Add idea: Dapr durable execution on CF - #33
Open
rkoster wants to merge 2 commits into
Open
Conversation
rkoster
requested review from
beyhan,
itsouvalas and
wayneeseguin
as code owners
August 11, 2026 06:37
… sidecar Reframes the developer-surface section around Diego's existing Envoy container-proxy injection (route integrity) as the precedent, rather than the manifest sidecars: feature. Envoy is already platform-injected, already handed the instance identity cert, and already operator-controlled - which is exactly the shape daprd needs, and reinforces the dapr-sentry bridging argument. Service bindings are retained for component configuration rather than for enabling Dapr itself.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A broad-strokes concept for integrating Dapr's durable-execution primitives (Workflow, Actors, Jobs/Reminders) into CF \u2014 the area where CF has a genuine gap, since
cf run-taskis one-shot and CF has no workflow engine, virtual actors, or durable reminders.Central insight: CF already owns the hardest part of Dapr's control plane \u2014 workload identity. Diego instance identity certs already carry
OU=app:/OU=space:/OU=organization:, which is exactly the(app-id, namespace)tupledapr-sentryexists to mint SPIFFE identities for. A Dapr namespace maps cleanly onto a CF org/space combo, and Dapr's namespace-scoped actor placement (v1.14+) verifies namespace claims against SPIFFE identity \u2014 which CF's certs make trustworthy by construction.Main content is a component-by-component adopt-vs-reimplement analysis:
dapr-sentry\u2192 bridge to the Diego instance identity CA (no second root of trust)dapr-operator\u2192 re-implement on CAPI + service bindingsdapr-sidecar-injector\u2192 re-implement on CF sidecars (no admission-webhook concept needed)dapr-placement-server\u2192 genuinely open; see the siblingdapr-aware-gorouterideadapr-scheduler-server\u2192 adopt upstream; this is the real gapAlso covers where RFC-0055 fits (actor invocation riding identity-aware routing instead of a parallel Dapr mTLS mesh, including RFC-0055's reserved
spiffe:policy-source prefix), two developer surfaces with tradeoffs (manifest flag vs.cf bind-service), and three broader adoption strategies presented as options rather than a recommendation.