Skip to content

feat(init): run Sentry with mTLS enabled in self-hosted init - #1738

Open
ep0ll wants to merge 10 commits into
dapr:masterfrom
ep0ll:feat(dapr-init-sentry)/self-hosted
Open

feat(init): run Sentry with mTLS enabled in self-hosted init#1738
ep0ll wants to merge 10 commits into
dapr:masterfrom
ep0ll:feat(dapr-init-sentry)/self-hosted

Conversation

@ep0ll

@ep0ll ep0ll commented Oct 30, 2026 •
edited
Loading

Copy link
Copy Markdown

Description

Wire up the existing --enable-mtls flag in dapr init so that it provisions the Sentry service and enables mTLS in the default configuration. This covers a subset of
#1648.

Changes:

  • Add an --enable-mtls example to the dapr init cobra command help.
  • Add EnableMTLS to InitOptions. When set, the init flow runs the install-sentry and run-sentry-service steps.
  • Add public GetDaprSentryCertsPath helper that returns the Sentry certs directory (<GetDaprRuntimePath>/certs).
  • runSentryService mounts the local certs directory (read-write, so Sentry can write generated certs) and the default configuration directory (read-only) into the container as volumes.
  • Pass --trust-domain=cluster.local, --issuer-credentials and --config as container entrypoint args, as described in the Dapr self-hosted mTLS docs: https://docs.dapr.io/operations/security/mtls/#self-hosted
  • Enable mTLS in the default configuration when the flag is used.

Issue reference

Refs: #1648

Checklist

Please make sure you've completed the relevant tasks for this PR, out of the following list:

  • Code compiles correctly
  • Created/updated tests
  • Extended the documentation

@ep0ll
ep0ll force-pushed the feat(dapr-init-sentry)/self-hosted branch from d0869bf to fbe1f85 Compare November 1, 2026 07:58
@ep0ll

ep0ll commented Nov 1, 2026

Copy link
Copy Markdown
Author

@JoshVanL can you please look at this PR. this currently works locally on my mac, but when i run in github codespaces, the volumes are becoming readonly

NOTE: i am taking assist of LLMs to generate tests, the current tests are expected to be falsy and possibly can also error/tests-might-fail, so please ignore the current test files

@ep0ll
ep0ll marked this pull request as ready for review November 1, 2026 11:00
@ep0ll
ep0ll requested review from a team as code owners November 1, 2026 11:00
@ep0ll
ep0ll force-pushed the feat(dapr-init-sentry)/self-hosted branch from 58b09c9 to 7758079 Compare November 1, 2026 14:32
ep0ll added 10 commits November 1, 2026 20:07
@ep0ll
feat(init): run Sentry with mTLS enabled in self-hosted init
801fff9 
Wire up the existing `--enable-mtls` flag in `dapr init` so that it
provisions the Sentry service and enables mTLS in the default
configuration. This covers a subset of
dapr#1648.

Changes:
- Add an `--enable-mtls` example to the `dapr init` cobra command help.
- Add `EnableMTLS` to `InitOptions`. When set, the init flow runs the
  install-sentry and run-sentry-service steps.
- Add public `GetDaprSentryCertsPath` helper that returns the Sentry
  certs directory (`<GetDaprRuntimePath>/certs`).
- `runSentryService` mounts the local certs directory (read-write, so
  Sentry can write generated certs) and the default configuration
  directory (read-only) into the container as volumes.
- Pass `--trust-domain=cluster.local`, `--issuer-credentials` and
  `--config` as container entrypoint args, as described in the Dapr
  self-hosted mTLS docs:
  https://docs.dapr.io/operations/security/mtls/#self-hosted
- Enable mTLS in the default configuration when the flag is used.

Refs: dapr#1648

Signed-off-by: ep0ll <wygininc@gmail.com>
@ep0ll
feat(uninstall): remove Sentry container if present
d05160c 
`dapr uninstall` now checks whether the Sentry container exists and
removes it alongside the other self-hosted containers. This covers a
subset of dapr#1648.

Changes:
- Check for an installed Sentry container during uninstall and remove
  it if found.
- The check does not depend on `--enable-mtls`. uninstall has no such
  flag, so Sentry is removed whenever it is installed, regardless of
  whether mTLS was enabled.
- No-op when Sentry is not installed.

Refs: dapr#1648

Signed-off-by: ep0ll <wygininc@gmail.com>
@ep0ll
chore(status-msg): show status message when dapr sentry is running
92d253a 
Signed-off-by: ep0ll <wygininc@gmail.com>
@ep0ll
Inject self-hosted mTLS env vars into daprd and apps in dapr run
6a39d78 
When mTLS is enabled in self-hosted mode, daprd needs DAPR_TRUST_ANCHORS,
DAPR_CERT_CHAIN, DAPR_CERT_KEY and NAMESPACE, which users currently
export by hand from $HOME/.dapr/certs before running `dapr run`.

Add standalone.MTLSEnv, which builds these variables from
<dapr-dir>/certs/{ca.crt,issuer.crt,issuer.key} and use it in both
run modes:

- With --run-file, the values are merged into common.env in GetApps,
  so every app in the run file receives them.
- Without --run-file, they are set on SharedRunConfig.Env.

Precedence, highest first: apps[i].env, common.env, variables already
exported in the shell, values read from the certs directory. Variables
already present in the environment are not overridden and their files
are not read.

If the certs are not present, nothing is injected and behaviour is
unchanged. Any other read error (e.g. permission denied) is returned
to the caller instead of being silently ignored. NAMESPACE defaults to
"default" and is only added when at least one cert variable is
injected.

Also fix a nil map write in mergeCommonAndAppsEnv, which panicked when
an app had no `env` block and common.env was non-empty.

The certs directory is resolved from the runtime path, so
--runtime-path and common.daprdInstallPath are respected.

Signed-off-by: ep0ll <wygininc@gmail.com>
@ep0ll
fix(sentry): prevent port conflicts and use absolute volume paths
648953f 
Update Sentry health and metrics ports to avoid conflicts with the Placement service.

Resolve Sentry certificate directory and configuration file paths to absolute paths to prevent path-resolution issues when running in Docker.

Standardize container paths for mounted volumes:
- Config: /.dapr/config.yaml
- Certificates: /.dapr/certs/

Signed-off-by: ep0ll <wygininc@gmail.com>
@ep0ll
ensure certs exists when MTLS enabled
4a23216 
Signed-off-by: ep0ll <wygininc@gmail.com>
@ep0ll
test(mtls): characterize existing self-hosted mTLS behavior
8f838d2 
Add tests for the mTLS code as it was before the refactor: config
detection, cert loading, sentry address and daprd args, default
configuration output, and the run-file env handling. Comments mark
behaviors that look questionable.

Signed-off-by: ep0ll <wygininc@gmail.com>
@ep0ll
Self-hosted: opt-in, and refactor code
c4a8538 
Signed-off-by: ep0ll <wygininc@gmail.com>
@ep0ll
llm generated tests
5b88bc8 
Signed-off-by: ep0ll <wygininc@gmail.com>
@ep0ll
fix tests excet in run_test.go file
ea4395f 
Signed-off-by: ep0ll <wygininc@gmail.com>
@ep0ll
ep0ll force-pushed the feat(dapr-init-sentry)/self-hosted branch from 7758079 to ea4395f Compare November 1, 2026 14:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ep0ll