diff --git a/docs/content/reference/resources/radius.ai/2025-08-01-preview/models/index.md b/docs/content/reference/resources/radius.ai/2025-08-01-preview/models/index.md index 9e2f49d0b..630a8eb46 100644 --- a/docs/content/reference/resources/radius.ai/2025-08-01-preview/models/index.md +++ b/docs/content/reference/resources/radius.ai/2025-08-01-preview/models/index.md @@ -45,18 +45,21 @@ resource frontend 'Radius.Compute/containers@2025-08-01-preview' = { } ``` -The connection automatically injects environment variables into the -container for all properties from the model. The environment variables are +On compatible Kubernetes Container Recipes, the connection injects environment +variables into the container for the model properties. The variables are named `CONNECTION__`. In this example the connection name is `llm` so the environment variables will be: - CONNECTION_LLM_MODEL - CONNECTION_LLM_ENDPOINT +- CONNECTION_LLM_APIKEY (secret-backed) -The `apiKey` secret is NOT injected via the connection — it is materialized -into a managed `Radius.Security/secrets` resource. Bind it into a container -env var with a `secretKeyRef`, using `model.properties.secrets.name` as the -`secretName` and key `apiKey` (see the `secrets` property). +With Radius control-plane support from `radius-project/radius#12709` and +Kubernetes Container Recipe support from `resource-types-contrib#300` or +later, the same connection injects `apiKey` through a Kubernetes secret +reference. For custom, older, or mixed-version Kubernetes deployments, use +`model.properties.secrets.name` as the `secretName` and `apiKey` as the key +in an explicitly authored `secretKeyRef`. ## Top-Level Properties @@ -68,7 +71,7 @@ env var with a `secretKeyRef`, using `model.properties.secrets.name` as the | `endpoint` | string | (Read Only) The base URL used to call the model inference endpoint. Mapped from the recipe module's output. | | `environment` | string | (Required) The Radius Environment ID. Typically set by the rad CLI. Typically value should be `environment`. | | `model` | string | (Optional) The model deployment to provision. Defaults to `gpt-5-mini` if not provided. | -| `secrets` | [object](#secrets) | (Read-only) Recipe secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; the other sub-properties declare secret keys whose values are written only into that managed secret (never onto this resource). Consumers bind a key into a container env var via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. | +| `secrets` | [object](#secrets) | (Read-only) Recipe secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the Recipe's `result.secrets`; the other sub-properties declare secret keys whose values are written only into that managed secret (never onto this resource). Consumers bind a key into a container env var via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. | ## Object Properties diff --git a/docs/content/reference/resources/radius.ai/2025-08-01-preview/search/index.md b/docs/content/reference/resources/radius.ai/2025-08-01-preview/search/index.md index 9b98dfbdf..872b6123e 100644 --- a/docs/content/reference/resources/radius.ai/2025-08-01-preview/search/index.md +++ b/docs/content/reference/resources/radius.ai/2025-08-01-preview/search/index.md @@ -42,17 +42,20 @@ resource frontend 'Radius.Compute/containers@2025-08-01-preview' = { } ``` -The connection automatically injects environment variables into the -container for all properties from the search service. The environment -variables are named `CONNECTION__`. In this +On compatible Kubernetes Container Recipes, the connection injects environment +variables into the container for the search properties. The variables are +named `CONNECTION__`. In this example the connection name is `search` so the environment variables will be: - CONNECTION_SEARCH_ENDPOINT +- CONNECTION_SEARCH_APIKEY (secret-backed) -The `apiKey` secret is NOT injected via the connection — it is materialized -into a managed `Radius.Security/secrets` resource. Bind it into a container -env var with a `secretKeyRef`, using `search.properties.secrets.name` as the -`secretName` and key `apiKey` (see the `secrets` property). +With Radius control-plane support from `radius-project/radius#12709` and +Kubernetes Container Recipe support from `resource-types-contrib#300` or +later, the same connection injects `apiKey` through a Kubernetes secret +reference. For custom, older, or mixed-version Kubernetes deployments, use +`search.properties.secrets.name` as the `secretName` and `apiKey` as the key +in an explicitly authored `secretKeyRef`. ## Top-Level Properties @@ -63,7 +66,7 @@ env var with a `secretKeyRef`, using `search.properties.secrets.name` as the | `connections` | [object](#connections) | Map of connection name to connection data. | | `endpoint` | string | The endpoint used to connect to the search service. Mapped from the recipe