1
┌──────────────────────────────────────┐
2
│            你的应用代码               │
3
├──────────┬──────────┬────────────────┤
4
│ 服务调用  │ 状态管理  │ 发布/订阅      │
5
│ (Service  │ (State   │ (Pub/Sub)     │
6
│  Invoca-  │  Store)  │               │
7
│  tion)    │          │               │
8
├──────────┴──────────┴────────────────┤
9
│          Dapr Sidecar                │
10
│   ┌──────────────┐ ┌──────────────┐  │
11
│   │ 可验证执行     │ │ 秘钥治理      │  │
12
│   │ (Verifiable  │ │ (Secret      │  │
13
│   │  Execution)  │ │  Mgmt)       │  │
14
│   └──────────────┘ └──────────────┘  │
15
├──────────────────────────────────────┤
16
│   Kubernetes / 本地 / 边缘            │
17
└──────────────────────────────────────┘

1
# 启用可验证执行
2
apiVersion: dapr.io/v1alpha1
3
kind: Configuration
4
metadata:
5
  name: verifiable-config
6
spec:
7
  verifiableExecution:
8
    enabled: true
9
    signingKey:
10
      # 使用硬件安全模块 (HSM) 或 Kubernetes Secret
11
      secretStore: "aws-secret-manager"
12
      secretName: "dapr-signing-key"
13
    auditTrail:
14
      storage: "s3://audit-logs-bucket"
15
      retentionDays: 365
16
    verification:
17
      required: true  # 所有入站调用必须经过验证

1
// 在服务 A 中调用服务 B
2
import dapr "github.com/dapr/go-sdk/client"
3

4
func ProcessOrder(order Order) error {
5
    client, err := dapr.NewClient()
6
    if err != nil { return err }
7
    defer client.Close()
8

9
    // 这次调用会自动生成审计证据
10
    resp, err := client.InvokeMethodWithContent(
11
        ctx,
12
        "payment-service",
13
        "charge",
14
        dapr.WithData(order),
15
        dapr.WithVerifiable(true),  // 要求可验证执行
16
    )
17

18
    // 你可以获取这次调用的"证据"
19
    receipt := resp.Headers.Get("X-Dapr-Verification-Receipt")
20
    log.Infof("调用凭证: %s", receipt)
21

22
    return nil
23
}

1
apiVersion: dapr.io/v1alpha1
2
kind: SecretStore
3
metadata:
4
  name: unified-secret-store
5
  namespace: production
6
spec:
7
  type: secretmanager.aws
8
  version: v1
9
  metadata:
10
    - name: region
11
      value: "us-east-1"
12
    - name: keyPrefix
13
      value: "prod-chenpingan"
14

15
---
16
# 应用声明自己需要的秘钥
17
apiVersion: dapr.io/v1alpha1
18
kind: SecretReference
19
metadata:
20
  name: db-credentials
21
  namespace: production
22
spec:
23
  store: unified-secret-store
24
  secrets:
25
    - key: "database/primary/username"
26
      name: DB_USERNAME
27
    - key: "database/primary/password"
28
      name: DB_PASSWORD

1
# Python 微服务
2
from dapr.clients import DaprClient
3

4
with DaprClient() as client:
5
    # Dapr 自动注入环境变量
6
    db_user = os.environ.get('DB_USERNAME')
7
    db_pass = os.environ.get('DB_PASSWORD')
8

9
    # 或者运行时获取
10
    secrets = client.get_secret(
11
        store_name='unified-secret-store',
12
        key='database/primary/username'
13
    )

1
# AI 推理管道的 Dapr 配置
2
apiVersion: dapr.io/v1alpha1
3
kind: Configuration
4
metadata:
5
  name: ai-pipeline-config
6
spec:
7
  # 为 AI 推理请求配置重试和超时
8
  httpPipeline:
9
    handlers:
10
      - name: retry
11
        type: middleware.http.retry
12
        properties:
13
          maxRetries: "3"
14
          retryInterval: "500ms"
15
      - name: rate-limit
16
        type: middleware.http.ratelimit
17
        properties:
18
          maxRequestsPerSecond: "100"

