docs for dapr/components-contrib #972

[ItalyPaleAle]

What content needs to be created or modified?
dapr/components-contrib#972 updated these components by implementing support for the "common Azure auth layer".

• secretstores/azure/keyvault
• state/azure/blobstorage

There are a few docs updates that are required to highlight the new features:

1. For all components that support the "common Azure layer" (currently the two ones above), authentication is now supported also with Azure AD, which means Service Principals and MSI. Before, support was incomplete and inconsistent: secretstores/azure/keyvault did support Service Principals but only using certificates (not client secrets), and it supported MSI's. state/azure/blobstorage did not support Azure AD authentication at all, only shared keys; this has been added and now it supports service principals and MSI.
2. As part of this change, we've standardized the names of metadata properties. For AKV, the names have changed to these (note that the old names continue to work, but are considered legacy):

• spnTenantId -> azureTenantId
• spnClientId -> azureClientId
• spnCertificate -> azureCertificate
• spnCertificateFile -> azureCertificateFile
• spnCertificatePassword -> azureCertificatePassword

3. In order to support authentication with a SP and using a client secret, a new metadata property has been added to all the components that support the common Azure auth layer: azureClientSecret.
4. Note that the docs for AKV said that MSI were supported only on AKS. This is incorrect: MSI's should work also on Azure VMs, App Service, etc.

To recap, there are now multiple ways for the components that have been updated to authenticate with Azure.

• All the updated components support authentication via Azure AD, which comes in two flavors:
  1. Authenticating using a Service Principal requires setting azureTenantId, azureClientId, azureClientSecret.
  2. Authenticating using a SP with a certificate instead uses azureTenantId, azureClientId, and azureCertificate (optionally, azureCertificateFile and/or azureCertificatePassword if needed)
  3. Authenticating with a MSI doesn't require anything, although an azureClientId may be specified if needed (again, this is optional)
• Depending on the component, shared key authentication may be supported.
  • Azure Key Vault does not support this.
  • Azure Storage supports the old authentication with a accountKey

Describe the solution you'd like

These 3 pages will need to be updated to reflect the new authentication options:

• https://docs.dapr.io/reference/components-reference/supported-state-stores/setup-azure-blobstorage/
• https://docs.dapr.io/reference/components-reference/supported-secret-stores/azure-keyvault/
• https://docs.dapr.io/reference/components-reference/supported-secret-stores/azure-keyvault-managed-identity/

My proposal is actually to:

• Create a new page that explains how to authenticate supported components with Azure AD, covering service principals and MSI. This will contain content that today exists on https://docs.dapr.io/reference/components-reference/supported-secret-stores/azure-keyvault-managed-identity/
• Deprecate the current page https://docs.dapr.io/reference/components-reference/supported-secret-stores/azure-keyvault-managed-identity/
• Update the other two pages to point out the various authentication options.

The associated pull request from dapr/dapr, dapr/components-contrib, or other Dapr code repos
dapr/components-contrib#972

Additional context
Note that more components are being updated to support the common Azure auth layer (see dapr/components-contrib#1103). For example, a PR is being reviewed for Cosmos DB: dapr/components-contrib#1104 I am going to open a separate issue for that.

[artursouza]

@berndverst Can you look into this doc for 1.4?

[orizohar]

@artursouza @berndverst @ItalyPaleAle - we need a docs PR for this, looks like the code change will go out in v1.4

[ItalyPaleAle]

Ori when's the deadline? I can look into contributing at least the part explaining the common Azure auth layer by EOW.

[yaron2]

@ItalyPaleAle it'd be very helpful if you can work on this.

[orizohar]

Ori when's the deadline? I can look into contributing at least the part explaining the common Azure auth layer by EOW.

@ItalyPaleAle that would be terrific! We plan to release v1.4 9/14 (see dapr/dapr#3492) and we want all new features or behavior changes captured in the docs (in this case that means v1.4 branch of the docs repo)