OS Manuals

/usr/bin/sentry

Dapr Sentry service manages mTLS between services and acts as a certificate authority

From dapr-sentry-1.16 1.16.21-r4 (enterprise-packages), captured 2026-11-08 by running sentry --help (exit 0). permalink

Usage of sentry:
      --config string                        Path to config file, or name of a configuration object (default "daprsystem")
      --enable-metrics                       Enable prometheus metric (default true)
      --healthz-listen-address string        The listening address for the healthz server
      --healthz-port int                     The port for the healthz server to listen on (default 8080)
      --issuer-ca-filename string            Certificate Authority certificate filename (default "ca.crt")
      --issuer-certificate-filename string   Issuer certificate filename (default "issuer.crt")
      --issuer-credentials string            Path to the credentials directory holding the issuer data (default "/var/run/secrets/dapr.io/credentials")
      --issuer-key-filename string           Issuer private key filename (default "issuer.key")
      --jwks-filename string                 JWKS (JSON Web Key Set) filename (default "jwks.json")
      --jwt-enabled                          Enable JWT token issuance by Sentry
      --jwt-issuer string                    Issuer value for JWT tokens (no issuer if empty)
      --jwt-key-filename string              JWT signing key filename (default "jwt.key")
      --jwt-key-id string                    Key ID (kid) used for JWT signing (defaults to base64 encoded SHA-256 of the signing key)
      --jwt-signing-algorithm string         Algorithm used for JWT signing, must be supported by signing key (default "RS256")
      --jwt-ttl duration                     Time-to-live for JWT tokens (default 24h) (default 24h0m0s)
      --kubeconfig string                    (optional) absolute path to the kubeconfig file (default "/tmp/.kube/config")
      --listen-address string                The listen address for the sentry server
      --log-as-json                          print log as JSON (default false)
      --log-level string                     Options are debug, info, warn, error, or fatal (default info) (default "info")
      --metrics-listen-address string        The address for the metrics server (default "0.0.0.0")
      --metrics-port string                  The port for the metrics server (default "9090")
      --mode string                          Runtime mode for Dapr Sentry (default "standalone")
      --oidc-allowed-hosts strings           List of allowed hosts for OIDC HTTP endpoints
      --oidc-enabled                         Enable OIDC HTTP server for Dapr Sentry
      --oidc-jwks-uri string                 Custom URI where the JWKS can be accessed externally
      --oidc-path-prefix string              Path prefix to add to OIDC HTTP endpoints
      --oidc-server-listen-address string    The address for the OIDC HTTP server (default "localhost")
      --oidc-server-listen-port int          The port for the OIDC HTTP server (default 9080)
      --oidc-server-tls-cert-file string     TLS certificate file for the OIDC HTTP server (required when OIDC HTTP server is enabled)
      --oidc-server-tls-enabled              Serve OIDC HTTP with TLS (default true)
      --oidc-server-tls-key-file string      TLS key file for the OIDC HTTP server (required when OIDC HTTP server is enabled)
      --port int                             The port for the sentry server to listen on (default 50001)
      --trust-domain string                  The CA trust domain (default "localhost")
Options (33)
OptionDescriptionSource
--config stringPath to config file, or name of a configuration object (default "daprsystem")help
--enable-metricsEnable prometheus metric (default true)help
--healthz-listen-address stringThe listening address for the healthz serverhelp
--healthz-port intThe port for the healthz server to listen on (default 8080)help
--issuer-ca-filename stringCertificate Authority certificate filename (default "ca.crt")help
--issuer-certificate-filename stringIssuer certificate filename (default "issuer.crt")help
--issuer-credentials stringPath to the credentials directory holding the issuer data (default "/var/run/secrets/dapr.io/credentials")help
--issuer-key-filename stringIssuer private key filename (default "issuer.key")help
--jwks-filename stringJWKS (JSON Web Key Set) filename (default "jwks.json")help
--jwt-enabledEnable JWT token issuance by Sentryhelp
--jwt-issuer stringIssuer value for JWT tokens (no issuer if empty)help
--jwt-key-filename stringJWT signing key filename (default "jwt.key")help
--jwt-key-id stringKey ID (kid) used for JWT signing (defaults to base64 encoded SHA-256 of the signing key)help
--jwt-signing-algorithm stringAlgorithm used for JWT signing, must be supported by signing key (default "RS256")help
--jwt-ttl durationTime-to-live for JWT tokens (default 24h) (default 24h0m0s)help
--kubeconfig string(optional) absolute path to the kubeconfig file (default "/tmp/.kube/config")help
--listen-address stringThe listen address for the sentry serverhelp
--log-as-jsonprint log as JSON (default false)help
--log-level stringOptions are debug, info, warn, error, or fatal (default info) (default "info")help
--metrics-listen-address stringThe address for the metrics server (default "0.0.0.0")help
--metrics-port stringThe port for the metrics server (default "9090")help
--mode stringRuntime mode for Dapr Sentry (default "standalone")help
--oidc-allowed-hosts stringsList of allowed hosts for OIDC HTTP endpointshelp
--oidc-enabledEnable OIDC HTTP server for Dapr Sentryhelp
--oidc-jwks-uri stringCustom URI where the JWKS can be accessed externallyhelp
--oidc-path-prefix stringPath prefix to add to OIDC HTTP endpointshelp
--oidc-server-listen-address stringThe address for the OIDC HTTP server (default "localhost")help
--oidc-server-listen-port intThe port for the OIDC HTTP server (default 9080)help
--oidc-server-tls-cert-file stringTLS certificate file for the OIDC HTTP server (required when OIDC HTTP server is enabled)help
--oidc-server-tls-enabledServe OIDC HTTP with TLS (default true)help
--oidc-server-tls-key-file stringTLS key file for the OIDC HTTP server (required when OIDC HTTP server is enabled)help
--port intThe port for the sentry server to listen on (default 50001)help
--trust-domain stringThe CA trust domain (default "localhost")help

Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.