apiVersion: dapr.io/v1alpha1
kind: Component
auth: 
 secretstore: <REPLACE-WITH-SECRET-STORE-NAME>
metadata:
  name: <REPLACE-WITH-COMPONENT-NAME>
  namespace: <REPLACE-WITH-COMPONENT-NAMESPACE>
spec:
  type: <REPLACE-WITH-COMPONENT-TYPE>
  version: v1
  initTimeout: <REPLACE-WITH-TIMEOUT-DURATION>
  ignoreErrors: <REPLACE-WITH-BOOLEAN>
  metadata:
  - name: <REPLACE-WITH-METADATA-NAME>
    value: <REPLACE-WITH-METADATA-VALUE>
scopes:
  - <REPLACE-WITH-APPID>
  - <REPLACE-WITH-APPID>

apiVersion: dapr.io/v1alpha1
kind: Component
metadata:
  name: messagebus
spec:
  type: pubsub.mqtt3
  version: v1
  metadata:
    - name: consumerID
      value: "{uuid}"
    - name: url
      value: "tcp://admin:public@localhost:1883"
    - name: qos
      value: 1
    - name: retain
      value: "false"
    - name: cleanSession
      value: "false"

apiVersion: dapr.io/v2alpha1
kind: Subscription
metadata:
  name: <REPLACE-WITH-NAME>
spec:
  topic: <REPLACE-WITH-TOPIC-NAME> # Required
  routes: # Required
    rules:
      - match: <REPLACE-WITH-CEL-FILTER>
        path: <REPLACE-WITH-PATH>
  pubsubname: <REPLACE-WITH-PUBSUB-NAME> # Required
  deadLetterTopic: <REPLACE-WITH-DEADLETTERTOPIC-NAME> # Optional
  bulkSubscribe: # Optional
    enabled: <REPLACE-WITH-BOOLEAN-VALUE>
    maxMessagesCount: <REPLACE-WITH-VALUE>
    maxAwaitDurationMs: <REPLACE-WITH-VALUE>
  metadata: <REPLACE-WITH-METADATA-OBJECT> # Optional
scopes:
- <REPLACE-WITH-SCOPED-APPIDS>

apiVersion: dapr.io/v1alpha1
kind: Subscription
metadata:
  name: <REPLACE-WITH-RESOURCE-NAME>
spec:
  topic: <REPLACE-WITH-TOPIC-NAME> # Required
  route: <REPLACE-WITH-ROUTE-NAME> # Required
  pubsubname: <REPLACE-WITH-PUBSUB-NAME> # Required
  deadLetterTopic: <REPLACE-WITH-DEAD-LETTER-TOPIC-NAME> # Optional
  metadata: <REPLACE-WITH-METADATA-OBJECT> # Optional
  bulkSubscribe: # Optional
  - enabled: <REPLACE-WITH-BOOLEAN-VALUE>
  - maxMessagesCount: <REPLACE-WITH-VALUE>
  - maxAwaitDurationMs: <REPLACE-WITH-VALUE>
scopes:
- <REPLACE-WITH-SCOPED-APPIDS>

apiVersion: dapr.io/v1alpha1
kind: Resiliency
metadata:
  name: <REPLACE-WITH-RESOURCE-NAME>
version: v1alpha1
scopes:
  - <REPLACE-WITH-SCOPED-APPIDS>
spec:
  policies: # Required
    timeouts:
      timeoutName: <REPLACE-WITH-TIME-VALUE> # Replace with any unique name
    retries:
      retryName: # Replace with any unique name
        policy: <REPLACE-WITH-VALUE>
        duration: <REPLACE-WITH-VALUE>
        maxInterval: <REPLACE-WITH-VALUE>
        maxRetries: <REPLACE-WITH-VALUE>
        matching:
          httpStatusCodes: <REPLACE-WITH-VALUE>
          gRPCStatusCodes: <REPLACE-WITH-VALUE>
    circuitBreakers:
      circuitBreakerName: # Replace with any unique name
        maxRequests: <REPLACE-WITH-VALUE>
        timeout: <REPLACE-WITH-VALUE> 
        trip: <REPLACE-WITH-CONSECUTIVE-FAILURE-VALUE>
targets: # Required
    apps:
      appID: # Replace with scoped app ID
        timeout: <REPLACE-WITH-TIMEOUT-NAME>
        retry: <REPLACE-WITH-RETRY-NAME>
        circuitBreaker: <REPLACE-WITH-CIRCUIT-BREAKER-NAME>
    actors:
      myActorType: 
        timeout: <REPLACE-WITH-TIMEOUT-NAME>
        retry: <REPLACE-WITH-RETRY-NAME>
        circuitBreaker: <REPLACE-WITH-CIRCUIT-BREAKER-NAME>
        circuitBreakerCacheSize: <REPLACE-WITH-VALUE>
    components:
      componentName: # Replace with your component name
        outbound:
          timeout: <REPLACE-WITH-TIMEOUT-NAME>
          retry: <REPLACE-WITH-RETRY-NAME>
          circuitBreaker: <REPLACE-WITH-CIRCUIT-BREAKER-NAME>