module's output. | | `environment` | string | (Required) The Radius Environment ID. Typically set by the rad CLI. Typically value should be `environment`. | -| `secrets` | [object](#secrets) | (Read-only) Recipe secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; the other sub-properties declare secret keys whose values are written only into that managed secret (never onto this resource). Consumers bind a key into a container env var via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. | +| `secrets` | [object](#secrets) | (Read-only) Recipe secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the Recipe's `result.secrets`; the other sub-properties declare secret keys whose values are written only into that managed secret (never onto this resource). Consumers bind a key into a container env var via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. | ## Object Properties diff --git a/docs/content/reference/resources/radius.compute/2025-08-01-preview/containers/index.md b/docs/content/reference/resources/radius.compute/2025-08-01-preview/containers/index.md index 4131598b4..0e0baee50 100644 --- a/docs/content/reference/resources/radius.compute/2025-08-01-preview/containers/index.md +++ b/docs/content/reference/resources/radius.compute/2025-08-01-preview/containers/index.md @@ -95,6 +95,13 @@ resource myContainer 'Radius.Compute/containers@2025-08-01-preview' = { To mount a persistent volume or secret see the PersistentVolumes and Secrets Resource Types. +On Kubernetes, each connection injects ordinary producer properties and +Recipe-managed secret references using +`CONNECTION__`. Explicit environment variables +take precedence, followed by managed secret references, then ordinary values. +Set `disableDefaultEnvVars: true` to disable all generated variables for a +connection. This behavior applies to regular and init containers. + ## Top-Level Properties | Property | Type | Description | @@ -125,7 +132,7 @@ To mount a persistent volume or secret see the PersistentVolumes and Secrets Res | Property | Type | Description | |----------|------|-------------| -| `disableDefaultEnvVars` | boolean | (Optional) Disables the automatic injection of environment variables from connected resource properties. | +| `disableDefaultEnvVars` | boolean | (Optional) Disables automatic injection of ordinary properties and secret-backed environment variables from this connection. | | `source` | string | (Required) The resource ID of the resource this container is dependent upon. | ### `containers` {#containers} diff --git a/docs/content/reference/resources/radius.data/2025-08-01-preview/mongodatabases/index.md b/docs/content/reference/resources/radius.data/2025-08-01-preview/mongodatabases/index.md index c611ee0cc..a504232aa 100644 --- a/docs/content/reference/resources/radius.data/2025-08-01-preview/mongodatabases/index.md +++ b/docs/content/reference/resources/radius.data/2025-08-01-preview/mongodatabases/index.md @@ -44,18 +44,21 @@ resource frontend 'Radius.Compute/containers@2025-08-01-preview' = { } ``` -The connection automatically injects environment variables into the -container for all properties from the database. The environment variables +On compatible Kubernetes Container Recipes, the connection injects environment +variables into the container for the database properties. The variables are named `CONNECTION__`. In this example the connection name is `mongo` so the environment variables will be: - CONNECTION_MONGO_DATABASE - CONNECTION_MONGO_ENDPOINT +- CONNECTION_MONGO_CONNECTIONSTRING (secret-backed) -The `connectionString` secret is NOT injected via the connection — it is -materialized into a managed `Radius.Security/secrets` resource. Bind it into -a container env var with a `secretKeyRef`, using `mongo.properties.secrets.name` -as the `secretName` and key `connectionString` (see the `secrets` property). +With Radius control-plane support from `radius-project/radius#12709` and +Kubernetes Container Recipe support from `resource-types-contrib#300` or +later, the same connection injects `connectionString` through a Kubernetes +secret reference. For custom, older, or mixed-version Kubernetes deployments, +use `mongo.properties.secrets.name` as the `secretName` and `connectionString` +as the key in an explicitly authored `secretKeyRef`. Portability note: this schema is platform-neutral so the same resource type works with Azure AVM, AWS Terraform modules, and Kubernetes recipes. @@ -73,7 +76,7 @@ surface stay identical. | `database` | string | (Optional) The Mongo database name. Defaults to `mongo_db` if not provided. | | `endpoint` | string | The endpoint used to connect to the database. Mapped from the recipe module's output. | | `environment` | string | (Required) The Radius Environment ID. Typically set by the rad CLI. Typically value should be `environment`. | -| `secrets` | [object](#secrets) | (Read-only) Recipe secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; the other sub-properties declare secret keys whose values are written only into that managed secret (never onto this resource). Consumers bind a key into a container env var via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. | +| `secrets` | [object](#secrets) | (Read-only) Recipe secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the Recipe's `result.secrets`; the other sub-properties declare secret keys whose values are written only into that managed secret (never onto this resource). Consumers bind a key into a container env var via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. | ## Object Properties diff --git a/docs/content/reference/resources/radius.data/2025-08-01-preview/mysqldatabases/index.md b/docs/content/reference/resources/radius.data/2025-08-01-preview/mysqldatabases/index.md index 66f615b97..dd5a01e72 100644 --- a/docs/content/reference/resources/radius.data/2025-08-01-preview/mysqldatabases/index.md +++ b/docs/content/reference/resources/radius.data/2025-08-01-preview/mysqldatabases/index.md @@ -67,9 +67,9 @@ The connection automatically injects environment variables into the container fo | `connections` | [object](#connections) | Map of connection name to connection data. | | `database` | string | (Optional) The name of the database. Defaults to `mysql_db` if not provided. | | `environment` | string | (Required) The Radius Environment ID. Typically set by the rad CLI. Typically value should be `environment`. | -| `host` | string | The host name used to connect to the database. Mapped from the recipe module's output. | +| `host` | string | (Read Only) The host name used to connect to the database. Mapped from the recipe module's output. | | `password` | string | (Required) The administrator password for the MySQL database. Marked `x-radius-sensitive`: Radius encrypts it at rest, redacts it on reads, and exposes it decrypted only to the recipe as `{{context.resource.properties.password}}`. | -| `port` | integer | The port number used to connect to the database. Mapped from the recipe module's output (MySQL flexible server uses 3306). | +| `port` | integer | (Optional) The TCP port used to connect to the database. Defaults to `3306`, the standard MySQL port that every Recipe in this repository provisions and the port MySQL flexible server is fixed to. A Recipe that provisions the database on a different port reports the real port as an output, which overwrites this value once the deployment finishes. Setting it in an application definition changes only the value reported to connected containers, never the port the server listens on, so leave it unset. | | `username` | string | (Required) The administrator username for the MySQL database. Provided directly on the resource and passed to the recipe as `{{context.resource.properties.username}}`. | | `version` | string | (Optional) The major MySQL server version in the X.Y format. Defaults to `8.4` if not provided.
Allowed values: `5.7`, `8.0`, `8.4`. | diff --git a/docs/content/reference/resources/radius.data/2025-08-01-preview/postgresqldatabases/index.md b/docs/content/reference/resources/radius.data/2025-08-01-preview/postgresqldatabases/index.md index 86a66ad16..7e2c7bcba 100644 --- a/docs/content/reference/resources/radius.data/2025-08-01-preview/postgresqldatabases/index.md +++ b/docs/content/reference/resources/radius.data/2025-08-01-preview/postgresqldatabases/index.md @@ -67,10 +67,10 @@ The connection automatically injects environment variables into the container fo | `connections` | [object](#connections) | Map of connection name to connection data. | | `database` | string | (Optional) The name of the database. Defaults to `postgres_db` if not provided. | | `environment` | string | (Required) The Radius Environment ID. Typically set by the rad CLI. Typically value should be `environment`. | -| `host` | string | The host name used to connect to the database. | +| `host` | string | (Read Only) The host name used to connect to the database. Mapped from the recipe module's output. | | `initSql` | string | (Optional) SQL script mounted into the PostgreSQL container's `/docker-entrypoint-initdb.d/` directory and executed whenever PGDATA is empty. With the default ephemeral storage this runs on every pod restart. If a PersistentVolumeClaim is used, the script runs only on the very first startup and subsequent changes to initSql are ignored on existing volumes. Limited to ~1 MiB. Useful for creating tables, indexes, and inserting seed data. | | `password` | string | (Required) The administrator password for the PostgreSQL database. Marked `x-radius-sensitive`: Radius encrypts it at rest, redacts it on reads, and exposes it decrypted only to the recipe as `{{context.resource.properties.password}}`. | -| `port` | string | The port number used to connect to the database. | +| `port` | integer | (Optional) The TCP port used to connect to the database. Defaults to `5432`, the standard PostgreSQL port that every Recipe in this repository provisions and the port PostgreSQL flexible server is fixed to. A Recipe that provisions the database on a different port reports the real port as an output, which overwrites this value once the deployment finishes. Setting it in an application definition changes only the value reported to connected containers, never the port the server listens on, so leave it unset. | | `size` | string | (Optional) The size of the PostgreSQL database. Defaults to `S` if not provided.
