Add Akeyless Secrets Store Component #4036

kgal-akl · 2025-09-19T23:03:12Z

Description

Added a new Secret Store component for Akeyless.

Checklist

Please make sure you've completed the relevant tasks for this PR, out of the following list:

Issue reference

#4063

Requirements

Code compiles correctly, component loaded successfully after compiling local daprd with added Akeyless Secret Store component, secret retrieved:

Created tests
Created the dapr/docs PR: Add Akeyless Secret Store Documentation docs#4930
Created the dapr/dapr PR: Add Akeyless Secret Store Component dapr#9181

secretstores/akeyless/akeyless.go

secretstores/akeyless/utils.go

secretstores/akeyless/metadata.yaml

secretstores/akeyless/example.yaml

secretstores/akeyless/akeyless.go

secretstores/akeyless/utils.go

sicoyle

Thank you for iterating with me on this! Here's another batch of feedback for ya - I still have a bit more to review on this, but this is the main I think so far :) 🙌

secretstores/akeyless/README.md

secretstores/akeyless/akeyless.go

tuvia-akeyless

LGTM. Please verify (manually/tests) it is working for various types of dynamic and rotated secrets.

kgal-akl · 2025-12-01T18:39:40Z

@sicoyle - can you please review this again? There were a bunch of merge conflicts and it happens every I update the branch.

sicoyle · 2025-12-09T22:00:02Z

@sicoyle - can you please review this again? There were a bunch of merge conflicts and it happens every I update the branch.

Hi! Yes, thank you for your patience 🙏 I've been OOO for the past two weeks on vacation. I'm back now :)

sicoyle · 2025-12-09T22:03:52Z

can you please rebase onto main? There are over 10k lines changed now in this PR with a ton of unrelated changes...

Signed-off-by: Kobbi Gal <[email protected]>

kgal-akl · 2025-12-09T22:16:55Z

can you please rebase onto main? There are over 10k lines changed now in this PR with a ton of unrelated changes...

@sicoyle should be all cleaned up now. FYI, since your last review I added a few things:

Added support for authentication options for k8s, AWS IAM.
Added refresh token mechanism
Added support for filtering when bulk secret retrieval using path/secret type query params.

Signed-off-by: kgal-akl <[email protected]>

Signed-off-by: Kobbi Gal <[email protected]>

sicoyle

few comments so far with the additions. I will circle back again either later today or tomorrow for updates - thank you! :) Also as long as we get this merged sometime this month then this should be in the clear imo to make the next official dapr 1.17 release set for January🎉

secretstores/akeyless/README.md

sicoyle · 2025-12-10T15:00:28Z

secretstores/akeyless/akeyless.go

+// akeylessMetadata contains the metadata for the Akeyless secret store.
+type akeylessMetadata struct {
+	GatewayURL             string `json:"gatewayUrl" mapstructure:"gatewayUrl"`
+	GatewayTLSCA           string `json:"gatewayTLSCA" mapstructure:"gatewayTLSCA"`


GatewayTLSCA -> GatewayTlsCa please
Also, can any of these become unexported fields instead of exported?

GatewayTLSCA -> GatewayTlsCa please

Rename resolved in commit 91b9871.

can any of these become unexported fields instead of exported?
As far as I can tell, metadata fields need to be exported. The fields must remain exported. In metadata/utils.go (lines 219-221):

// fields that are not exported cannot be set via the mapstructure metadata decoding mechanism if !currentField.IsExported() { continue }

This means:

kitmd.DecodeMetadata (used in parseMetadata) uses mapstructure, which requires exported fields for reflection.

GetComponentMetadata uses GetMetadataInfoFromStructType, which skips unexported fields.

If we lowercase these fields:

parseMetadata would fail to decode metadata from the configuration.

GetComponentMetadata would skip them, breaking metadata documentation generation.

So I believe it's better to leave the fields as is.

However, I did find that some of the secret store receiver functions can be unexported since they're only used within the akeyless package (in test and other functions). I unexported them in commit ff08e2a.