apiVersion: dapr.io/v1alpha1
kind: MCPServer
metadata:
  name: <NAME>
spec:
  ignoreErrors: <REPLACE-WITH-BOOL> # Optional. When true, daprd keeps running if this MCPServer fails to load.
  endpoint:
    streamableHTTP:
      url: <REPLACE-WITH-URL> # Required. The endpoint URL of the MCP server.
      protocolVersion: <REPLACE-WITH-VERSION> # Optional. MCP spec version (e.g. "2025-06-18").
      timeout: <REPLACE-WITH-TIMEOUT> # Optional. Per-call deadline (e.g. "30s").
      headers: # Optional
        - name: <REPLACE-WITH-HEADER-NAME>
          value: <REPLACE-WITH-HEADER-VALUE>
        - name: <REPLACE-WITH-HEADER-NAME>
          secretKeyRef:
            name: <REPLACE-WITH-SECRET-NAME>
            key: <REPLACE-WITH-SECRET-KEY>
      auth: # Optional
        secretStore: <REPLACE-WITH-SECRETSTORE>
        oauth2:
          issuer: <REPLACE-WITH-TOKEN-ENDPOINT>
          clientID: <REPLACE-WITH-CLIENT-ID> # Optional. OAuth2 client identifier.
          audience: <REPLACE-WITH-AUDIENCE>
          scopes:
            - <REPLACE-WITH-SCOPE>
          secretKeyRef:
            name: <REPLACE-WITH-SECRET-NAME>
            key: <REPLACE-WITH-SECRET-KEY>
        spiffe:
          jwt:
            header: <REPLACE-WITH-HEADER-NAME>
            headerValuePrefix: <REPLACE-WITH-PREFIX>
            audience: <REPLACE-WITH-AUDIENCE>
  middleware: # Optional
    beforeCallTool:
      - workflow:
          workflowName: <REPLACE-WITH-WORKFLOW-NAME>
          appID: <REPLACE-WITH-APP-ID> # Optional. Remote app.
        mutate: <REPLACE-WITH-BOOL> # Optional. When true, hook return value replaces the arguments.
    afterCallTool:
      - workflow:
          workflowName: <REPLACE-WITH-WORKFLOW-NAME>
        mutate: <REPLACE-WITH-BOOL> # Optional. When true, hook return value replaces the result.
    beforeListTools:
      - workflow:
          workflowName: <REPLACE-WITH-WORKFLOW-NAME>
    afterListTools:
      - workflow:
          workflowName: <REPLACE-WITH-WORKFLOW-NAME>
        mutate: <REPLACE-WITH-BOOL> # Optional. When true, hook return value replaces the result.
  catalog: # Optional. Informational only.
    displayName: <REPLACE-WITH-DISPLAY-NAME>
    description: <REPLACE-WITH-DESCRIPTION>
    owner:
      team: <REPLACE-WITH-TEAM>
      contact: <REPLACE-WITH-CONTACT>
    tags:
      - <REPLACE-WITH-TAG>
    links:
      docs: <REPLACE-WITH-URL>
scopes: # Optional
  - <REPLACE-WITH-SCOPED-APPIDS>

apiVersion: dapr.io/v1alpha1
kind: MCPServer
metadata:
  name: <NAME>
spec:
  endpoint:
    sse:
      url: <REPLACE-WITH-URL>
      protocolVersion: <REPLACE-WITH-VERSION> # Optional
      timeout: <REPLACE-WITH-TIMEOUT> # Optional
      headers: # Optional. Same format as streamableHTTP.
        - name: <REPLACE-WITH-HEADER-NAME>
          value: <REPLACE-WITH-HEADER-VALUE>
      auth: # Optional. Same format as streamableHTTP.
        secretStore: <REPLACE-WITH-SECRETSTORE>

apiVersion: dapr.io/v1alpha1
kind: MCPServer
metadata:
  name: <NAME>
spec:
  endpoint:
    stdio:
      command: <REPLACE-WITH-COMMAND> # Required.
      args: # Optional
        - <REPLACE-WITH-ARG>
      env: # Optional
        - name: <REPLACE-WITH-ENV-NAME>
          value: <REPLACE-WITH-ENV-VALUE>
        - name: <REPLACE-WITH-ENV-NAME>
          secretKeyRef:
            name: <REPLACE-WITH-SECRET-NAME>
            key: <REPLACE-WITH-SECRET-KEY>

