feat(secretstores): Add Akeyless Secretstore by kgal-akl · Pull Request #4385 · dapr/components-contrib

kgal-akl · 2026-05-12T18:43:12Z

Description

continuation of #4036.

Issue reference

Please reference the issue this PR will close: #4063

Checklist

Code compiles correctly
Created/updated tests
Extended the documentation
- Created the dapr/docs PR: Add Akeyless Secret Store Documentation docs#4930

Signed-off-by: Kobbi Gal <kobbi.g@akeyless.io>

Signed-off-by: Kobbi Gal <195813801+kgal-akl@users.noreply.github.com>

dapr-bot · 2026-06-11T19:24:49Z

This pull request has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in 7 days if no further activity occurs. Please feel free to give a status update now, ping for review, or re-open when it's ready. Thank you for your contributions!

Signed-off-by: kgal-akl <kobbi.g@akeyless.io>

kgal-akl · 2026-06-15T15:56:21Z

/ok-to-test

kgal-akl · 2026-06-15T15:57:23Z

@cicoyle @sicoyle can we please get this reviewed?

sicoyle

first round of feedback from me - thank you!!!

sicoyle · 2026-06-17T14:42:27Z

+type: secretstores
+name: akeyless
+version: v1
+status: beta


typically when we introduce new components we make them alpha

Suggested change

status: beta

status: alpha

sicoyle · 2026-06-17T14:44:12Z

+urls:
+  - title: Reference
+    url: https://docs.dapr.io/reference/components-reference/supported-secret-stores/akeyless/
+metadata:


pls mv the auth related fields into an authenticationProfiles: section similar to that of here https://github.com/dapr/components-contrib/blob/main/pubsub/kafka/metadata.yaml#L72

sicoyle · 2026-06-17T14:45:47Z

+  - name: k8sAuthConfigName
+    required: false
+    description: |
+      If using the k8s auth method, specify the name of the k8s auth config.


is this referring to ~/.kube/config or a config map? This is not clear to me. Please adjust to be clearer.

it's a config that includes some metadata the k8s service account jwt used for tokenreview api.
see https://docs.akeyless.io/docs/auth-with-kubernetes#create-kubernetes-gateway-auth-config-using-gateway-serviceaccount.

sicoyle · 2026-06-17T14:46:48Z

+    example: "eyJ..."
+    type: string
+    sensitive: true
+  - name: k8sAuthConfigName


sicoyle · 2026-06-17T14:47:03Z

+    example: "k8s-auth-config"
+    type: string
+  - name: k8sGatewayUrl
+    required: false
+    description: |
+      The gateway URL that where the k8s auth config is located.
+    example: "https://gw.akeyless.svc.cluster.local"
+    type: string
+  - name: k8sServiceAccountToken
+    required: false
+    description: |


rest of these are dupes

sicoyle · 2026-06-17T15:01:51Z

+	authRequest.SetK8sServiceAccountToken(metadata.K8sServiceAccountToken)
+
+	if metadata.K8SGatewayURL == "" {
+		a.logger.Debug("k8s gateway url is missing, using gatewayUrl")


Suggested change

a.logger.Debug("k8s gateway url is missing, using gatewayUrl")

a.logger.Debug("k8s gateway url is missing, using default")

?

sicoyle · 2026-06-17T15:08:26Z

+func parseSecretTypes(secretTypes string) ([]string, error) {
+	// Handle "all" or empty string which returns all supported secret types
+	if secretTypes == AllSecretTypes || secretTypes == "" {
+		return supportedSecretTypes, nil


Suggested change

return supportedSecretTypes, nil

return return append([]string(nil), supportedSecretTypes...), nil

sicoyle · 2026-06-17T15:11:00Z

+		return nil, errors.New("no secret types provided")
+	}


strings.Split returns [""] in an empty case so this is unreachable - pls rm

sicoyle · 2026-06-17T15:12:23Z

+}
+
+// startTokenRefreshRoutine starts a bg goroutine that refreshes the token
+func (a *akeylessSecretStore) startTokenRefreshRoutine(ctx context.Context, metadata *akeylessMetadata) {


is ctx used?

removed as part of #4385 (comment).

