Dapr extension for Azure Kubernetes Service (AKS) and Arc-enabled Kubernetes
Article
Distributed Application Runtime (Dapr) offers APIs that help you write and implement simple, portable, resilient, and secured microservices. Dapr APIs run as a sidecar process in tandem with your applications and abstract away common complexities you may encounter when building distributed applications, such as:
The Dapr extension is the only Microsoft-supported option for Dapr in AKS.
Issue handling
Microsoft categorizes issues raised against the Dapr extension into two parts:
Extension operations
Dapr runtime (including APIs and components)
The following table breaks down support priority levels for each of these categories.
Description
Security risks/Regressions
Functional issues
Extension operations
Issues encountered during extension operations, such as installing/uninstalling or upgrading the Dapr extension.
Microsoft prioritizes for immediate resolution.
Microsoft investigates and addresses as needed.
Dapr runtime
Issues encountered when using the Dapr runtime, APIs, and components via the extension.
Microsoft works with the open source community to investigate high priority issues. Depending on priority, severity, and size of the issue, Microsoft either resolves them directly in the extension, or works with the Dapr open source project to resolve in a hotfix or future Dapr open source release. Once fixes are released in Dapr open source, they are then made available in the Dapr extension.
Microsoft investigates new functional issues alongside the Dapr open source project and collaborates with them to resolve in a hotfix or future Dapr open source release. Known open source functional issues won't be investigated by Microsoft at this time.
Dapr versions
Microsoft provides best-effort support for the latest version of Dapr and two previous versions (N-2). The latest patch version is the only supported version of each minor version release. Currently, the Dapr extension for AKS or Arc-enabled Kubernetes supports the following Dapr versions:
1.14.x
1.13.x
1.12.x
You can run Azure CLI commands to retrieve a list of available versions in a cluster or a location.
The Dapr extension support varies depending on how you manage the runtime.
Self-managed
Self-managed runtime requires manual upgrade to remain in the support window. To upgrade Dapr via the extension, follow the Update extension instance instructions.
After a Dapr runtime version reaches end of Microsoft support, your applications continue to run unchanged. However, Microsoft can no longer provide security patches or related customer support for that runtime version. If your application encounters any problems past the end-of-support date for that version, we recommend upgrading to a supported version to receive the latest security patches and features.
Auto-upgrade
Enabling auto-upgrade requires careful consideration. While auto-upgrade keeps your Dapr extension updated to the latest minor version, you may experience breaking changes between updates. Microsoft isn't responsible for any downtime caused due to breaking changes between auto-updates.
Components and APIs
You can use all Dapr components and APIs via the Dapr extension, including those in alpha and beta status. However, Microsoft only provides support to a subset of APIs and components, following the defined issue handling policies.
Stable Dapr APIs
The Dapr extension supports stable versions of Dapr APIs (building blocks).
Allows publisher and subscriber apps to intercommunicate via an intermediary message broker. You can also create declarative subscriptions to a topic using an external component JSON file.
Retrieve and subscribe to application configuration items for supported configuration. stores.
Dapr components
Tier 1 versus Tier 2 components
A subset of Dapr components is supported. Within that subset, Dapr components are broken into two support categories: Tier 1 or Tier 2.
Tier 1 components: Stable components that receive immediate investigation in critical (security or serious regression) scenarios. Otherwise, Microsoft collaborates with open source to address in a hotfix or the next regular release.
Tier 2 components: Components that are investigated on a lesser priority, as they're not in stable state or are with a third party provider.