Allowed values: `L`, `M`, `S`. | | `username` | string | (Required) The administrator username for the PostgreSQL database. Provided directly on the resource and passed to the recipe as `{{context.resource.properties.username}}`. | diff --git a/docs/content/reference/resources/radius.data/2025-08-01-preview/rediscaches/index.md b/docs/content/reference/resources/radius.data/2025-08-01-preview/rediscaches/index.md index 216e04bfb..394488dc5 100644 --- a/docs/content/reference/resources/radius.data/2025-08-01-preview/rediscaches/index.md +++ b/docs/content/reference/resources/radius.data/2025-08-01-preview/rediscaches/index.md @@ -10,8 +10,8 @@ linkTitle: "RedisCaches" The Radius.Data/redisCaches Resource Type deploys a Redis cache. To deploy a Redis cache, add a redisCaches resource to the application definition Bicep -file. Unlike database types, no secret is required: Azure Managed Redis -generates its own access keys, so the platform-engineer recipe needs no +file. Unlike database types, no credential has to be supplied: the cache +generates its own access key, so the platform-engineer recipe needs no injected credentials. ```bicep resource cache 'Radius.Data/redisCaches@2025-08-01-preview' = { @@ -46,18 +46,45 @@ resource frontend 'Radius.Compute/containers@2025-08-01-preview' = { } ``` -The connection automatically injects environment variables into the -container for all properties from the cache. The environment variables are +On compatible Kubernetes Container Recipes, the connection injects environment +variables into the container for the cache properties. The variables are named `CONNECTION__`. In this example the connection name is `redis` so the environment variables will be: - CONNECTION_REDIS_HOST - CONNECTION_REDIS_PORT -The `url` secret is NOT injected via the connection — it is materialized into -a managed `Radius.Security/secrets` resource. Bind it into a container env var -with a `secretKeyRef`, using `redis.properties.secrets.name` as the `secretName` -and key `url` (see the `secrets` property). +Recipe-generated secrets are materialized into a managed +`Radius.Security/secrets` resource. With Radius control-plane support from +`radius-project/radius#12709` and Kubernetes Container Recipe support from +`resource-types-contrib#300` or later, the same `redis` connection injects each +key returned in `result.secrets`: `CONNECTION_REDIS_URL`, and +`CONNECTION_REDIS_ACCESSKEY` when the Recipe returns `accessKey`. `host` and +`port` remain ordinary values. + +For custom, older, or mixed-version Kubernetes deployments, bind the key +explicitly with `secretKeyRef`, using `cache.properties.secrets.name` as the +`secretName`. Use `url` for a client that parses a connection URL, or +`accessKey` for a client that takes host, port, and password separately: + +```bicep +env: { + REDIS_ADDR: { + value: '${cache.properties.host}:${cache.properties.port}' + } + REDIS_PASSWORD: { + valueFrom: { + secretKeyRef: { + secretName: cache.properties.secrets.name + key: 'accessKey' + } + } + } +} +``` + +A recipe that provisions a cache requiring no credential does not map +`accessKey`; bind it only against a recipe that declares it. ## Top-Level Properties @@ -69,7 +96,7 @@ and key `url` (see the `secrets` property). | `environment` | string | (Required) The Radius Environment ID. Typically set by the rad CLI. Typically value should be `environment`. | | `host` | string | (Read Only) The host name used to connect to the cache. Mapped from the recipe module's output. | | `port` | integer | (Read Only) The TLS port number used to connect to the cache. Mapped from the recipe module's `port` output (Azure Managed Redis uses 10000). | -| `secrets` | [object](#secrets) | (Read-only) Recipe secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; the other sub-properties declare secret keys whose values are written only into that managed secret (never onto this resource). Consumers bind a key into a container env var via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. | +| `secrets` | [object](#secrets) | (Read-only) Recipe secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the Recipe's `result.secrets`; the other sub-properties declare secret keys whose values are written only into that managed secret (never onto this resource). Consumers bind a key into a container env var via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. | | `size` | string | (Optional) The size of the Redis cache. Defaults to `S` if not provided. The recipe maps the size onto a concrete cloud SKU.
