Project: Dapr (App Definition and Development / Application Definition & Image Build)
File: v1.11.0.md

We're happy to announce the release of Dapr 1.11! We would like to extend our thanks to all the new and existing contributors who helped make this release happen. If you're new to Dapr, visit the page and familiarize yourself with Dapr. Docs have been updated with all the new features and changes of this release. To get started with new capabilities introduced in this release, go to the and the pages. Note: This release contains a few . See for instructions on upgrading Dapr to version 1.11. If upgrading to v1.11.0 with the Dapr CLI, make sure you're using the version of the CLI. Older versions of the CLI cannot upgrade to the v1.11.0 runtime version. Thanks to everyone who made this release possible! @AaronCrawfis, @abhi314e, @abossard, @AdamKorcz, @addjuarez, @alicejgibbons, @artursouza, @ASHIQUEMD, @berndverst, @binnn6, @bruth, @cciobanu98, @cgillum, @champel, @cmoulliard, @codefromthecrypt, @DeepanshuA, @dmutterSF, @drewby, @ehalsey, @fernandosmither, @filintod, @Flern, @gaofeihang, @greenie-msft, @handlerww, @hhunter-ms, @HiltonGiesenow, @hunter007, @iamnicoj, @ItalyPaleAle, @jackycsl, @JaimeStill, @JaydipGabani, @jjcollinge, @JoshVanL, @Juneezee, @k0da, @KarlisAG, @kayayarai, @kubemq, @kushalnl7, @LaurenceLiZhixin, @leepa, @letmerecall, @liu-song, @louisquach, @macel94, @MatejNedic, @matzew, @mcandeia, @mdarii, @MregXN, @msfussell, @mukundansundar, @naah69, @NickLarsenNZ, @nponraj, @nyemade-uversky, @obenarchid, @owainow, @owenchenxy, @ParrySMS, @paulyuk, @philliphoff, @pimmerks, @pravinpushkar, @riverar, @robertojrojas, @rosdi, @RyanLettieri, @ryou90, @sab-codes, @salmankhan-prs, @sarsharma, @serpentfabric, @shivamkm07, @shivanisinghnitp, @shubham1172, @sicoyle, @SoTrx, @SpikeWong, @stuartleeks, @sunzhaochang, @Taction, @taenyang, @tanopanta, @tharun634, @thombrn, @ThorstenHans, @tianyax, @timcallaghan, @tmacam, @tomkerkhove,@tottoto, @Vishal07051999, @wolvever, @worming004, @wralith, @XavierGeerinck, @xclayl, @yaron2, @yash-nisar, @ZhangSetSail These are the v1.11 release highlights: The is now a v1 stable API including the APIs in all SDKs. Read more on the . Stable APIs are non-breaking in future versions and change go through versioning. Read more on This release extended service invocation to be able to call non-Dapr endpoints. For example: You may choose to only use Dapr in part of your overall application, including brownfield development. You may not have access to the code to migrate an existing application to use Dapr. You want Dapr features like resiliency policies and observability applied to non-Dapr service calls. You need to call an external HTTP service. For more information read Workflow had several updates including You now have the ability to in the management API. You can now have a workflow wait on an for example a person responding to a request. The Python SDK now supports Dapr Workflow along with the .NET SDK. Note In this release there have been breaking changes to the Workflow APIs. For example workflow `instanceID` is now supplied as a query parameter when starting a workflow You can read more on the workflow APIs A new alpha has been introduced to enable the enryption and decryption of data using key information. With the cryptography building block, you can leverage cryptography in a safe and consistent way. Dapr exposes APIs that allows you to perform operations, such as encrypting and decrypting messages, within the Dapr sidecar, without exposing cryptographic keys to your application. There are also alpha that you can use with the building block. Try out the to see this in

