update steps to run hello-world with ACL in selfhosted mode

daprdocs/content/en/operations/configuration/invoke-allowlist.md

@@ -14,7 +14,7 @@ An access control policy is specified in configuration and be applied to Dapr si
 
 **TrustDomain** - A "trust domain" is a logical group to manage trust relationships. Every application is assigned a trust domain which can be specified in the access control list policy spec. If no policy spec is defined or an empty trust domain is specified, then a default value "public" is used. This trust domain is used to generate the identity of the application in the TLS cert.
 
-**App Identity** - Dapr generates a [SPIFFE](https://spiffe.io/) id for all applications which is attached in the TLS cert. The SPIFFE id is of the format: `**spiffe://\<trustdomain>/ns/\<namespace\>/\<appid\>**`. For matching policies, the trust domain, namespace and app ID values of the calling app are extracted from the SPIFFE id in the TLS cert of the calling app. These values are matched against the trust domain, namespace and app ID values specified in the policy spec. If all three of these match, then more specific policies are further matched.
+**App Identity** - Dapr requests the sentry service to generate a [SPIFFE](https://spiffe.io/) id for all applications and this id is attached in the TLS cert. The SPIFFE id is of the format: `**spiffe://\<trustdomain>/ns/\<namespace\>/\<appid\>**`. For matching policies, the trust domain, namespace and app ID values of the calling app are extracted from the SPIFFE id in the TLS cert of the calling app. These values are matched against the trust domain, namespace and app ID values specified in the policy spec. If all three of these match, then more specific policies are further matched.
 
 ## Configuration properties
 
@@ -189,10 +189,11 @@ spec:
       namespace: "ns2"
 ```
 
-## Hello world example
-This scenario shows how to apply access control to the [hello world](https://github.com/dapr/quickstarts/blob/master/hello-world/README.md) or [hello kubernetes](https://github.com/dapr/quickstarts/blob/master/hello-world/README.md) samples where a python app invokes a node.js app. You can create and apply these configuration files `nodeappconfig.yaml` and `pythonappconfig.yaml` as described in the [configuration]({{< ref "configuration-concept.md" >}}) article.
+## Hello world examples 
+These examples show how to apply access control to the [hello world](https://github.com/dapr/quickstarts#quickstarts) quickstart samples where a python app invokes a node.js app.
+Access control lists rely on the Dapr [Sentry service]({{< ref "security-concept.md" >}}) to generate the TLS certificates with a SPIFFE id for authentication, which means the Sentry service either has to be running locally or deployed to your hosting enviroment such as a Kubernetes cluster.
 
-The nodeappconfig example below shows how to deny access to the `neworder` method from the `pythonapp`, where the python app is in the `myDomain` trust domain and `default` namespace. The nodeapp is in the `public` trust domain.
+The nodeappconfig example below shows how to **deny** access to the `neworder` method from the `pythonapp`, where the python app is in the `myDomain` trust domain and `default` namespace. The nodeapp is in the `public` trust domain. 
 
 **nodeappconfig.yaml**
 
@@ -233,7 +234,97 @@ spec:
     trustDomain: "myDomain"
 ```     
 
-For example, this is how the pythonapp is deployed to Kubernetes in the default namespace with this configuration file.
+### Self-hosted mode
+This example uses the [hello world](https://github.com/dapr/quickstarts/tree/master/hello-world/README.md) quickstart.
+
+The following steps run the Sentry service locally with mTLS enabled, set up necessary environment variables to access certificates, and then launch both the node app and python app each referencing the Sentry service to apply the ACLs.
+
+ 1. Follow these steps to run the [Sentry service in self-hosted mode]({{< ref "mtls.md" >}}) with mTLS enabled
+
+ 2. In a command prompt, set these environment variables:
+
+    {{< tabs "Linux/MacOS" Windows >}}
+
+    {{% codetab %}}
+  ```bash
+  export DAPR_TRUST_ANCHORS=`cat $HOME/.dapr/certs/ca.crt`
+  export DAPR_CERT_CHAIN=`cat $HOME/.dapr/certs/issuer.crt`
+  export DAPR_CERT_KEY=`cat $HOME/.dapr/certs/issuer.key`
+  export NAMESPACE=default
+  ```
+
+    {{% /codetab %}}
+
+    {{% codetab %}}
+  ```powershell
+  set DAPR_TRUST_ANCHORS=``
+  set DAPR_CERT_CHAIN=``
+  set DAPR_CERT_KEY=``
+  set NAMESPACE=default
+  ```
+
+    {{% /codetab %}} 
+
+    {{< /tabs >}}
+
+3. Run daprd to launch a Dapr sidecar for the node.js app with mTLS enabled, referencing the local Sentry service:
+
+   ```bash
+   daprd --app-id nodeapp --dapr-grpc-port 50002 -dapr-http-port 3501 --log-level debug --app-port 3000 --enable-mtls --sentry-address localhost:50001 --config nodeappconfig.yaml
+   ```
+
+4. Run the node app in a separate command prompt:
+
+   ```bash
+   node app.js
+   ```
+
+5. In another command prompt, set these environment variables:
+
+   {{< tabs "Linux/MacOS" Windows >}}
+
+   {{% codetab %}}
+   ```bash
+   export DAPR_TRUST_ANCHORS=`cat $HOME/.dapr/certs/ca.crt`
+   export DAPR_CERT_CHAIN=`cat $HOME/.dapr/certs/issuer.crt`
+   export DAPR_CERT_KEY=`cat $HOME/.dapr/certs/issuer.key`
+   export NAMESPACE=default
+  ```
+   {{% /codetab %}}
+
+   {{% codetab %}}
+   ```powershell
+   set DAPR_TRUST_ANCHORS=``
+   set DAPR_CERT_CHAIN=``
+   set DAPR_CERT_KEY=``
+   set NAMESPACE=default
+   ```
+   {{% /codetab %}}
+
+   {{< /tabs >}}
+
+6. Run daprd to launch a Dapr sidecar for the python app with mTLS enabled, referencing the local Sentry service:
+
+   ```bash
+   daprd --app-id pythonapp   --dapr-grpc-port 50003 --metrics-port 9092 --log-level debug --enable-mtls --sentry-address localhost:50001 --config pythonappconfig.yaml
+   ```
+
+7. Run the python app in a separate command prompt:
+
+   ```bash
+   python app.py
+   ```
+
+8. You should see the calls to the node app fail in the python app command prompt based due to the **deny** operation action in the nodeappconfig file. Change this to action to **allow** and re-run the apps and you should then see this call succeed.
+
+### Kubernetes mode
+
+This example uses the [hello kubernetes](https://github.com/dapr/quickstarts/tree/master/hello-kubernetes/README.md) quickstart.
+
+You can create and apply the above configuration files `nodeappconfig.yaml` and `pythonappconfig.yaml` as described in the [configuration]({{< ref "configuration-concept.md" >}}) to the Kubernetes deployments.
+
+For example, below is how the pythonapp is deployed to Kubernetes in the default namespace with this pythonappconfig configuration file. 
+Do the same for the nodeapp deployment and then look at the logs for the pythonapp to see the calls fail due to the **deny** operation action set in the nodeappconfig file. Change this to action to **allow** and re-deploy the apps and you should then see this call succeed.
 
 ```yaml
 apiVersion: apps/v1