Overview of Dapr configuration options

Information on Dapr configuration and how to set options for your application

Sidecar configuration

Setup sidecar configuration

Self-hosted sidecar

In self hosted mode the Dapr configuration is a configuration file, for example config.yaml. By default the Dapr sidecar looks in the default Dapr folder for the runtime configuration eg: $HOME/.dapr/config.yaml in Linux/MacOS and %USERPROFILE%\.dapr\config.yaml in Windows.

A Dapr sidecar can also apply a configuration by using a --config flag to the file path with dapr run CLI command.

Kubernetes sidecar

In Kubernetes mode the Dapr configuration is a Configuration CRD, that is applied to the cluster. For example:

  1. kubectl apply -f myappconfig.yaml

You can use the Dapr CLI to list the Configuration CRDs

  1. dapr configurations -k

A Dapr sidecar can apply a specific configuration by using a dapr.io/config annotation. For example:

  1. annotations:
  2. dapr.io/enabled: "true"
  3. dapr.io/app-id: "nodeapp"
  4. dapr.io/app-port: "3000"
  5. dapr.io/config: "myappconfig"

Note: There are more Kubernetes annotations available to configure the Dapr sidecar on activation by sidecar Injector system service.

Sidecar configuration settings

The following configuration settings can be applied to Dapr application sidecars:

Tracing

Tracing configuration turns on tracing for an application.

The tracing section under the Configuration spec contains the following properties:

  1. tracing:
  2. samplingRate: "1"
  3. zipkin:
  4. endpointAddress: "http://zipkin.default.svc.cluster.local:9411/api/v2/spans"

The following table lists the properties for tracing:

PropertyTypeDescription
samplingRatestringSet sampling rate for tracing to be enabled or disabled.
zipkin.endpointAddressstringSet the Zipkin server address.

samplingRate is used to enable or disable the tracing. To disable the sampling rate , set samplingRate : "0" in the configuration. The valid range of samplingRate is between 0 and 1 inclusive. The sampling rate determines whether a trace span should be sampled or not based on value. samplingRate : "1" samples all traces. By default, the sampling rate is (0.0001) or 1 in 10,000 traces.

See Observability distributed tracing for more information

Metrics

The metrics section can be used to enable or disable metrics for an application.

The metrics section under the Configuration spec contains the following properties:

  1. metrics:
  2. enabled: true

The following table lists the properties for metrics:

PropertyTypeDescription
enabledbooleanWhether metrics should to be enabled.

See metrics documentation for more information

Middleware

Middleware configuration set named Http pipeline middleware handlers The httpPipeline section under the Configuration spec contains the following properties:

  1. httpPipeline:
  2. handlers:
  3. - name: oauth2
  4. type: middleware.http.oauth2
  5. - name: uppercase
  6. type: middleware.http.uppercase

The following table lists the properties for HTTP handlers:

PropertyTypeDescription
namestringName of the middleware component
typestringType of middleware component

See Middleware pipelines for more information

Scope secret store access

See the Scoping secrets guide for information and examples on how to scope secrets to an application.

Access Control allow lists for building block APIs

See the selectively enable Dapr APIs on the Dapr sidecar guide for information and examples on how to set ACLs on the building block APIs lists.

Access Control allow lists for service invocation API

See the Allow lists for service invocation guide for information and examples on how to set allow lists with ACLs which using service invocation API.

Turning on preview features

See the preview features guide for information and examples on how to opt-in to preview features for a release. Preview feature enable new capabilities to be added that still need more time until they become generally available (GA) in the runtime.

Example sidecar configuration

The following yaml shows an example configuration file that can be applied to an applications’ Dapr sidecar.

  1. apiVersion: dapr.io/v1alpha1
  2. kind: Configuration
  3. metadata:
  4. name: myappconfig
  5. namespace: default
  6. spec:
  7. tracing:
  8. samplingRate: "1"
  9. httpPipeline:
  10. handlers:
  11. - name: oauth2
  12. type: middleware.http.oauth2
  13. secrets:
  14. scopes:
  15. - storeName: localstore
  16. defaultAccess: allow
  17. deniedSecrets: ["redis-password"]
  18. accessControl:
  19. defaultAction: deny
  20. trustDomain: "public"
  21. policies:
  22. - appId: app1
  23. defaultAction: deny
  24. trustDomain: 'public'
  25. namespace: "default"
  26. operations:
  27. - name: /op1
  28. httpVerb: ['POST', 'GET']
  29. action: deny
  30. - name: /op2/*
  31. httpVerb: ["*"]
  32. action: allow

Control-plane configuration

There is a single configuration file called daprsystem installed with the Dapr control plane system services that applies global settings. This is only set up when Dapr is deployed to Kubernetes.

Control-plane configuration settings

A Dapr control plane configuration can configure the following settings:

PropertyTypeDescription
enabledboolSet mtls to be enabled or disabled
allowedClockSkewstringThe extra time to give for certificate expiry based on possible clock skew on a machine. Default is 15 minutes.
workloadCertTTLstringTime a certificate is valid for. Default is 24 hours

See the Mutual TLS HowTo and security concepts for more information.

Example control plane configuration

  1. apiVersion: dapr.io/v1alpha1
  2. kind: Configuration
  3. metadata:
  4. name: default
  5. namespace: default
  6. spec:
  7. mtls:
  8. enabled: true
  9. allowedClockSkew: 15m
  10. workloadCertTTL: 24h

Last modified November 26, 2021: fix: small typo replace semicolons with colons (3f307294)