From this release there are The default image contains all components which is the same as has been done for all release to date. A new variation containing only stable components, using the `stablecomponents` tag. The Dapr dashboard is no longer installed by default with the Dapr control plane when installing via Helm. To install the dashboard, use the new `dapr-dashboard` chart: ```sh helm repo add dapr https://dapr.github.io/helm-charts/ helm repo update kubectl create namespace dapr-system helm install dapr dapr/dapr-dashboard --namespace dapr-system ``` When using `dapr init` or `dapr init -k` with Dapr CLI, the Dapr Dashboard is still installed. On Kubernetes, it will automatically use the new `dapr-dashboard` Helm chart. Dapr 1.11 offers container images for Windows Server 2022, using the `windows-ltsc2022` tag. This is in addition to the images based on Windows Server 1809. In Dapr 1.11, the CLI flag `--app-protocol` can now assume 3 more values in addition to `http` and `grpc`: `https` and `grpcs` use HTTP and gRPC, respectively, but enable TLS. > Note: With Dapr 1.11, using `--app-protocol=https` and `--app-protocol=grpcs` is preferred to the previous option of setting `--app-ssl=true` (which is still supported but considered deprecated). `h2c` is a new value that configures Dapr to connect to your app using HTTP/2 Cleartext. Using HTTP/2 (including HTTP/2 Cleartext) can offer noticeable performance benefits when Dapr communicates with your app. It requires your app to expose a HTTP/2-capable server. You can now with multi-app run command `dapr run -f .` A new enables a which enables you to have the state automatically removed after a certain time Metrics for are now reported Metrics for are now reported The following features are now stable, having been in preview for at least 2 releases. App Health Checks is now stable, changing the default HTTP healthcheck path to `/healthz` There are now over 100+ components in Dapr (115 in total). New components added in this release: Bindings: - State stores: - Cryptography: - - Starting with Dapr 1.11, support for authenticating with Azure AD has been added to these components: Additionally, all Azure components that support Azure AD now support authentication using: on Kubernetes Credentials from the Azure CLI, useful for local development and testing Azure CosmosDB CockroachDB MongoDB MySQL and MariaDB SQL Server (Azure SQL) This release focused on preparing more components for `beta` and `stable` designation. This means certification tests are added and quality issues are addressed. Read for details. The following components are now `stable` Bindings: Middlewares: - PubSub: State stores: - Configuration stores: - The following components that were deprecated in a previous version of Dapr have been removed from Dapr 1.11: Bindings: Twitter PubSub: Hazelcast FIXED DaprGrpcClient making blocking calls. ADDED Support for suspending, resuming, and raising events to workflows ADDED Support for Dapr Workflow management ADDED New Dapr Workflow authoring SDK `dapr-ext-workflow` ADDED Support for cryptography APIs ADDED Support for Dapr Workflow management ADDED Support for Distributed Lock API on HTTP ADDED Support for cryptography APIs You can now with multi-app run command By setting the `--app-channel-address` flag, you can instruct Dapr to send all events to the configured address You can now provide multiple resource paths. Example: `dapr run --resources-path ./mycomponents --resources-path

The following new have been added All quickstarts snap to the latest SDKs Numerous quality improvements and fixes If you're new to Dapr, visit the page and familiarize yourself with Dapr. Docs have been updated with all the new features and changes of this release. To get started with new capabilities introduced in this release, go to the and the . Note: This release contains a few . See section on upgrading Dapr to version 1.11.0. ADDED Multiple build variations of Dapr sidecar: `stablecomponents` and `allcomponents` ADDED Kubernetes labels `dapr.io/sidecar-injected` and `dapr.io/app-id` when Dapr sidecar is injected ADDED Extend Service invocation to non-Dapr endpoints UPDATED Dapr Dashboard has been moved from `dapr` Helm chart to a new `dapr-dashboard` chart FIXED Distinguish between retrialable and non-retriable errors when publishing messages with pubsub UPDATED Make Configuration API stable FIXED Dapr Operator uses lots of memory when there are lots of pods that aren't Dapr-enabled ADDED Accept traceparent for incoming CloudEvent ADDED Ingress template for the dashboard helm chart UPDATED Use ERROUTBOUNDHEALTHNOTREADY for Dapr's outbound health error ADDED Option to Operator to disable the reconciler for Services ADDED Dynamic allowed service accounts watcher for injector ADDED Dynamic watch for serviceaccount UIDs so injector can inject