radius-project · radius-docs · Sep 3, 2026
@@ -45,18 +45,21 @@ resource frontend 'Radius.Compute/containers@2025-08-01-preview' = {
 }
 ```
 
-The connection automatically injects environment variables into the
-container for all properties from the model. The environment variables are
+On compatible Kubernetes Container Recipes, the connection injects environment
+variables into the container for the model properties. The variables are
 named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>`. In this example the
 connection name is `llm` so the environment variables will be:
 
 - CONNECTION_LLM_MODEL
 - CONNECTION_LLM_ENDPOINT
+- CONNECTION_LLM_APIKEY (secret-backed)
 
-The `apiKey` secret is NOT injected via the connection — it is materialized
-into a managed `Radius.Security/secrets` resource. Bind it into a container
-env var with a `secretKeyRef`, using `model.properties.secrets.name` as the
-`secretName` and key `apiKey` (see the `secrets` property).
+With Radius control-plane support from `radius-project/radius#12709` and
+Kubernetes Container Recipe support from `resource-types-contrib#300` or
+later, the same connection injects `apiKey` through a Kubernetes secret
+reference. For custom, older, or mixed-version Kubernetes deployments, use
+`model.properties.secrets.name` as the `secretName` and `apiKey` as the key
+in an explicitly authored `secretKeyRef`.
 
 ## Top-Level Properties
 
@@ -68,7 +71,7 @@ env var with a `secretKeyRef`, using `model.properties.secrets.name` as the
 | `endpoint` | string | (Read Only) The base URL used to call the model inference endpoint. Mapped from the recipe module's output. |
 | `environment` | string | (Required) The Radius Environment ID. Typically set by the rad CLI. Typically value should be `environment`. |
 | `model` | string | (Optional) The model deployment to provision. Defaults to `gpt-5-mini` if not provided. |
-| `secrets` | [object](#secrets) | (Read-only) Recipe secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; the other sub-properties declare secret keys whose values are written only into that managed secret (never onto this resource). Consumers bind a key into a container env var via `secretKeyRef`, using `<resource>.properties.secrets.name` as `secretName`. |
+| `secrets` | [object](#secrets) | (Read-only) Recipe secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the Recipe's `result.secrets`; the other sub-properties declare secret keys whose values are written only into that managed secret (never onto this resource). Consumers bind a key into a container env var via `secretKeyRef`, using `<resource>.properties.secrets.name` as `secretName`. |
 
 ## Object Properties
 

@@ -42,17 +42,20 @@ resource frontend 'Radius.Compute/containers@2025-08-01-preview' = {
 }
 ```
 
-The connection automatically injects environment variables into the
-container for all properties from the search service. The environment
-variables are named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>`. In this
+On compatible Kubernetes Container Recipes, the connection injects environment
+variables into the container for the search properties. The variables are
+named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>`. In this
 example the connection name is `search` so the environment variables will be:
 
 - CONNECTION_SEARCH_ENDPOINT
+- CONNECTION_SEARCH_APIKEY (secret-backed)
 
-The `apiKey` secret is NOT injected via the connection — it is materialized
-into a managed `Radius.Security/secrets` resource. Bind it into a container
-env var with a `secretKeyRef`, using `search.properties.secrets.name` as the
-`secretName` and key `apiKey` (see the `secrets` property).
+With Radius control-plane support from `radius-project/radius#12709` and
+Kubernetes Container Recipe support from `resource-types-contrib#300` or
+later, the same connection injects `apiKey` through a Kubernetes secret
+reference. For custom, older, or mixed-version Kubernetes deployments, use
+`search.properties.secrets.name` as the `secretName` and `apiKey` as the key
+in an explicitly authored `secretKeyRef`.
 
