT signing key path: %s", opts.JWT.SigningKeyFilename)
+		jwtKeyPath = opts.JWT.SigningKeyFilename
+	}
+	jwksPath := filepath.Join(opts.IssuerCredentialsPath, config.DefaultJWKSFilename)
+	if filepath.IsAbs(opts.JWT.JWKSFilename) {
+		log.Debugf("Using user provided JWKS path: %s", opts.JWT.JWKSFilename)
+		jwksPath = opts.JWT.JWKSFilename
 	}
 
 	m := make(map[string]struct{})
 	// we need to watch over all these relevant directories
-	for _, path := range []string{issuerCertPath, issuerKeyPath, rootCertPath} {
-		dir := filepath.Dir(path)
-		if _, ok := m[dir]; !ok {
-			m[dir] = struct{}{}
+	for _, path := range []*string{
+		&issuerCertPath,
+		&issuerKeyPath,
+		&rootCertPath,
+		&jwtKeyPath,
+		&jwksPath,
+	} {
+		if path != nil {
+			dir := filepath.Dir(*path)
+			if _, ok := m[dir]; !ok {
+				m[dir] = struct{}{}
+			}
 		}
 	}
+
 	watchDirs := make([]string, 0, len(m))
 	for dir := range m {
 		watchDirs = append(watchDirs, dir)
@@ -104,11 +124,28 @@ func Run() {
 	cfg.IssuerCertPath = issuerCertPath
 	cfg.IssuerKeyPath = issuerKeyPath
 	cfg.RootCertPath = rootCertPath
+	cfg.JWT.SigningKeyPath = jwtKeyPath
+	cfg.JWT.Enabled = opts.JWT.Enabled
+	cfg.JWT.JWKSPath = jwksPath
 	cfg.TrustDomain = opts.TrustDomain
 	cfg.Port = opts.Port
 	cfg.ListenAddress = opts.ListenAddress
 	cfg.Mode = modes.DaprMode(opts.Mode)
 
+	if opts.JWT.Issuer != nil {
+		cfg.JWT.Issuer = opts.JWT.Issuer
+	}
+
+	if opts.JWT.SigningAlgorithm != "" {
+		cfg.JWT.SigningAlgorithm = opts.JWT.SigningAlgorithm
+	}
+
+	if opts.JWT.KeyID != nil {
+		cfg.JWT.KeyID = opts.JWT.KeyID
+	}
+
+	cfg.JWT.TTL = opts.JWT.TTL
+
 	// We use runner manager inception here since we want the inner manager to be
 	// restarted when the CA server needs to be restarted because of file events.
 	// We don't want to restart the healthz server and file watcher on file
@@ -122,9 +159,31 @@ func Run() {
 			Port:      opts.Metrics.Port(),
 			Healthz:   healthz,
 		})
+
+		// Configure TLS for OIDC HTTP server if needed
+		var oidcTLSConfig *tls.Config
+		if opts.OIDC.TLSCertFile != "" && opts.OIDC.TLSKeyFile != "" {
+			oidcTLSConfig, err = createOIDCTLSConfig(opts.OIDC.TLSCertFile, opts.OIDC.TLSKeyFile)
+			if err != nil {
+				log.Errorf("Failed to create OIDC TLS config: %v", err)
+				return err
+			}
+		} else if opts.OIDC.TLSCertFile != "" || opts.OIDC.TLSKeyFile != "" {
+			log.Fatalf("Both OIDC TLS certificate and key must be provided if one is specified. Cert: %q, Key: %q", opts.OIDC.TLSCertFile, opts.OIDC.TLSKeyFile)
+		}
+
 		sentry, serr := sentry.New(ctx, sentry.Options{
 			Config:  cfg,
 			Healthz: healthz,
+			OIDC: sentry.OIDCOptions{
+				Enabled:             opts.OIDC.Enabled,
+				ServerListenAddress: opts.OIDC.ServerListenAddress,
+				ServerListenPort:    opts.OIDC.ServerListenPort,
+				JWKSURI:             opts.OIDC.JWKSURI,
+				PathPrefix:          opts.OIDC.PathPrefix,
+				Domains:             opts.OIDC.AllowedHosts,
+				TLSConfig:           oidcTLSConfig,
+			},
 		})
 		if serr != nil {
 			return serr
@@ -197,3 +256,16 @@ func Run() {
 	}
 	log.Info("Sentry shut down gracefully")
 }
+
+// createOIDCTLSConfig creates a TLS configuration for the OIDC HTTP server
+func createOIDCTLSConfig(certFile, keyFile string) (*tls.Config, error) {
+	cert, err := tls.LoadX509KeyPair(certFile, keyFile)
+	if err != nil {
+		return nil, err
+	}
+
+	return &tls.Config{
+		Certificates: []tls.Certificate{cert},
+		MinVersion:   tls.VersionTLS12,
+	}, nil
+}