sidecar created by a synced serviceaccount from a virtual cluster ADDED Support for multiple `--resources-path` flags on daprd ADDED When the port for the internal gRPC server is unset, return a "stable" value for better local developer experience ADDED Support for `seccompProfile` in Dapr sidecar via injector ADDED Option to skip installing the Dapr Sidecar Injector with Helm charts FIXED Sentry to preserve original secret metadata ADDED Pluggable components injector UPDATED Granularity on resiliency metrics FIXED Reduced memory consumption in Dapr Operator cache FIXED Allow trace header propagation without trace exporting ADDED API denylist to Dapr config, complementing API allowlist ADDED Publishing Docker images based on Windows 2022 ADDED Support for multiple workflow apps in a single cluster FIXED Create/delete reminder throwing "possible etag mismatch" after enabling resiliency FIXED Dapr returns 200 response instead of 302 for application redirect (version 1.10.2) ADDED Support Min TLS Version via Configuration ADDED Metrics for Actor reminder and timer ADDED Support for Argo Rollouts Controller FIXED Panic when subscriber listen message in Redis ADDED New workflow APIs: Pause and Resume Purge Support for Raise Event UPDATED Enforce minimum TLS version 1.2 for communication between internal Dapr services and sidecars UPDATED Enforce minimum TLS version to 1.2 for HTTP and gRPC app channels FIXED Bulk pubsub subscriber panics when tracing is disabled FIXED Service invocation not forwarding multiple headers with same name from response ADDED Ability to configure TTL in Actor State Store operations as a preview feature FIXED Alicloud tablestore is not registered in daprd FIXED: Health checks do not work when using HTTPS for app channel FIXED Workflows: actor ID should not use

`#` character (Workflows not working with Cosmos DB) FIXED Fixed: deleting a reminder should be a no-op when the reminder doesn't exist ADDED Option to disable Dapr Placement service ADDED Allow setting OTEL endpoint with the `OTELEXPORTEROTLP_ENDPOINT` env var ADDED Allow overriding app channel address ADDED High-level crypto APIs for gRPC and HTTP ADDED `https` and `h2c` to `app-protocol` for better HTTP/2 support, and deprecate `app-ssl` ADDED Case-insensitive parsing of metadata properties `actorStateStore` and `keyPrefix` ADDED Azure Key Vault component for Crypto building block UPDATED App Health Checks are stable (and change the default HTTP healthcheck path to `/healthz`) FIXED Panic in bulk publish while unmarshalling incorrect cloudevent FIXED HTTP Channel: Add "Content-Type" header only if not empty FIXED Unsubscribe config api: response with incorrect subscriptionID FIXED Connection leak problem of app callback gRPC client FIXED Implement nil-check for CEL program in matchRoutingRule ADDED App channel address is now configurable ADDED `daprhttpserverresponsecount` metric FIXED Panic while decrypting empty value from state stores FIXED State store: make BulkSet/BulkDelete not transactional in all state stores ADDED `dapr-http-max-request-size` now applies to gRPC proxying too ADDED `reinvocationPolicy: IfNeeded` to Dapr Sidecar injector FIXED Bulk pubsub subscriber panics when tracing is disabled ADDED Namespace to Helm chart resources FIXED RBAC permissions for operator-admin FIXED Bulk subscription - sidecar crashes after first batch is delivered FIXED Decoding slash in url FIXED Bulk subscribe response when app replies back with some incorrect message ADDED Add root `name` property to run file UPDATED Log message to reflect the container runtime ADDED `DAPRCONTAINERRUNTIME` env in addition to `--container-runtime`