 ## Top-Level Properties
 
@@ -63,7 +66,7 @@ env var with a `secretKeyRef`, using `search.properties.secrets.name` as the
 | `connections` | [object](#connections) | Map of connection name to connection data. |
 | `endpoint` | string | The endpoint used to connect to the search service. Mapped from the recipe module's output. |
 | `environment` | string | (Required) The Radius Environment ID. Typically set by the rad CLI. Typically value should be `environment`. |
-| `secrets` | [object](#secrets) | (Read-only) Recipe secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; the other sub-properties declare secret keys whose values are written only into that managed secret (never onto this resource). Consumers bind a key into a container env var via `secretKeyRef`, using `<resource>.properties.secrets.name` as `secretName`. |
+| `secrets` | [object](#secrets) | (Read-only) Recipe secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the Recipe's `result.secrets`; the other sub-properties declare secret keys whose values are written only into that managed secret (never onto this resource). Consumers bind a key into a container env var via `secretKeyRef`, using `<resource>.properties.secrets.name` as `secretName`. |
 
 ## Object Properties
 

@@ -95,6 +95,13 @@ resource myContainer 'Radius.Compute/containers@2025-08-01-preview' = {
 
 To mount a persistent volume or secret see the PersistentVolumes and Secrets Resource Types.
 
+On Kubernetes, each connection injects ordinary producer properties and
+Recipe-managed secret references using
+`CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>`. Explicit environment variables
+take precedence, followed by managed secret references, then ordinary values.
+Set `disableDefaultEnvVars: true` to disable all generated variables for a
+connection. This behavior applies to regular and init containers.
+
 ## Top-Level Properties
 
 | Property | Type | Description |
@@ -125,7 +132,7 @@ To mount a persistent volume or secret see the PersistentVolumes and Secrets Res
 
 | Property | Type | Description |
 |----------|------|-------------|
-| `disableDefaultEnvVars` | boolean | (Optional) Disables the automatic injection of environment variables from connected resource properties. |
+| `disableDefaultEnvVars` | boolean | (Optional) Disables automatic injection of ordinary properties and secret-backed environment variables from this connection. |
 | `source` | string | (Required) The resource ID of the resource this container is dependent upon. |
 