Allowed values: `L`, `M`, `S`. | ## Object Properties @@ -85,5 +112,6 @@ and key `url` (see the `secrets` property). | Property | Type | Description | |----------|------|-------------| +| `accessKey` | string | (Read Only) The access key on its own, for clients that take host, port, and password separately instead of parsing a URL — it is the password such a client authenticates with. Mapped from the recipe module's `primaryAccessKey` output; delivered via the managed secret. Declared by recipes that provision an authenticated cache — a recipe provisioning a cache that needs no credential (such as the in-cluster Kubernetes recipe) does not map this key. | | `name` | string | (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`. | | `url` | string | (Read Only) The full TLS connection URL (`rediss://:@:`) used to connect to the cache, including the access key. Mapped from the recipe module's `primaryConnectionString` output; delivered via the managed secret. | diff --git a/docs/content/reference/resources/radius.data/2025-08-01-preview/sqlserverdatabases/index.md b/docs/content/reference/resources/radius.data/2025-08-01-preview/sqlserverdatabases/index.md index 43246dffb..c4c897a40 100644 --- a/docs/content/reference/resources/radius.data/2025-08-01-preview/sqlserverdatabases/index.md +++ b/docs/content/reference/resources/radius.data/2025-08-01-preview/sqlserverdatabases/index.md @@ -72,9 +72,9 @@ Kubernetes would map a Service DNS name. | `connections` | [object](#connections) | Map of connection name to connection data. | | `database` | string | (Required) The SQL database name to create on the server. Defaults to `appdb` in the sample application. | | `environment` | string | (Required) The Radius Environment ID. Typically set by the rad CLI. Typically value should be `environment`. | -| `host` | string | The SQL Server fully qualified domain name. Mapped from the recipe module's `fullyQualifiedDomainName` output. | +| `host` | string | (Read Only) The SQL Server fully qualified domain name. Mapped from the recipe module's `fullyQualifiedDomainName` output. | | `password` | string | (Required) The administrator password for the SQL database. Marked `x-radius-sensitive`: Radius encrypts it at rest, redacts it on reads, and exposes it decrypted only to the recipe as `{{context.resource.properties.password}}`. | -| `port` | string | The SQL Server TCP port. Azure SQL Database listens on 1433. | +| `port` | integer | (Optional) The TCP port used to connect to the database. Defaults to `1433`, the standard SQL Server port that every Recipe in this repository provisions and the port Azure SQL Database is fixed to. A Recipe that provisions the database on a different port reports the real port as an output, which overwrites this value once the deployment finishes. Setting it in an application definition changes only the value reported to connected containers, never the port the server listens on, so leave it unset. | | `username` | string | (Required) The administrator username for the SQL database. Provided directly on the resource and passed to the recipe as `{{context.resource.properties.username}}`. | ## Object Properties diff --git a/docs/content/reference/resources/radius.messaging/2025-08-01-preview/kafka/index.md b/docs/content/reference/resources/radius.messaging/2025-08-01-preview/kafka/index.md index 869e0b491..fc90257f2 100644 --- a/docs/content/reference/resources/radius.messaging/2025-08-01-preview/kafka/index.md +++ b/docs/content/reference/resources/radius.messaging/2025-08-01-preview/kafka/index.md @@ -43,17 +43,20 @@ resource frontend 'Radius.Compute/containers@2025-08-01-preview' = { } ``` -The connection automatically injects environment variables into the -container for all properties from the cluster. The environment variables are +On compatible Kubernetes Container Recipes, the connection injects environment +variables into the container for the Kafka properties. The variables are named `CONNECTION__`. In this example the connection name is `kafka` so the environment variables will be: - CONNECTION_KAFKA_HOST +- CONNECTION_KAFKA_CONNECTIONSTRING (secret-backed) -The `connectionString` secret is NOT injected via the connection — it is -materialized into a managed `Radius.Security/secrets` resource. Bind it into -a container env var with a `secretKeyRef`, using `kafka.properties.secrets.name` -as the `secretName` and key `connectionString` (see the `secrets` property). +With Radius control-plane support from `radius-project/radius#12709` and +Kubernetes Container Recipe support from `resource-types-contrib#300` or +later, the same connection injects `connectionString` through