ADDED Support for multiple `--resources-path` flags UPDATED Send merged STDOUT to console on `dapr run -f` ADDED Option to initialise Dapr cluster with custom certificates FIXED Enabling App Health Checks causes unexpected behaviour in dapr list FIXED `~` does not resolve to home folder in `in dapr run -f` ADDED Initialize Dapr dashboard from separate helm chart ADDED Add new protocols to `app-protocol`, including HTTP/2 Cleartext, and deprecate `app-ssl` FIXED Wrong target HTTP Unix Domain Socket ADDED Allow app channel address to be passed via CLI ADDED Add `httpendpoint` resource on `dapr init -k` Bindings: AWS SES: Remove required checks for secretKey and accessKey Azure Service Bus: Allow configuring message headers Azure Storage Queues: Added support for authentication with Azure AD Polling interval is now configurable GraphQL: Add support for query variables HTTP: Response timeout is now customizable Added support for mTLS Added TLS renegotiation KubeMQ: Fixed panic and small production issues RabbitMQ: New `reconnectWaitInSeconds` metadata property Support for mTLS and external authentication with SASL Redis: Support GetDel operation Support Increment Operation and TTL State stores: All state stores: Allow storing empty string values in all state stores Remove native/transactional BulkSet/BulkDelete support for consistency etag failures return the proper error on all components AWS DynamoDB: Added transaction support Azure Cosmos DB: Add support for merge partitions CockroachDB: Added support for TTLs MongoDB: Added support for TTLs Can now connect to MongoDB using a `connectionString` metadata option Detect replica sets to improve error reporting and transaction support Improve BSON serialization to address issues with storing actor reminders MySQL: Added support for TTLs Improved BulkGet performance with native support Oracle database: Component is now beta, including many fixes Redis: Fixed handling of JSON in Multi RethinkDB: Disable (undocumented) transaction support that was not working correctly SQL Server (Azure SQL): Added support for authenticating with Azure AD Added support for TTLs Case-insensitive matching for `database` in connstring SQLite: Improved handling of concurrent access by multiple processes PubSub: Apache Pulsar Add support for End-to-End encryption Added partition support Azure Service Bus components: Allow configuring message headers JetStream: Fixed: Competing consumers pattern doesn't work in JetStream RabbitMQ: Add support for priority queues Support for external authentication with SASL Fixed exchange declare RocketMQ: Add new configuration options for RocketMQ Middlewares: OAuth2: Fixed: Oauth2 middleware adds Bearer token to request headers. OpenID Connect (Bearer): Multiple fixes for Bearer HTTP Middleware Open Policy Agent (OPA): Fixed: additional_headers not set on allowed requests WASM: Changed config to `url` instead of `path` Nameresolvers: Consul: Consul nameresolver has been improved for performance and stability Secret stores: Hashicorp Vault: Fix vault prefix empty Local env: Adedd `prefix` metadata option All Azure components now support Azure AD Workload Identity All Azure components can now authenticate using Azure AD with credentials from the Azure CLI, for local development UPDATED DurableTask SDK dependency to get ARM64 compatibility UPDATED Improvements to Dapr Client APIs for Workflow ADDED .NET Runtime Support Policy ADDED Support for suspending, resuming, and raising events to workflows UPDATED Rename `WorkflowEngineClient` to `DaprWorkflowClient` and added additional APIs. UPDATED Config API to stable ADDED Workflow Sample to Pause/Resume and Raise Event as part of workflow FIXED Incorrect TaskFailedException is used when exceptions are thrown from workflow activities ADDED Proper workflow retry support REMOVED Obsolete attribute from config API classes ADDED Workflow demo to how to FIXED Create new client error CHANGED Switched router from gorilla/mux to chi ADDED gRPC options on gRPC server ADDED Support to set own gRPC server when calling `NewService` ADDED Support for app to use HTTP protocol with customized headers UPDATED Update Configuration API Subscribe method UPDATED Update client's configuration methods with stable config api ADDED Support for cryptography APIs (alpha) FIXED DaprGrpcClient making blocking calls. ADDED PubSub subscriber examples over gPRC UPDATED Config API to use stable endpoints. ADDED Async support for Python SDK (`dapr.aio.clients.DaprClient`) ADDED Support for Dapr Workflow management ADDED New Dapr Workflow authoring SDK `dapr-ext-workflow` CHANGED Configuration API now stable and implementation uses stable APIs FIXED RecursionError in conf settings class when accessing unimplemented settings ADDED HTTP support for Distributed Locking FIXED State query returns empty string instead of