apiVersion: dapr.io/v1alpha1
kind: HTTPEndpoint
metadata:
  name: <NAME>  
spec:
  baseUrl: <REPLACE-WITH-BASEURL> # Required. Use "http://" or "https://" prefix.
  headers: # Optional
  - name: <REPLACE-WITH-A-HEADER-NAME>
    value: <REPLACE-WITH-A-HEADER-VALUE>
  - name: <REPLACE-WITH-A-HEADER-NAME>
    secretKeyRef:
      name: <REPLACE-WITH-SECRET-NAME>
      key: <REPLACE-WITH-SECRET-KEY>
  clientTLS:
    rootCA:
      secretKeyRef:
        name: <REPLACE-WITH-SECRET-NAME>
        key: <REPLACE-WITH-SECRET-KEY>
    certificate:
      secretKeyRef:
        name: <REPLACE-WITH-SECRET-NAME>
        key: <REPLACE-WITH-SECRET-KEY>
    privateKey:
      secretKeyRef:
        name: <REPLACE-WITH-SECRET-NAME>
        key: <REPLACE-WITH-SECRET-KEY>
scopes: # Optional
  - <REPLACE-WITH-SCOPED-APPIDS>
auth: # Optional
  secretStore: <REPLACE-WITH-SECRETSTORE>

apiVersion: dapr.io/v1alpha1
kind: Configuration
metadata:
  name: <REPLACE-WITH-NAME>
  namespace: <REPLACE-WITH-NAMESPACE>
spec:
  api:
    allowed:
      - name: <REPLACE-WITH-API>
        version: <VERSION>
        protocol: <HTTP-OR-GRPC>
  tracing:
    samplingRate: <REPLACE-WITH-INTEGER>
    stdout: true
    otel:
      endpointAddress: <REPLACE-WITH-ENDPOINT-ADDRESS>
      isSecure: <TRUE-OR-FALSE>
      protocol: <HTTP-OR-GRPC>
      headers:
        - name: <HEADER-NAME>
          value: <HEADER-VALUE>
        - name: <HEADER-NAME>
          secretKeyRef:
            name: <SECRET-STORE-NAME>
            key: <SECRET-KEY>
      timeout: <DURATION>
  metrics:
    enabled: <TRUE-OR-FALSE>
    rules:
      - name: <METRIC-NAME>
        labels:
          - name: <LABEL-NAME>
            regex: {}
    recordErrorCodes: <TRUE-OR-FALSE>
    latencyDistributionBuckets:
      - <BUCKET-VALUE-MS-0>
      - <BUCKET-VALUE-MS-1>
    http:
      increasedCardinality: <TRUE-OR-FALSE>
      pathMatching: 
        - <PATH-A>
        - <PATH-B>
      excludeVerbs: <TRUE-OR-FALSE>
  httpPipeline: # for incoming http calls
    handlers:
      - name: <HANDLER-NAME>
        type: <HANDLER-TYPE>
  appHttpPipeline: # for outgoing http calls
    handlers:
      - name: <HANDLER-NAME>
        type: <HANDLER-TYPE>
  nameResolution:
    component: <NAME-OF-NAME-RESOLUTION-COMPONENT>
    version: <NAME-RESOLUTION-COMPONENT-VERSION>
    configuration:
     <NAME-RESOLUTION-COMPONENT-METADATA-CONFIGURATION>
  secrets:
    scopes:
      - storeName: <NAME-OF-SCOPED-STORE>
        defaultAccess: <ALLOW-OR-DENY>
        deniedSecrets: <REPLACE-WITH-DENIED-SECRET>
  components:
    deny:
      - <COMPONENT-TO-DENY>
  features:
    - name: <FEATURE-NAME>
      enabled: <TRUE-OR-FALSE>
  accessControl:
    defaultAction: <ALLOW-OR-DENY>
    trustDomain: <REPLACE-WITH-TRUST-DOMAIN>
    policies:
      - appId: <APP-NAME>
        defaultAction: <ALLOW-OR-DENY>
        trustDomain: <REPLACE-WITH-TRUST-DOMAIN>
        namespace: "default"
        operations:
          - name: <OPERATION-NAME>
            httpVerb: ['POST', 'GET']
            action: <ALLOW-OR-DENY>

apiVersion: dapr.io/v1alpha1
kind: Configuration
metadata:
  name: daprsystem
  namespace: default
spec:
  mtls:
    enabled: true
    allowedClockSkew: 15m
    workloadCertTTL: 24h

apiVersion: dapr.io/v1alpha1
kind: WorkflowAccessPolicy
metadata:
  name: <REPLACE-WITH-NAME>
  namespace: <NAMESPACE>
scopes:
  - <TARGET-APP-ID>
spec:
  rules:
    - callers:
        - appID: <CALLER-APP-ID>
      workflows:
        - name: <WORKFLOW-NAME-OR-GLOB-PATTERN>
          operations: [schedule]
      activities:
        - name: <ACTIVITY-NAME-OR-GLOB-PATTERN>

apiVersion: dapr.io/v1alpha1
kind: WorkflowAccessPolicy
metadata:
  name: order-processing-policy
  namespace: production
scopes:
  - order-service
spec:
  rules:
    - callers:
        - appID: frontend-app
        - appID: api-gateway
      workflows:
        - name: OrderWF
          operations: [schedule]
        - name: CheckoutWF
          operations: [schedule]
      activities:
        - name: ProcessPayment
    - callers:
        - appID: admin-app
      workflows:
        - name: "*"
          operations: [schedule]
      activities:
        - name: "*"