Tier 1 components
API
Component
Type
State management
Azure Cosmos DB Azure Blob Storage v1 Azure Table Storage Microsoft SQL Server
Global Azure cloud is supported with AKS and Arc support on the following regions:
Region
AKS support
Arc for Kubernetes support
australiaeast
✔️
✔️
australiasoutheast
✔️
❌
brazilsouth
✔️
❌
canadacentral
✔️
✔️
canadaeast
✔️
✔️
centralindia
✔️
✔️
centralus
✔️
✔️
eastasia
✔️
✔️
eastus
✔️
✔️
eastus2
✔️
✔️
eastus2euap
❌
✔️
francecentral
✔️
✔️
francesouth
✔️
❌
germanywestcentral
✔️
✔️
japaneast
✔️
✔️
japanwest
✔️
❌
koreacentral
✔️
✔️
koreasouth
✔️
❌
northcentralus
✔️
✔️
northeurope
✔️
✔️
norwayeast
✔️
❌
southafricanorth
✔️
❌
southcentralus
✔️
✔️
southeastasia
✔️
✔️
southindia
✔️
❌
swedencentral
✔️
✔️
switzerlandnorth
✔️
✔️
uaenorth
✔️
❌
uksouth
✔️
✔️
ukwest
✔️
❌
westcentralus
✔️
✔️
westeurope
✔️
✔️
westus
✔️
✔️
westus2
✔️
✔️
westus3
✔️
✔️
Frequently asked questions
How do Dapr and Service meshes compare?
While Dapr and service meshes do offer some overlapping capabilities, a service mesh is focused on networking concerns, whereas Dapr is focused on providing building blocks that make building applications as microservices easier. Dapr is developer-centric, while service meshes are infrastructure-centric.
Some common capabilities that Dapr shares with service meshes include:
Secure service-to-service communication with mTLS encryption
Service-to-service metric collection
Service-to-service distributed tracing
Resiliency through retries
Dapr provides other application-level building blocks for state management, pub/sub messaging, actors, and more. However, Dapr doesn't provide capabilities for traffic behavior, such as routing or traffic splitting. If your solution would benefit from the traffic splitting a service mesh provides, consider using Open Service Mesh.
For more information on Dapr and service meshes, and how they can be used together, visit the Dapr documentation.
How does the Dapr secrets API compare to the Secrets Store CSI driver?
Both the Dapr secrets API and the managed Secrets Store CSI driver allow for the integration of secrets held in an external store, abstracting secret store technology from application code.
The Secrets Store CSI driver mounts secrets held in Azure Key Vault as a CSI volume for consumption by an application.
Dapr exposes secrets via a RESTful API that can be:
Called by application code
Configured with assorted secret stores
The following table lists the capabilities of each offering:
Dapr secrets API
Secrets Store CSI driver
Supported secrets stores
Local environment variables (for Development); Local file (for Development); Kubernetes Secrets; AWS Secrets Manager; Azure Key Vault secret store; Azure Key Vault with Managed Identities on Kubernetes; GCP Secret Manager; HashiCorp Vault
Azure Key Vault secret store
Accessing secrets in application code
Call the Dapr secrets API
Access the mounted volume or sync mounted content as a Kubernetes secret and set an environment variable
Secret rotation
New API calls obtain the updated secrets
Polls for secrets and updates the mount at a configurable interval
Logging and metrics
The Dapr sidecar generates logs, which can be configured with collectors such as Azure Monitor, emits metrics via Prometheus, and exposes an HTTP endpoint for health checks
Emits driver and Azure Key Vault provider metrics via Prometheus
How does the managed Dapr cluster extension compare to the open source Dapr offering?
The managed Dapr cluster extension is the easiest method to provision Dapr on an AKS cluster. With the extension, you're able to offload management of the Dapr runtime version by opting into automatic upgrades. Additionally, the extension installs Dapr with smart defaults (for example, provisioning the Dapr control plane in high availability mode).
When installing Dapr open source via helm or the Dapr CLI, developers and cluster maintainers are also responsible for runtime versions and configuration options.
Lastly, the Dapr extension is an extension of AKS, therefore you can expect the same support policy as other AKS features.
If you install Dapr through the AKS extension, our recommendation is to continue using the extension for future management of Dapr instead of the Dapr CLI. Combining the two tools can cause conflicts and result in undesired behavior.
The source for this content can be found on GitHub, where you can also create and review issues and pull requests. For more information, see our contributor guide.
Azure Kubernetes Service feedback
Azure Kubernetes Service is an open source project. Select a link to provide feedback:
Administer an SQL Server database infrastructure for cloud, on-premises and hybrid relational databases using the Microsoft PaaS relational database offerings.