1
# AI 服务中的 Dapr 集成
2
import json
3
from dapr.clients import DaprClient
4
import asyncio
5

6
async def handle_inference_request(model_input: dict):
7
    async with DaprClient() as client:
8
        # 1. 查询缓存
9
        cached = await client.invoke_method(
10
            app_id="redis-cache",
11
            method="get",
12
            data=json.dumps({"key": str(model_input["id"])})
13
        )
14
        if cached:
15
            return json.loads(cached)
16

17
        # 2. 调用模型推理服务
18
        result = await client.invoke_method(
19
            app_id="model-server",
20
            method="predict",
21
            data=json.dumps(model_input),
22
        )
23

24
        # 3. 发布推理事件
25
        await client.publish_event(
26
            pubsub_name="ai-events",
27
            topic_name="inference-completed",
28
            data=json.dumps({
29
                "input_id": model_input["id"],
30
                "result": result,
31
                "latency_ms": 42,
32
            })
33
        )
34

35
        return json.loads(result)

1
apiVersion: apps/v1
2
kind: Deployment
3
metadata:
4
  name: my-service
5
  annotations:
6
    dapr.io/enabled: "true"
7
    dapr.io/app-id: "my-service"
8
    dapr.io/app-port: "8080"
9
    dapr.io/config: "verifiable-config"
10
spec:
11
  replicas: 3
12
  selector:
13
    matchLabels:
14
      app: my-service
15
  template:
16
    metadata:
17
      labels:
18
        app: my-service
19
    spec:
20
      containers:
21
      - name: app
22
        image: my-service:latest
23
        ports:
24
        - containerPort: 8080

1
# Dapr 组件配置：消息队列
2
apiVersion: dapr.io/v1alpha1
3
kind: Component
4
metadata:
5
  name: order-events
6
spec:
7
  type: pubsub.redis
8
  version: v1
9
  metadata:
10
    - name: redisHost
11
      value: "redis-master:6379"
12
    - name: redisPassword
13
      secretKeyRef:
14
        name: redis-password

1
apiVersion: dapr.io/v1alpha1
2
kind: Component
3
metadata:
4
  name: production-orders-db
5
  namespace: production
6
spec:
7
  type: state.redis
8
  version: v1
9
  metadata:
10
    - name: redisHost
11
      value: "redis-orders:6379"
12
    - name: keyPrefix
13
      value: "orders"
14
    - name: actorStateStore
15
      value: "true"
16
  # 只允许 orders-* 的应用访问
17
  scopes:
18
    - orders-api
19
    - orders-processor

1
apiVersion: dapr.io/v1alpha1
2
kind: Configuration
3
metadata:
4
  name: observability-config
5
spec:
6
  tracing:
7
    samplingRate: "1"  # 生产环境设为 1（全量采样最初几天，然后降到 0.1）
8
    zipkin:
9
      endpointAddress: "http://jaeger-collector:9411/api/v2/spans"
10
  metrics:
11
    enabled: true
12
    rules:
13
      - name: dapr-sidecar-metrics
14
        labels:
15
          - name: app
16
            value: "true"

1
# Deployment 中配置 initContainers 等待 Dapr Sidecar
2
spec:
3
  template:
4
    metadata:
5
      annotations:
6
        dapr.io/enabled: "true"
7
        dapr.io/app-id: "order-service"
8
        dapr.io/app-port: "8080"
9
    spec:
10
      initContainers:
11
        - name: wait-for-dapr
12
          image: busybox:1.36
13
          command:
14
            - sh
15
            - -c
16
            - |
17
              echo "Waiting for Dapr Sidecar..."
18
              until nc -z localhost 3500; do
19
                sleep 1
20
              done
21
              echo "Dapr Sidecar is ready!"