-
Notifications
You must be signed in to change notification settings - Fork 371
feat: Implement Dapr.SecretsManagement as a purpose-specific client #1794
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
Copilot
wants to merge
7
commits into
master
Choose a base branch
from
copilot/feature-dapr-secrets-management
base: master
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
7 commits
Select commit
Hold shift + click to select a range
b75f51b
feat: Add Dapr.SecretsManagement projects (Abstractions, Runtime, Gen…
Copilot 8514d77
fix: Remove duplicate _BuildGeneratorIfFirstTFM target from aggregato…
Copilot ff244d8
Address PR review feedback: standardize port, enable typed example, n…
Copilot 347e0c8
Merge origin/master to resolve conflicts in all.sln
Copilot f0384da
Merge remote-tracking branch 'origin/master' into copilot/feature-dap…
Copilot e6ce283
Merge origin/master to resolve conflict in all.sln (IntegrationTest.E…
Copilot 579833f
Merge origin/master to resolve conflicts in all.sln (AI, DistributedL…
Copilot File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| # Dapr Secrets Management Sample | ||
|
|
||
| This sample demonstrates how to use the Dapr Secrets Management SDK to retrieve secrets from Dapr secret store components. | ||
|
|
||
| ## Features Demonstrated | ||
|
|
||
| 1. **Direct secret retrieval** — Using `DaprSecretsManagementClient` to fetch individual or bulk secrets via gRPC. | ||
| 2. **Typed secret stores** — Using the `[SecretStore]` and `[Secret]` attributes with the source generator to create strongly-typed secret accessors. | ||
| 3. **Dependency injection** — Registering the secrets client and typed stores via `IServiceCollection` extensions. | ||
|
|
||
| ## Prerequisites | ||
|
|
||
| - [Dapr CLI](https://docs.dapr.io/getting-started/install-dapr-cli/) | ||
| - [.NET 10 SDK](https://dotnet.microsoft.com/download/dotnet/10.0) | ||
| - A configured Dapr secret store component (e.g., local file, Kubernetes secrets, Azure Key Vault) | ||
|
|
||
| ## Running the Sample | ||
|
|
||
| ```bash | ||
| dapr run --app-id secret-sample --app-port 6543 -- dotnet run | ||
| ``` | ||
|
|
||
| ## Endpoints | ||
|
|
||
| | Method | Path | Description | | ||
| |--------|------|-------------| | ||
| | GET | `/secrets/{storeName}/{key}` | Retrieve a single secret by key | | ||
| | GET | `/secrets/{storeName}` | Retrieve all secrets from a store | | ||
| | GET | `/typed-secrets` | Retrieve secrets using the source-generated typed store | | ||
|
|
||
| ## NuGet Package Note | ||
|
|
||
| When consuming from NuGet, install the single **`Dapr.SecretsManagement`** package. The sub-projects (`Abstractions`, `Runtime`, `Generators`) are bundled into this one package and are not published individually. | ||
|
|
||
| ```xml | ||
| <PackageReference Include="Dapr.SecretsManagement" Version="<version>" /> | ||
| ``` |
40 changes: 40 additions & 0 deletions
40
examples/SecretManagement/SecretManagementSample/IMyVaultSecrets.cs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| // ------------------------------------------------------------------------ | ||
| // Copyright 2026 The Dapr Authors | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
| // ------------------------------------------------------------------------ | ||
|
|
||
| using Dapr.SecretsManagement.Abstractions; | ||
|
|
||
| namespace SecretManagementSample; | ||
|
|
||
| /// <summary> | ||
| /// Example of a typed secret store interface. Apply the <see cref="SecretStoreAttribute"/> to an interface | ||
| /// and the Dapr Secrets Management source generator will produce: | ||
| /// 1. A concrete implementation that caches secrets loaded at startup. | ||
| /// 2. A DI registration extension method (e.g., <c>AddMyVaultSecrets()</c>). | ||
| /// | ||
| /// Properties without <see cref="SecretAttribute"/> use the property name as the secret key. | ||
| /// Properties with <see cref="SecretAttribute"/> use the specified secret name. | ||
| /// </summary> | ||
| [SecretStore("my-vault")] | ||
| public partial interface IMyVaultSecrets | ||
| { | ||
| /// <summary> | ||
| /// The database connection string, retrieved from the "db-connection-string" secret key. | ||
| /// </summary> | ||
| [Secret("db-connection-string")] | ||
| string DatabaseConnection { get; } | ||
|
|
||
| /// <summary> | ||
| /// The API key. Uses the property name "ApiKey" as the secret key. | ||
