Update referencing secrets document

daprdocs/content/en/operations/components/component-secrets.md

@@ -1,6 +1,6 @@
 ---
 type: docs
-title: "How-To: Reference secret stores in components"
+title: "How-To: Reference secrets in components"
 linkTitle: "How-To: Reference secrets"
 weight: 200
 description: "How to securly reference secrets from a component definition"
@@ -18,40 +18,9 @@ When running in Kubernetes, if the `auth.secretStore` is empty, the Kubernetes s
 
 Go to [this]({{< ref "howto-secrets.md" >}}) link to see all the secret stores supported by Dapr, along with information on how to configure and use them.
 
-## Non default namespaces
-
-If your Dapr enabled apps are using components that fetch secrets from non-default namespaces, apply the following resources to the namespace:
-
-```yaml
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: secret-reader
-  namespace: <NAMESPACE>
-rules:
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["get"]
----
-
-kind: RoleBinding
-apiVersion: rbac.authorization.k8s.io/v1
-metadata:
-  name: dapr-secret-reader
-  namespace: <NAMESPACE>
-subjects:
-- kind: ServiceAccount
-  name: default
-roleRef:
-  kind: Role
-  name: secret-reader
-  apiGroup: rbac.authorization.k8s.io
-```
-
 ## Examples
 
-Using plain text:
+Using plain text secrets (not recommended for production):
 
 ```yml
 apiVersion: dapr.io/v1alpha1
@@ -69,7 +38,7 @@ spec:
     value: MyPassword
 ```
 
-Using a Kubernetes secret:
+Referencing secret from a secret store:
 
 ```yml
 apiVersion: dapr.io/v1alpha1
@@ -88,12 +57,14 @@ spec:
     	name: redis-secret
         key:  redis-password
 auth:
-  secretStore: kubernetes
+  secretStore: <SECRET_STORE_NAME>
 ```
 
-The above example tells Dapr to use the `kubernetes` secret store, extract a secret named `redis-secret` and assign the value of the `redis-password` key in the secret to the `redisPassword` field in the Component.
+When running in Kubernetes and using a Kubernetes secret store, either the field `auth.SecretStore` can be empty (as it is assumed to be Kubernetes secret store) or it needs to be `kubernetes`. For all other secret store, the `SECRET_STORE_NAME` is the name of the configured secret store component.
 
-### Creating a secret and referencing it in a Component
+The above example tells Dapr to extract a secret named `redis-secret` from the defined secret store and assign the value of the `redis-password` key in the secret to the `redisPassword` field in the Component.
+
+### Creating a Kubernetes secret and referencing it in a Component
 
 The following example shows you how to create a Kubernetes secret to hold the connection string for an Event Hubs binding.
 
@@ -126,5 +97,45 @@ Finally, apply the component to the Kubernetes cluster:
 ```bash
 kubectl apply -f ./eventhubs.yaml
 ```
+## Kubernetes
 
-All done!
+### Default namespace 
+
+When running in Kubernetes, Dapr, during installtion, defines default Role and RoleBinding for secrets access from Kubernetes secret store in the `default` namespace. For Dapr enabled apps that fetch secrets from `default` namespace, a secret can be defined and referenced in components as shown in the example above.
+
+### Non default namespaces
+
+If your Dapr enabled apps are using components that fetch secrets from non-default namespaces, apply the following resources to that namespace:
+
+```yaml
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: secret-reader
+  namespace: <NAMESPACE>
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get"]
+---
+
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: dapr-secret-reader
+  namespace: <NAMESPACE>
+subjects:
+- kind: ServiceAccount
+  name: default
+roleRef:
+  kind: Role
+  name: secret-reader
+  apiGroup: rbac.authorization.k8s.io
+```
+
+These resources grant Dapr permissions to get secrets from the Kubernetes secret store for the namespace defined in the Role and RoleBinding.
+
+{{% alert title="Note" color="warning" %}}
+In production scenario to limit Dapr's access to certain secret resources alone, you can use the `resourceNames` field. See this [link](https://kubernetes.io/docs/reference/access-authn-authz/rbac/#referring-to-resources) for further explanation.
+{{% /alert %}}