sicoyle · 2026-06-17T15:13:53Z

+
+			refreshDuration := time.Until(expiry.Add(-TokenRefreshGracePeriod))
+			if refreshDuration <= 0 {
+				refreshDuration = time.Minute // Refresh immediately if less than 1 minute left


pls double check with the aws x509 refresher at components-contrib/common/aws/auth/auth_x509.go and make sure the time choice and such you have here aligns nicely

aws cert refresh is lazy loaded. changed proactive approach to lazy load (store token in secretstore instance, check if valid (> 1m), if not, refresh). simplified flow so secret store apis call sdk directly (rm retry with 401) after token validity check. addressed in 09036f2.

Restructure metadata with authenticationProfiles, set status to alpha, and nest Kubernetes auth fields in akeylessK8sAuth. Signed-off-by: Kobbi Gal <195813801+kgal-akl@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com>

Rename constants with prefix-first naming, introduce SecretType and SecretResponse types, simplify stringifyStaticSecret, and split utils.go into auth.go, constants.go, secrets.go, and tls.go. Signed-off-by: Kobbi Gal <195813801+kgal-akl@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com>

kgal-akl · 2026-06-17T21:28:36Z

Addressed the remaining utils.go review feedback in akeylesslabs@e445b1be:

Split utils.go into auth.go, constants.go, secrets.go, and tls.go
Renamed constants with prefix-first naming (e.g. SecretResponseStatic, SecretTypeStatic, AuthTypeAccessKey)
Introduced typed SecretResponse and SecretType to avoid mixing API response values with metadata types
Simplified stringifyStaticSecret and return an error on nil secret values
Extracted producer/rotator status strings and the K8s service account token path to constants
Returned a defensive copy from parseSecretTypes and removed unreachable post-strings.Split code

Prior commits on this branch also cover the metadata/README/auth-profile changes, lazy token refresh, and removal of proactive background refresh / executeWithRetryOn401.

Docs PR update is still pending separately.

kgal-akl · 2026-06-19T17:33:05Z

@sicoyle changes addressed, please review again 🙏

dapr-bot · 2026-07-19T17:49:11Z

This pull request has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in 7 days if no further activity occurs. Please feel free to give a status update now, ping for review, or re-open when it's ready. Thank you for your contributions!

mikeee · 2026-07-25T13:24:25Z

@kgal-akl - before I review; could you please address the conflicts! Sorry about this.

Signed-off-by: kgal-akl <kobbi.g@akeyless.io>

kgal-akl · 2026-07-27T13:41:14Z

@kgal-akl - before I review; could you please address the conflicts! Sorry about this.

@mikeee done.

Copilot

Pull request overview

Adds a new Akeyless implementation of the Dapr Secret Store component, including client auth handling, TLS support for custom gateway CAs, component metadata/docs, and a comprehensive test suite.

Changes:

Introduces the secretstores/akeyless component implementation (auth, secret retrieval, bulk listing, TLS helper, constants).
Adds component docs (README.md) and component metadata (metadata.yaml) for configuration/auth profiles.
Adds unit/integration-style tests using httptest plus new Go module dependencies for the Akeyless SDK.

Reviewed changes

Copilot reviewed 9 out of 10 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
secretstores/akeyless/akeyless.go	Main secret store implementation (init/auth, GetSecret, BulkGetSecret, token refresh, list/filter logic).
secretstores/akeyless/auth.go	Auth helpers (accessId parsing/type detection, k8s auth config, token expiry parsing).
secretstores/akeyless/constants.go	Component constants and supported secret types.
secretstores/akeyless/secrets.go	Secret type parsing, static secret stringification, and secret “active” filtering logic.
secretstores/akeyless/tls.go	TLS config builder from base64-encoded PEM CA.
secretstores/akeyless/akeyless_test.go	Test suite using mock gateways and token refresh coverage.
secretstores/akeyless/README.md	End-user documentation and configuration examples.
secretstores/akeyless/metadata.yaml	Component metadata schema (fields + auth profiles).
go.mod	Adds Akeyless SDK deps; updates Azure SDK versions.
go.sum	Dependency checksum updates corresponding to go.mod changes.