a Kubernetes +secret reference. For custom, older, or mixed-version Kubernetes deployments, +use `kafka.properties.secrets.name` as the `secretName` and `connectionString` +as the key in an explicitly authored `secretKeyRef`. Portability note: the schema is platform-neutral so the same type works with Azure AVM (Bicep), AWS Terraform registry modules, and Kubernetes @@ -73,7 +76,7 @@ the broker bootstrap Service DNS. | `connections` | [object](#connections) | Map of connection name to connection data. | | `environment` | string | (Required) The Radius Environment ID. Typically set by the rad CLI. Typically value should be `environment`. | | `host` | string | The host name used to connect to the Kafka-compatible endpoint. For Azure Event Hubs this is the namespace name; the bootstrap server is `.servicebus.windows.net:9093`. | -| `secrets` | [object](#secrets) | (Read-only) Recipe secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; the other sub-properties declare secret keys whose values are written only into that managed secret (never onto this resource). Consumers bind a key into a container env var via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. | +| `secrets` | [object](#secrets) | (Read-only) Recipe secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the Recipe's `result.secrets`; the other sub-properties declare secret keys whose values are written only into that managed secret (never onto this resource). Consumers bind a key into a container env var via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. | | `topic` | string | (Optional) The Kafka topic/Event Hub name to create. Defaults to `events`. | ## Object Properties diff --git a/docs/content/reference/resources/radius.messaging/2025-08-01-preview/rabbitmq/index.md b/docs/content/reference/resources/radius.messaging/2025-08-01-preview/rabbitmq/index.md index b29038ab2..8f5c9ba77 100644 --- a/docs/content/reference/resources/radius.messaging/2025-08-01-preview/rabbitmq/index.md +++ b/docs/content/reference/resources/radius.messaging/2025-08-01-preview/rabbitmq/index.md @@ -47,18 +47,24 @@ resource queue 'Radius.Messaging/rabbitMQ@2025-08-01-preview' = { ``` To connect your workload to the queue, create a connection from the workload -resource to the queue resource. The connection automatically injects -environment variables named `CONNECTION__`. -For a connection named `rabbitmq`, the variables are: +resource to the queue resource. On compatible Kubernetes Container Recipes, +the connection injects environment variables named +`CONNECTION__`. For a connection named +`rabbitmq`, the variables are: - CONNECTION_RABBITMQ_HOST - CONNECTION_RABBITMQ_PORT - CONNECTION_RABBITMQ_USERNAME +- CONNECTION_RABBITMQ_PASSWORD (secret-backed, when `password` is omitted) -When `password` is supplied, bind the same `Radius.Security/secrets` resource -into the workload. When it is omitted, bind the Recipe-generated managed -secret using `queue.properties.secrets.name` as the `secretName`. In both cases, -use key `password`. +With Radius control-plane support from `radius-project/radius#12709` and +Kubernetes Container Recipe support from `resource-types-contrib#300` or +later, omitting `password` lets the same connection inject the Recipe-generated +password. `queue.properties.secrets.name` remains available for explicitly +authored custom or backward-compatible `secretKeyRef` wiring. When `password` +supplies a user-authored `Radius.Security/secrets` resource, the Recipe emits +no managed secret and the queue connection has no password variable. Connect +the workload directly to the supplied Secret to inject its keys. ## Top-Level Properties @@ -72,7 +78,7 @@ use key `password`. | `password` | string | (Optional) The resource ID of the `Radius.Security/secrets` resource that holds the broker password under the data key `password`. Set to `.id`. If omitted, the Kubernetes Recipe generates a random password and returns it through the managed `secrets.password` output. | | `port` | integer | (Read Only) The port used to connect to the broker over AMQP 0-9-1 (5672). Mapped from the recipe's output. | | `queue` | string | (Optional) The name of the queue to pre-provision on the broker. The Recipe creates this durable queue on the default virtual host when the broker starts, so it exists before your workload connects. Defaults to `jobs` if not provided. | -| `secrets` | [object](#secrets) | (Read Only) Recipe-generated secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the Recipe's `outputs.secrets`. Consumers bind a key into a container env var via `secretKeyRef`. | +| `secrets` | [object](#secrets) | (Read Only) Recipe-generated secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the Recipe's `result.secrets`. Consumers bind a key into a container env var via `secretKeyRef`. | | `username` | string | (Optional) The username the broker is provisioned with and