| /// </summary> | ||
| string ApiKey { get; } | ||
| } |
58 changes: 58 additions & 0 deletions
58
examples/SecretManagement/SecretManagementSample/Program.cs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,58 @@ | ||
| // ------------------------------------------------------------------------ | ||
| // Copyright 2026 The Dapr Authors | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
| // ------------------------------------------------------------------------ | ||
|
|
||
| using Dapr.SecretsManagement; | ||
| using Dapr.SecretsManagement.Extensions; | ||
| using SecretManagementSample; | ||
|
|
||
| var builder = WebApplication.CreateBuilder(args); | ||
|
|
||
| // Register the Dapr Secrets Management client and the source-generated typed secret store. | ||
| // AddMyVaultSecrets() is a generated extension method — see IMyVaultSecrets.cs. | ||
| builder.Services.AddDaprSecretsManagementClient() | ||
| .AddMyVaultSecrets(); | ||
|
|
||
| var app = builder.Build(); | ||
|
|
||
| // --- Example 1: Direct secret retrieval --- | ||
| app.MapGet("/secrets/{storeName}/{key}", async ( | ||
| string storeName, | ||
| string key, | ||
| DaprSecretsManagementClient secretsClient, | ||
| CancellationToken cancellationToken) => | ||
| { | ||
| var secret = await secretsClient.GetSecretAsync(storeName, key, cancellationToken: cancellationToken); | ||
| return Results.Ok(secret); | ||
| }); | ||
|
|
||
| // --- Example 2: Bulk secret retrieval --- | ||
| app.MapGet("/secrets/{storeName}", async ( | ||
| string storeName, | ||
| DaprSecretsManagementClient secretsClient, | ||
| CancellationToken cancellationToken) => | ||
| { | ||
| var secrets = await secretsClient.GetBulkSecretAsync(storeName, cancellationToken: cancellationToken); | ||
| return Results.Ok(secrets); | ||
| }); | ||
|
|
||
| // --- Example 3: Using the source-generated typed secret store --- | ||
| app.MapGet("/typed-secrets", (SecretManagementSample.IMyVaultSecrets secrets) => | ||
| { | ||
| return Results.Ok(new | ||
| { | ||
| DatabaseConnection = secrets.DatabaseConnection, | ||
| ApiKey = secrets.ApiKey | ||
| }); | ||
| }); | ||
|
|
||
| app.Run(); |
13 changes: 13 additions & 0 deletions
13
examples/SecretManagement/SecretManagementSample/Properties/launchSettings.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| { | ||
| "profiles": { | ||
| "SecretManagementSample": { | ||
| "commandName": "Project", | ||
| "dotnetRunMessages": true, | ||
| "launchBrowser": false, | ||
| "applicationUrl": "http://localhost:6543", | ||
| "environmentVariables": { | ||
| "ASPNETCORE_ENVIRONMENT": "Development" | ||
| } | ||
| } | ||
| } | ||
| } |
29 changes: 29 additions & 0 deletions
29
examples/SecretManagement/SecretManagementSample/SecretManagementSample.csproj
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| <Project Sdk="Microsoft.NET.Sdk.Web"> | ||
|
|
||
| <PropertyGroup> | ||
| <TargetFramework>net10.0</TargetFramework> | ||
| <Nullable>enable</Nullable> | ||
| <ImplicitUsings>enable</ImplicitUsings> | ||
|
|
||
| <!-- Added for demonstration purposes - emit generated source files to disk for inspection --> | ||
| <EmitCompilerGeneratedFiles>true</EmitCompilerGeneratedFiles> | ||
| <CompilerGeneratedFilesOutputPath>$(BaseIntermediateOutputPath)Generated</CompilerGeneratedFilesOutputPath> | ||
| </PropertyGroup> | ||
|
|
||
| <!-- | ||
| NOTE: When consuming from NuGet, use the single 'Dapr.SecretsManagement' package instead of | ||
| these individual project references. The sub-projects (Abstractions, Runtime, Generators) are | ||
| NOT published to NuGet individually — they are bundled into the Dapr.SecretsManagement package. | ||
|
|
||
| Replace the ProjectReference items below with: | ||
| <PackageReference Include="Dapr.SecretsManagement" Version="<version>" /> | ||
| --> | ||
| <ItemGroup> | ||
| <ProjectReference Include="..\..\..\src\Dapr.SecretsManagement.Abstractions\Dapr.SecretsManagement.Abstractions.csproj" /> | ||
| <ProjectReference Include="..\..\..\src\Dapr.SecretsManagement.Runtime\Dapr.SecretsManagement.Runtime.csproj" /> | ||
| <ProjectReference Include="..\..\..\src\Dapr.SecretsManagement.Generators\Dapr.SecretsManagement.Generators.csproj" | ||
| OutputItemType="Analyzer" | ||
| ReferenceOutputAssembly="false" /> | ||
| </ItemGroup> | ||
|
|
||
| </Project> | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Perfect