Comments suppressed due to low confidence (1)

secretstores/akeyless/akeyless.go:313

This inline comment says only static secrets are supported for bulk get, but the code immediately retrieves dynamic and rotated secrets too. Keeping this comment accurate helps prevent future regressions.

	// separate items by type since only static secrets are supported for bulk get
	staticItemNames, dynamicItemNames, rotatedItemNames := a.separateItemsByType(listItems)
	a.logger.Infof("%d items returned (static: %d, dynamic: %d, rotated: %d)", len(listItems), len(staticItemNames), len(dynamicItemNames), len(rotatedItemNames))

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+	if value, ok := req.Metadata[MetadataKeyPath]; ok {
+		// normalize path
+		if !strings.HasPrefix(value, "/") {
+			secretsPath = "/" + value
+		}
+
+		a.logger.Debugf("using path '%s' from metadata...", secretsPath)
+	} else {


Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: kgal-akl <kobbi.g@akeyless.io>

kgal-akl and others added 3 commits March 5, 2026 21:36

dco

8c05c57

Signed-off-by: Kobbi Gal <kobbi.g@akeyless.io>

conflict

571a240

Signed-off-by: Kobbi Gal <195813801+kgal-akl@users.noreply.github.com>

upgrade akeyless go cloud to 0.3.8

2e6d78b

Signed-off-by: Kobbi Gal <195813801+kgal-akl@users.noreply.github.com>

kgal-akl requested review from a team as code owners May 12, 2026 18:43

kgal-akl added 2 commits May 12, 2026 14:46

revert unintended file changes from merge conflict

c56d70d

Signed-off-by: Kobbi Gal <195813801+kgal-akl@users.noreply.github.com>

rm workflow file

47df498

Signed-off-by: Kobbi Gal <195813801+kgal-akl@users.noreply.github.com>

kgal-akl mentioned this pull request May 12, 2026

Add Akeyless Secrets Store Component #4036

Closed

4 tasks

dapr-bot added the stale label Jun 11, 2026

Merge branch 'main' into add-akeyless-secretstore

775cad3

Signed-off-by: kgal-akl <kobbi.g@akeyless.io>

kgal-akl changed the title ~~Add Akeyless Secretstore~~ feat(secretstores): Add Akeyless Secretstore Jun 15, 2026

kgal-akl mentioned this pull request Jun 15, 2026

Add Akeyless Secret Store Component #4063

Closed

dapr-bot removed the stale label Jun 15, 2026

sicoyle requested changes Jun 17, 2026

View reviewed changes

kgal-akl and others added 2 commits June 17, 2026 17:03

kgal-akl requested a review from sicoyle June 17, 2026 21:29

dapr-bot added the stale label Jul 19, 2026

dapr-bot removed the stale label Jul 25, 2026

Merge branch 'main' into add-akeyless-secretstore

a7b4dc7

Signed-off-by: kgal-akl <kobbi.g@akeyless.io>

mikeee requested a review from Copilot July 27, 2026 14:33

Copilot started reviewing on behalf of mikeee July 27, 2026 14:34 View session

Copilot AI reviewed Jul 27, 2026

View reviewed changes

Apply suggestions from code review

59c10cd

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: kgal-akl <kobbi.g@akeyless.io>

	a.logger.Debug("k8s gateway url is missing, using gatewayUrl")
	a.logger.Debug("k8s gateway url is missing, using default")

	return supportedSecretTypes, nil
	return return append([]string(nil), supportedSecretTypes...), nil

Uh oh!

Conversation

kgal-akl commented May 12, 2026

Description

Issue reference

Checklist

Uh oh!

dapr-bot commented Jun 11, 2026

Uh oh!

kgal-akl commented Jun 15, 2026

Uh oh!

kgal-akl commented Jun 15, 2026

Uh oh!

sicoyle left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kgal-akl commented Jun 17, 2026

Uh oh!

kgal-akl commented Jun 19, 2026

Uh oh!

dapr-bot commented Jul 19, 2026

Uh oh!

mikeee commented Jul 25, 2026

Uh oh!

kgal-akl commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

kgal-akl commented Jul 27, 2026 •

edited

Loading