that clients authenticate as. Defaults to `radius` if not provided. Avoid `guest`, which RabbitMQ restricts to loopback connections. The username is not sensitive and is exposed as a read-only connection value. | ## Object Properties diff --git a/docs/content/reference/resources/radius.security/2025-08-01-preview/secrets/index.md b/docs/content/reference/resources/radius.security/2025-08-01-preview/secrets/index.md index 02f5077e4..2fb5bc057 100644 --- a/docs/content/reference/resources/radius.security/2025-08-01-preview/secrets/index.md +++ b/docs/content/reference/resources/radius.security/2025-08-01-preview/secrets/index.md @@ -45,6 +45,13 @@ The Radius.Security/secrets Resource Type stores sensitive data such as tokens, } } ``` + +On Kubernetes, connect a Container directly to the Secret to inject each data +key through a Kubernetes secret reference. A connection named `credentials` +creates variables such as `CONNECTION_CREDENTIALS_USERNAME` and +`CONNECTION_CREDENTIALS_PASSWORD` in regular and init containers. Set +`disableDefaultEnvVars: true` to disable automatic injection; explicitly +declared container environment variables take precedence. When deploying the application, specify the secret value as a command-line parameter. It is recommended to use a password generator such as `openssl` or equivalent. For example, `rad deploy app.bicep -p password=$(openssl rand -hex 16)`. For details on how to use the secret with another resource such as a container or database, see the documentation for those resource types. diff --git a/docs/content/reference/resources/radius.storage/2025-08-01-preview/objectstorage/index.md b/docs/content/reference/resources/radius.storage/2025-08-01-preview/objectstorage/index.md index 159a1bf1c..1aaf4f98d 100644 --- a/docs/content/reference/resources/radius.storage/2025-08-01-preview/objectstorage/index.md +++ b/docs/content/reference/resources/radius.storage/2025-08-01-preview/objectstorage/index.md @@ -47,20 +47,23 @@ resource frontend 'Radius.Compute/containers@2025-08-01-preview' = { } ``` -The connection automatically injects environment variables into the -container for all properties from the store. The environment variables are +On compatible Kubernetes Container Recipes, the connection injects environment +variables into the container for the storage properties. The variables are named `CONNECTION__`. In this example the connection name is `storage` so the environment variables will be: - CONNECTION_STORAGE_CONTAINERNAME - CONNECTION_STORAGE_ENDPOINT - CONNECTION_STORAGE_ACCOUNTNAME +- CONNECTION_STORAGE_CONNECTIONSTRING (secret-backed) +- CONNECTION_STORAGE_ACCOUNTKEY (secret-backed) -The `connectionString` and `accountKey` secrets are NOT injected via the -connection — they are materialized into a managed `Radius.Security/secrets` -resource. Bind them into container env vars with a `secretKeyRef`, using -`store.properties.secrets.name` as the `secretName` and the desired key -(`connectionString` or `accountKey`; see the `secrets` property). +With Radius control-plane support from `radius-project/radius#12709` and +Kubernetes Container Recipe support from `resource-types-contrib#300` or +later, the same connection injects `connectionString` and `accountKey` through +Kubernetes secret references. For custom, older, or mixed-version Kubernetes +deployments, use `store.properties.secrets.name` as the `secretName` and the +desired key in an explicitly authored `secretKeyRef`. The schema is platform-neutral: the same developer-facing properties can be backed by Azure Blob Storage, AWS S3, or a Kubernetes object-store recipe by @@ -77,7 +80,7 @@ changing only the platform recipe's module source, parameters, and outputs. | `containerName` | string | (Optional) The object container (blob container / S3 bucket) name to create inside the storage account. Defaults to `data` if not provided. | | `endpoint` | string | The object storage endpoint used to connect to the store. Mapped from the recipe module's `primaryBlobEndpoint` output. | | `environment` | string | (Required) The Radius Environment ID. Typically set by the rad CLI. Typically value should be `environment`. | -| `secrets` | [object](#secrets) | (Read-only) Recipe secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; the other sub-properties declare secret keys whose values are written only into that managed secret (never onto this resource). Consumers bind a key into a container env var via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. | +| `secrets` | [object](#secrets) | (Read-only) Recipe secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the Recipe's `result.secrets`; the other sub-properties declare secret keys whose values are written only into that managed secret (never onto this resource). Consumers bind a key into a container env var via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. | ## Object Properties