 ### `containers` {#containers}

@@ -44,18 +44,21 @@ resource frontend 'Radius.Compute/containers@2025-08-01-preview' = {
 }
 ```
 
-The connection automatically injects environment variables into the
-container for all properties from the database. The environment variables
+On compatible Kubernetes Container Recipes, the connection injects environment
+variables into the container for the database properties. The variables
 are named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>`. In this example
 the connection name is `mongo` so the environment variables will be:
 
 - CONNECTION_MONGO_DATABASE
 - CONNECTION_MONGO_ENDPOINT
+- CONNECTION_MONGO_CONNECTIONSTRING (secret-backed)
 
-The `connectionString` secret is NOT injected via the connection — it is
-materialized into a managed `Radius.Security/secrets` resource. Bind it into
-a container env var with a `secretKeyRef`, using `mongo.properties.secrets.name`
-as the `secretName` and key `connectionString` (see the `secrets` property).
+With Radius control-plane support from `radius-project/radius#12709` and
+Kubernetes Container Recipe support from `resource-types-contrib#300` or
+later, the same connection injects `connectionString` through a Kubernetes
+secret reference. For custom, older, or mixed-version Kubernetes deployments,
+use `mongo.properties.secrets.name` as the `secretName` and `connectionString`
+as the key in an explicitly authored `secretKeyRef`.
 
 Portability note: this schema is platform-neutral so the same resource
 type works with Azure AVM, AWS Terraform modules, and Kubernetes recipes.
@@ -73,7 +76,7 @@ surface stay identical.
 | `database` | string | (Optional) The Mongo database name. Defaults to `mongo_db` if not provided. |
 | `endpoint` | string | The endpoint used to connect to the database. Mapped from the recipe module's output. |
 | `environment` | string | (Required) The Radius Environment ID. Typically set by the rad CLI. Typically value should be `environment`. |
-| `secrets` | [object](#secrets) | (Read-only) Recipe secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; the other sub-properties declare secret keys whose values are written only into that managed secret (never onto this resource). Consumers bind a key into a container env var via `secretKeyRef`, using `<resource>.properties.secrets.name` as `secretName`. |
+| `secrets` | [object](#secrets) | (Read-only) Recipe secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the Recipe's `result.secrets`; the other sub-properties declare secret keys whose values are written only into that managed secret (never onto this resource). Consumers bind a key into a container env var via `secretKeyRef`, using `<resource>.properties.secrets.name` as `secretName`. |
 
 ## Object Properties
 

@@ -67,9 +67,9 @@ The connection automatically injects environment variables into the container fo
 | `connections` | [object](#connections) | Map of connection name to connection data. |
 | `database` | string | (Optional) The name of the database. Defaults to `mysql_db` if not provided. |
 | `environment` | string | (Required) The Radius Environment ID. Typically set by the rad CLI. Typically value should be `environment`. |
-| `host` | string | The host name used to connect to the database. Mapped from the recipe module's output. |
+| `host` | string | (Read Only) The host name used to connect to the database. Mapped from the recipe module's output. |
 | `password` | string | (Required) The administrator password for the MySQL database. Marked `x-radius-sensitive`: Radius encrypts it at rest, redacts it on reads, and exposes it decrypted only to the recipe as `{{context.resource.properties.password}}`. |
-| `port` | integer | The port number used to connect to the database. Mapped from the recipe module's output (MySQL flexible server uses 3306). |
+| `port` | integer | (Optional) The TCP port used to connect to the database. Defaults to `3306`, the standard MySQL port that every Recipe in this repository provisions and the port MySQL flexible server is fixed to. A Recipe that provisions the database on a different port reports the real port as an output, which overwrites this value once the deployment finishes. Setting it in an application definition changes only the value reported to connected containers, never the port the server listens on, so leave it unset. |
 | `username` | string | (Required) The administrator username for the MySQL database. Provided directly on the resource and passed to the recipe as `{{context.resource.properties.username}}`. |
 | `version` | string | (Optional) The major MySQL server version in the X.Y format. Defaults to `8.4` if not provided.<br />Allowed values: `5.7`, `8.0`, `8.4`. |
 

@@ -67,10 +67,10 @@ The connection automatically injects environment variables into the container fo
 | `connections` | [object](#connections) | Map of connection name to connection data. |
 | `database` | string | (Optional) The name of the database. Defaults to `postgres_db` if not provided. |
 | `environment` | string | (Required) The Radius Environment ID. Typically set by the rad CLI. Typically value should be `environment`. |
-| `host` | string | The host name used to connect to the database. |
+| `host` | string | (Read Only) The host name used to connect to the database. Mapped from the recipe module's output. |
 | `initSql` | string | (Optional) SQL script mounted into the PostgreSQL container's `/docker-entrypoint-initdb.d/` directory and executed whenever PGDATA is empty. With the default ephemeral storage this runs on every pod restart. If a PersistentVolumeClaim is used, the script runs only on the very first startup and subsequent changes to initSql are ignored on existing volumes. Limited to ~1 MiB. Useful for creating tables, indexes, and inserting seed data. |
 | `password` | string | (Required) The administrator password for the PostgreSQL database. Marked `x-radius-sensitive`: Radius encrypts it at rest, redacts it on reads, and exposes it decrypted only to the recipe as `{{context.resource.properties.password}}`. |