Looks like the linter is actually asking me to rename GatewayTlsCa to GatewayTLSCa:

secretstores/akeyless/utils.go:281:22 stylecheck ST1003: func parameter gatewayTlsCa should be gatewayTLSCa

Should I revert the change or just add annotate/ignore it?

secretstores/akeyless/akeyless.go

sicoyle · 2025-12-10T15:24:02Z

secretstores/akeyless/akeyless.go

+				if reauthErr := a.ensureValidToken(ctx); reauthErr != nil {
+					return fmt.Errorf("failed to re-authenticate after 401: %w", reauthErr)
+				}


honestly this seems to me like it belongs elsewhere and we should have a dynamic client. Can you reference

components-contrib/common/aws/auth/auth_x509.go

Line 44 in 2390f7a

func (x *X509) RefreshX509(ctx context.Context) error {

see here using "latest" clients creds https://github.com/dapr/components-contrib/blob/main/common/component/kafka/clients.go#L14

I refactored this method, see #4036.

Are you suggesting that I create a new client in common/akeyless/client.go and move this logic there? Are we expecting other components to utilize Akeyless clients and this is why we want to move this logic to common?

Signed-off-by: Kobbi Gal <[email protected]>

kgal-akl · 2025-12-10T18:51:45Z

@sicoyle - I've finished going over the PR comments, let me know what you think.

Also, can you please let me know what I need to do to resolve this/(your sister's?) comment?

sicoyle · 2025-12-10T21:34:43Z

@sicoyle - I've finished going over the PR comments, let me know what you think.

Also, can you please let me know what I need to do to resolve this/(your sister's?) dapr/dapr#9181 (comment)?

Hahah yeah she's my twin actually! So after this PR is merged then in your PR in dapr/dapr you have to bump the components-contrib go mod reference and push that as well so dapr/dapr knows about your changes here. Essentially it will be a:

go get github.com/dapr/components-contrib@<grab commit sha from contrib main branch with this PR merged>

kgal-akl mentioned this pull request Oct 4, 2025

Add Akeyless Doc dapr/docs#4910

Closed

7 tasks

kgal-akl marked this pull request as ready for review October 4, 2025 05:09

kgal-akl requested review from a team as code owners October 4, 2025 05:09

tuvia-akeyless reviewed Oct 22, 2025

View reviewed changes

secretstores/akeyless/akeyless.go Outdated Show resolved Hide resolved

secretstores/akeyless/utils.go Outdated Show resolved Hide resolved

secretstores/akeyless/utils.go Outdated Show resolved Hide resolved

secretstores/akeyless/utils.go Outdated Show resolved Hide resolved

sicoyle reviewed Oct 22, 2025

View reviewed changes

secretstores/akeyless/metadata.yaml Show resolved Hide resolved

secretstores/akeyless/metadata.yaml Show resolved Hide resolved

secretstores/akeyless/example.yaml Outdated Show resolved Hide resolved

sicoyle reviewed Oct 22, 2025

View reviewed changes

kgal-akl requested a review from sicoyle October 22, 2025 17:33

kgal-akl force-pushed the add-akeyless-secretstore branch from a56fc84 to b2a72bf Compare October 22, 2025 19:17

sicoyle reviewed Oct 23, 2025

View reviewed changes

kgal-akl mentioned this pull request Oct 30, 2025

Add Akeyless Secret Store Documentation dapr/docs#4930

Open

7 tasks

tuvia-akeyless approved these changes Nov 5, 2025

View reviewed changes

alikdolg approved these changes Nov 5, 2025

View reviewed changes

This comment was marked as outdated.