StateQueryResponseType ADDED Support for optional attributes in state management DEPRECATED `createHTTPMetadataQueryParam` in favor of `createHTTPQueryParam` ADDED Support for Workflow management APIs FIXED Delete operation in actor state provider to use the correct operation ADDED Support for cryptography APIs (alpha) ADDED Dev package release pipeline for JavaScript SDK UPDATED Configuration API to use stable endpoint To upgrade to this release of Dapr, follow the steps here to ensure a smooth upgrade. You know, the one where you don't get red errors on the terminal.. we all hate that, right? Uninstall Dapr using the CLI you currently have installed. Note that this will remove the default $HOME/.dapr directory, binaries and all containers daprredis, daprplacement and

Linux users need to run sudo if docker command needs sudo: ```bash dapr uninstall --all ``` For RC releases like this, download the latest and greatest release from and put the `dapr` binary in your PATH. Once you have installed the CLI, run: ```bash dapr init --runtime-version=1.11 ``` Wait for the update to finish, ensure you are using the latest version of Dapr(1.11) with: ```bash $ dapr --version CLI version: 1.11 Runtime version: 1.11 ``` You can perform zero-downtime upgrades using both Helm 3 and the Dapr CLI. Download the latest RC release from and put the `dapr` binary in your PATH. To upgrade Dapr, run: ``` dapr upgrade --runtime-version 1.11 -k ``` To upgrade with high availability mode: ``` dapr upgrade --runtime-version 1.11 --enable-ha=true -k ``` Wait until the operation is finished and check your status with `dapr status -k`. All done! Note: Make sure your deployments are restarted to pick the latest version of the Dapr sidecar To upgrade Dapr using Helm, run: ``` helm repo add dapr https://dapr.github.io/helm-charts/ helm repo update helm upgrade dapr dapr/dapr --version 1.11 --namespace=dapr-system --wait ``` Wait until the operation is finished and check your status with `dapr status -k`. All done! Note: Make sure your deployments are restarted to pick the latest version of the Dapr sidecar Please see for a complete guide to installing Dapr on Kubernetes You can use Helm 3 to install Dapr: ``` helm repo add dapr https://dapr.github.io/helm-charts/ helm repo update kubectl create namespace dapr-system helm install dapr dapr/dapr --version 1.11 --namespace dapr-system --wait ``` Alternatively, you can use the latest version of CLI: ``` dapr init --runtime-version=1.11 -k ``` Verify the control plane pods are running and are healthy: ``` $ dapr status -k NAME NAMESPACE HEALTHY STATUS REPLICAS VERSION AGE CREATED dapr-sidecar-injector dapr-system True Running 1 1.11 15s 2023-06-02 13:07.39 dapr-sentry dapr-system True Running 1 1.11 15s 2023-06-02 13:07.39 dapr-operator dapr-system True Running 1 1.11 15s 2023-06-02 13:07.39 dapr-placement dapr-system True Running 1 1.11 15s 2023-06-02 13:07.39 ``` After Dapr 1.11 has been installed, perform a rolling restart for your deployments to pick up the new version of the sidecar. This can be done with: ``` kubectl rollout restart deploy/<deployment-name> ``` When communicating with apps using HTTPS or gRPC with TLS, Dapr now enforces the use of TLS 1.2 or higher. This behavior can be disabled temporarily using a Configuration option. The default path for HTTP app health checks has been changed to `/healthz`. The old path `/health` can still be used if configured explicitly. Dapr's Helm chart does not include the Dapr Dashboard anymore Workflows: Added support for multiple workflow apps in a single cluster Breaking changes to workflow management API The following components have been removed from Dapr 1.11 (): Twitter binding Hazelcast PubSub component UPDATED Update Configuration API Subscribe method UPDATED Update client's configuration methods with stable config api UPDATED Bump from reactor 2.3.5.RELEASE to 2.7.8 UPDATED Convert Config API to Stable endpoints. UPDATED Rename `WorkflowEngineClient` to `DaprWorkflowClient` and added additional APIs. The CLI flag `--app-ssl` (in both the Dapr CLI and daprd) has been deprecated in favor of using `--app-protocol` with values `https` or `grpcs`. The Windows Server 1809 images have been deprecated in favor of Windows Server 2022 images