-| `port` | string | The port number used to connect to the database. |
+| `port` | integer | (Optional) The TCP port used to connect to the database. Defaults to `5432`, the standard PostgreSQL port that every Recipe in this repository provisions and the port PostgreSQL flexible server is fixed to. A Recipe that provisions the database on a different port reports the real port as an output, which overwrites this value once the deployment finishes. Setting it in an application definition changes only the value reported to connected containers, never the port the server listens on, so leave it unset. |
 | `size` | string | (Optional) The size of the PostgreSQL database. Defaults to `S` if not provided.<br />Allowed values: `L`, `M`, `S`. |
 | `username` | string | (Required) The administrator username for the PostgreSQL database. Provided directly on the resource and passed to the recipe as `{{context.resource.properties.username}}`. |
 

@@ -10,8 +10,8 @@ linkTitle: "RedisCaches"
 
 The Radius.Data/redisCaches Resource Type deploys a Redis cache. To deploy a
 Redis cache, add a redisCaches resource to the application definition Bicep
-file. Unlike database types, no secret is required: Azure Managed Redis
-generates its own access keys, so the platform-engineer recipe needs no
+file. Unlike database types, no credential has to be supplied: the cache
+generates its own access key, so the platform-engineer recipe needs no
 injected credentials.
 ```bicep
 resource cache 'Radius.Data/redisCaches@2025-08-01-preview' = {
@@ -46,18 +46,45 @@ resource frontend 'Radius.Compute/containers@2025-08-01-preview' = {
 }
 ```
 
-The connection automatically injects environment variables into the
-container for all properties from the cache. The environment variables are
+On compatible Kubernetes Container Recipes, the connection injects environment
+variables into the container for the cache properties. The variables are
 named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>`. In this example the
 connection name is `redis` so the environment variables will be:
 
 - CONNECTION_REDIS_HOST
 - CONNECTION_REDIS_PORT
 
-The `url` secret is NOT injected via the connection — it is materialized into
-a managed `Radius.Security/secrets` resource. Bind it into a container env var
-with a `secretKeyRef`, using `redis.properties.secrets.name` as the `secretName`
-and key `url` (see the `secrets` property).
+Recipe-generated secrets are materialized into a managed
+`Radius.Security/secrets` resource. With Radius control-plane support from
+`radius-project/radius#12709` and Kubernetes Container Recipe support from
+`resource-types-contrib#300` or later, the same `redis` connection injects each
+key returned in `result.secrets`: `CONNECTION_REDIS_URL`, and
+`CONNECTION_REDIS_ACCESSKEY` when the Recipe returns `accessKey`. `host` and
+`port` remain ordinary values.
+
+For custom, older, or mixed-version Kubernetes deployments, bind the key
+explicitly with `secretKeyRef`, using `cache.properties.secrets.name` as the
+`secretName`. Use `url` for a client that parses a connection URL, or
+`accessKey` for a client that takes host, port, and password separately:
+
+```bicep
+env: {
+  REDIS_ADDR: {
+    value: '${cache.properties.host}:${cache.properties.port}'
+  }
+  REDIS_PASSWORD: {
+    valueFrom: {
+      secretKeyRef: {
+        secretName: cache.properties.secrets.name
+        key: 'accessKey'
+      }
+    }
+  }
+}
+```
+
+A recipe that provisions a cache requiring no credential does not map
+`accessKey`; bind it only against a recipe that declares it.
 
 ## Top-Level Properties
 
@@ -69,7 +96,7 @@ and key `url` (see the `secrets` property).
 | `environment` | string | (Required) The Radius Environment ID. Typically set by the rad CLI. Typically value should be `environment`. |
 | `host` | string | (Read Only) The host name used to connect to the cache. Mapped from the recipe module's output. |
 | `port` | integer | (Read Only) The TLS port number used to connect to the cache. Mapped from the recipe module's `port` output (Azure Managed Redis uses 10000). |
-| `secrets` | [object](#secrets) | (Read-only) Recipe secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; the other sub-properties declare secret keys whose values are written only into that managed secret (never onto this resource). Consumers bind a key into a container env var via `secretKeyRef`, using `<resource>.properties.secrets.name` as `secretName`. |
+| `secrets` | [object](#secrets) | (Read-only) Recipe secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the Recipe's `result.secrets`; the other sub-properties declare secret keys whose values are written only into that managed secret (never onto this resource). Consumers bind a key into a container env var via `secretKeyRef`, using `<resource>.properties.secrets.name` as `secretName`. |
 | `size` | string | (Optional) The size of the Redis cache. Defaults to `S` if not provided. The recipe maps the size onto a concrete cloud SKU.<br />Allowed values: `L`, `M`, `S`. |
 
 ## Object Properties
@@ -85,5 +112,6 @@ and key `url` (see the `secrets` property).
 
 | Property | Type | Description |
 |----------|------|-------------|
+| `accessKey` | string | (Read Only) The access key on its own, for clients that take host, port, and password separately instead of parsing a URL — it is the password such a client authenticates with. Mapped from the recipe module's `primaryAccessKey` output; delivered via the managed secret. Declared by recipes that provision an authenticated cache — a recipe provisioning a cache that needs no credential (such as the in-cluster Kubernetes recipe) does not map this key. |
 | `name` | string | (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`. |
 | `url` | string | (Read Only) The full TLS connection URL (`rediss://:<access-key>@<host>:<port>`) used to connect to the cache, including the access key. Mapped from the recipe module's `primaryConnectionString` output; delivered via the managed secret. |