Sign in to view

kgal-akl requested a review from sicoyle November 11, 2025 18:27

kgal-akl mentioned this pull request Nov 11, 2025

Add Akeyless Secret Store Component dapr/dapr#9181

Open

5 tasks

kgal-akl mentioned this pull request Nov 20, 2025

Add Akeyless Secret Store Component #4063

Open

kgal-akl force-pushed the add-akeyless-secretstore branch 3 times, most recently from bc57bc0 to 2718c8f Compare December 1, 2025 18:38

kgal-akl force-pushed the add-akeyless-secretstore branch from 850536c to 4226c9f Compare December 9, 2025 19:33

kgal-akl force-pushed the add-akeyless-secretstore branch from 79d16fc to e7bc2f8 Compare December 9, 2025 22:08

kgal-akl added 5 commits December 9, 2025 17:13

Add Akeyless Secrets Store Component

fc7b3d1

Signed-off-by: Kobbi Gal <[email protected]>

rm dup func

07b2a96

Signed-off-by: Kobbi Gal <[email protected]>

cleaned up tests

9a5ee65

Signed-off-by: Kobbi Gal <[email protected]>

handle nil response when auth

a86ca40

Signed-off-by: Kobbi Gal <[email protected]>

add gw tls conf

ae8999e

Signed-off-by: Kobbi Gal <[email protected]>

kgal-akl added 5 commits December 9, 2025 17:13

set access type for auth request

109dc0a

Signed-off-by: Kobbi Gal <[email protected]>

align k8s auth conf parameters (encode jwt, trim v2 endpoint

2f83dc8

Signed-off-by: Kobbi Gal <[email protected]>

fix zero-value init of secret response

cdc3f94

Signed-off-by: Kobbi Gal <[email protected]>

added token refresh support

5682fd3

Signed-off-by: Kobbi Gal <[email protected]>

readd akeyless dependencies

bb84293

Signed-off-by: Kobbi Gal <[email protected]>

kgal-akl force-pushed the add-akeyless-secretstore branch from e7bc2f8 to bb84293 Compare December 9, 2025 22:13

kgal-akl added 2 commits December 9, 2025 17:17

Merge branch 'main' into add-akeyless-secretstore

704bb4c

Signed-off-by: kgal-akl <[email protected]>

implemented get component metadata in store

21d3ae2

Signed-off-by: Kobbi Gal <[email protected]>

sicoyle reviewed Dec 10, 2025

View reviewed changes

kgal-akl added 8 commits December 10, 2025 11:58

camelcase gw tls ca field

91b9871

Signed-off-by: Kobbi Gal <[email protected]>

cont: camelcase gw tls ca field

a63c83e

Signed-off-by: Kobbi Gal <[email protected]>

cont: camelcase gw tls ca field

ff08e2a

Signed-off-by: Kobbi Gal <[email protected]>

change default auth method

e7ddc84

Signed-off-by: Kobbi Gal <[email protected]>

rm whitespace in go codeblock doc

45d562c

Signed-off-by: Kobbi Gal <[email protected]>

added 30s timeout to http client when using tls

41db6f7

Signed-off-by: Kobbi Gal <[email protected]>

check auth response output for token/expiration

c2e1b1c

Signed-off-by: Kobbi Gal <[email protected]>

refactor to use helper for 401 retry

2598ccf

Signed-off-by: Kobbi Gal <[email protected]>

kgal-akl requested a review from sicoyle December 10, 2025 18:47

Add Akeyless Secrets Store Component #4036

Are you sure you want to change the base?

Add Akeyless Secrets Store Component #4036

Conversation

kgal-akl commented Sep 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Issue reference

Requirements

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sicoyle left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tuvia-akeyless left a comment

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

kgal-akl commented Dec 1, 2025

Uh oh!

sicoyle commented Dec 9, 2025

Uh oh!

sicoyle commented Dec 9, 2025

Uh oh!

kgal-akl commented Dec 9, 2025

Uh oh!

sicoyle left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

sicoyle Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

kgal-akl Dec 10, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kgal-akl Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sicoyle Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

kgal-akl Dec 10, 2025

Choose a reason for hiding this comment

Uh oh!

kgal-akl commented Sep 19, 2025 •

edited

Loading

kgal-akl Dec 10, 2025 •

edited

Loading