Dapr 1.16.15

This update contains a bug fix:

• Sentry fails to start with "unsupported key type" when the issuer key is Ed25519 or RSA

Sentry fails to start with "unsupported key type" when the issuer key is Ed25519 or RSA

Problem

Operators who downgraded a control plane from 1.18 back to 1.16 saw dapr-sentry crash on startup with:

fatal: error creating CA: failed to get CA bundle: failed to verify CA bundle: unsupported key type ed25519.PrivateKey

The same failure mode also rejected RSA-keyed issuer bundles. The crash is hit before sentry serves any traffic, so every sidecar that depends on sentry for its identity certificate stops being able to obtain or rotate one.

Impact

Any 1.16 control plane whose dapr-trust-bundle secret was generated by, or migrated through, a newer Dapr release that issues Ed25519 (or RSA) issuer keys is affected. In practice this includes:

• Downgrade from Dapr 1.18 to 1.16 against the same cluster.
• Existing 1.16 deployments where the issuer key was rotated or replaced with an Ed25519 / RSA key by the operator.

Sentry crash-loops, no new mTLS identities are issued, and existing certificates are not rotated. Sidecars whose certs have not yet expired keep working; sidecars that come up fresh, restart, or hit cert expiry start failing to obtain identities.

Root Cause

dapr/kit's crypto/pem.EncodePrivateKey (used by sentry to re-encode the issuer key it just decoded from the trust bundle) only matched *ecdsa.PrivateKey and *ed25519.PrivateKey in its type switch. ed25519.PrivateKey is itself a []byte alias rather than a struct, so the *ed25519.PrivateKey case never matched a real Ed25519 key. RSA private keys were never listed at all.

When sentry called EncodePrivateKey on an Ed25519 or RSA issuer key it fell through to the default branch and returned unsupported key type %T, which the CA initialiser surfaced as a fatal error.

Solution

dapr/kit's EncodePrivateKey now matches ed25519.PrivateKey (value form) and *rsa.PrivateKey alongside *ecdsa.PrivateKey. All three round-trip through PKCS#8 unchanged. Dapr 1.16.15 picks up this fix by bumping github.com/dapr/kit to v0.16.3, which also includes table-driven roundtrip tests for ECDSA P-256, RSA-2048, and Ed25519 to guard the regression.