From 184d112f6feb19508d1dcf6e7425e6e1b584cebd Mon Sep 17 00:00:00 2001 From: willdavsmith Date: Thu, 16 Jul 2026 11:15:13 -0700 Subject: [PATCH] chore: refresh resource type manifests from resource-types-contrib Signed-off-by: willdavsmith --- .../dev/containerImages.svg | 3 ++ .../built-in-providers/dev/kafka.yaml | 27 +++++++++++--- .../built-in-providers/dev/models.yaml | 27 +++++++++++--- .../dev/mongoDatabases.yaml | 27 +++++++++++--- .../built-in-providers/dev/objectStorage.yaml | 36 ++++++++++++++----- .../built-in-providers/dev/rabbitMQ.yaml | 27 +++++++++++--- .../built-in-providers/dev/redisCaches.yaml | 28 +++++++++++---- .../built-in-providers/dev/search.yaml | 27 +++++++++++--- .../self-hosted/containerImages.svg | 3 ++ .../built-in-providers/self-hosted/kafka.yaml | 27 +++++++++++--- .../self-hosted/models.yaml | 27 +++++++++++--- .../self-hosted/mongoDatabases.yaml | 27 +++++++++++--- .../self-hosted/objectStorage.yaml | 36 ++++++++++++++----- .../self-hosted/rabbitMQ.yaml | 27 +++++++++++--- .../self-hosted/redisCaches.yaml | 28 +++++++++++---- .../self-hosted/search.yaml | 27 +++++++++++--- go.mod | 2 +- go.sum | 4 +-- 18 files changed, 327 insertions(+), 83 deletions(-) create mode 100644 deploy/manifest/built-in-providers/dev/containerImages.svg create mode 100644 deploy/manifest/built-in-providers/self-hosted/containerImages.svg diff --git a/deploy/manifest/built-in-providers/dev/containerImages.svg b/deploy/manifest/built-in-providers/dev/containerImages.svg new file mode 100644 index 0000000000..9fe55f8e58 --- /dev/null +++ b/deploy/manifest/built-in-providers/dev/containerImages.svg @@ -0,0 +1,3 @@ + + + diff --git a/deploy/manifest/built-in-providers/dev/kafka.yaml b/deploy/manifest/built-in-providers/dev/kafka.yaml index 44cca5d509..12a0a1f736 100644 --- a/deploy/manifest/built-in-providers/dev/kafka.yaml +++ b/deploy/manifest/built-in-providers/dev/kafka.yaml @@ -43,7 +43,11 @@ types: connection name is `kafka` so the environment variables will be: - CONNECTION_KAFKA_HOST - - CONNECTION_KAFKA_CONNECTIONSTRING + + The `connectionString` secret is NOT injected via the connection — it is + materialized into a managed `Radius.Security/secrets` resource. Bind it into + a container env var with a `secretKeyRef`, using `kafka.properties.secrets.name` + as the `secretName` and key `connectionString` (see the `secrets` property). Portability note: the schema is platform-neutral so the same type works with Azure AVM (Bicep), AWS Terraform registry modules, and Kubernetes @@ -72,8 +76,21 @@ types: type: string description: The host name used to connect to the Kafka-compatible endpoint. For Azure Event Hubs this is the namespace name; the bootstrap server is `.servicebus.windows.net:9093`. readOnly: true - connectionString: - type: string - description: The connection string used to connect to the Kafka-compatible endpoint. Mapped from the recipe module's output. - readOnly: true + secrets: + type: object + description: >- + (Read-only) Recipe secrets. The reserved `name` sub-property references the managed + Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; + the other sub-properties declare secret keys whose values are written only into that + managed secret (never onto this resource). Consumers bind a key into a container env var + via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. + properties: + name: + type: string + readOnly: true + description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`. + connectionString: + type: string + readOnly: true + description: The connection string used to connect to the Kafka-compatible endpoint. Mapped from the recipe module's `primaryConnectionString` output; delivered via the managed secret. required: [environment] diff --git a/deploy/manifest/built-in-providers/dev/models.yaml b/deploy/manifest/built-in-providers/dev/models.yaml index 1a7735360d..b509105bb6 100644 --- a/deploy/manifest/built-in-providers/dev/models.yaml +++ b/deploy/manifest/built-in-providers/dev/models.yaml @@ -46,7 +46,11 @@ types: - CONNECTION_LLM_MODEL - CONNECTION_LLM_ENDPOINT - - CONNECTION_LLM_APIKEY + + The `apiKey` secret is NOT injected via the connection — it is materialized + into a managed `Radius.Security/secrets` resource. Bind it into a container + env var with a `secretKeyRef`, using `model.properties.secrets.name` as the + `secretName` and key `apiKey` (see the `secrets` property). apiVersions: '2025-08-01-preview': @@ -67,8 +71,21 @@ types: type: string description: "(Read Only) The base URL used to call the model inference endpoint. Mapped from the recipe module's output." readOnly: true - apiKey: - type: string - description: "(Read Only) The API key used to call the model inference endpoint. Mapped from the recipe module's `primaryKey` output." - readOnly: true + secrets: + type: object + description: >- + (Read-only) Recipe secrets. The reserved `name` sub-property references the managed + Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; + the other sub-properties declare secret keys whose values are written only into that + managed secret (never onto this resource). Consumers bind a key into a container env var + via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. + properties: + name: + type: string + readOnly: true + description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`. + apiKey: + type: string + readOnly: true + description: "(Read Only) The API key used to call the model inference endpoint. Mapped from the recipe module's `primaryKey` output; delivered via the managed secret." required: [environment] diff --git a/deploy/manifest/built-in-providers/dev/mongoDatabases.yaml b/deploy/manifest/built-in-providers/dev/mongoDatabases.yaml index 7af8e282c3..2791ed9893 100644 --- a/deploy/manifest/built-in-providers/dev/mongoDatabases.yaml +++ b/deploy/manifest/built-in-providers/dev/mongoDatabases.yaml @@ -45,7 +45,11 @@ types: - CONNECTION_MONGO_DATABASE - CONNECTION_MONGO_ENDPOINT - - CONNECTION_MONGO_CONNECTIONSTRING + + The `connectionString` secret is NOT injected via the connection — it is + materialized into a managed `Radius.Security/secrets` resource. Bind it into + a container env var with a `secretKeyRef`, using `mongo.properties.secrets.name` + as the `secretName` and key `connectionString` (see the `secrets` property). Portability note: this schema is platform-neutral so the same resource type works with Azure AVM, AWS Terraform modules, and Kubernetes recipes. @@ -71,8 +75,21 @@ types: type: string description: The endpoint used to connect to the database. Mapped from the recipe module's output. readOnly: true - connectionString: - type: string - description: The connection string used to connect to the database. Mapped from the recipe module's output. - readOnly: true + secrets: + type: object + description: >- + (Read-only) Recipe secrets. The reserved `name` sub-property references the managed + Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; + the other sub-properties declare secret keys whose values are written only into that + managed secret (never onto this resource). Consumers bind a key into a container env var + via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. + properties: + name: + type: string + readOnly: true + description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`. + connectionString: + type: string + readOnly: true + description: The connection string used to connect to the database. Mapped from the recipe module's output; delivered via the managed secret. required: [environment] diff --git a/deploy/manifest/built-in-providers/dev/objectStorage.yaml b/deploy/manifest/built-in-providers/dev/objectStorage.yaml index 2a5efd225f..a7337ddeaf 100644 --- a/deploy/manifest/built-in-providers/dev/objectStorage.yaml +++ b/deploy/manifest/built-in-providers/dev/objectStorage.yaml @@ -48,9 +48,14 @@ types: - CONNECTION_STORAGE_CONTAINERNAME - CONNECTION_STORAGE_ENDPOINT - - CONNECTION_STORAGE_CONNECTIONSTRING - CONNECTION_STORAGE_ACCOUNTNAME + The `connectionString` and `accountKey` secrets are NOT injected via the + connection — they are materialized into a managed `Radius.Security/secrets` + resource. Bind them into container env vars with a `secretKeyRef`, using + `store.properties.secrets.name` as the `secretName` and the desired key + (`connectionString` or `accountKey`; see the `secrets` property). + The schema is platform-neutral: the same developer-facing properties can be backed by Azure Blob Storage, AWS S3, or a Kubernetes object-store recipe by changing only the platform recipe's module source, parameters, and outputs. @@ -74,16 +79,29 @@ types: type: string description: The object storage endpoint used to connect to the store. Mapped from the recipe module's `primaryBlobEndpoint` output. readOnly: true - connectionString: - type: string - description: The storage account connection string. Mapped from the recipe module's `primaryConnectionString` output. - readOnly: true accountName: type: string description: The Azure Storage account name. Mapped from the recipe module's `name` output. readOnly: true - accountKey: - type: string - description: The Azure Storage account access key. Mapped from the recipe module's `primaryAccessKey` output. - readOnly: true + secrets: + type: object + description: >- + (Read-only) Recipe secrets. The reserved `name` sub-property references the managed + Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; + the other sub-properties declare secret keys whose values are written only into that + managed secret (never onto this resource). Consumers bind a key into a container env var + via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. + properties: + name: + type: string + readOnly: true + description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`. + connectionString: + type: string + readOnly: true + description: The storage account connection string. Mapped from the recipe module's `primaryConnectionString` output; delivered via the managed secret. + accountKey: + type: string + readOnly: true + description: The Azure Storage account access key. Mapped from the recipe module's `primaryAccessKey` output; delivered via the managed secret. required: [environment] diff --git a/deploy/manifest/built-in-providers/dev/rabbitMQ.yaml b/deploy/manifest/built-in-providers/dev/rabbitMQ.yaml index f3bfb23237..5026bd0f11 100644 --- a/deploy/manifest/built-in-providers/dev/rabbitMQ.yaml +++ b/deploy/manifest/built-in-providers/dev/rabbitMQ.yaml @@ -29,7 +29,11 @@ types: For a connection named `rabbitmq`, the variables are: - CONNECTION_RABBITMQ_HOST - - CONNECTION_RABBITMQ_CONNECTIONSTRING + + The `connectionString` secret is NOT injected via the connection — it is + materialized into a managed `Radius.Security/secrets` resource. Bind it into + a container env var with a `secretKeyRef`, using `rabbitmq.properties.secrets.name` + as the `secretName` and key `connectionString` (see the `secrets` property). apiVersions: '2025-08-01-preview': @@ -50,8 +54,21 @@ types: type: string description: The host or namespace name used to connect to the queue. Mapped from the recipe module's output. readOnly: true - connectionString: - type: string - description: The primary connection string used to connect to the queue. Mapped from the recipe module's output. - readOnly: true + secrets: + type: object + description: >- + (Read-only) Recipe secrets. The reserved `name` sub-property references the managed + Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; + the other sub-properties declare secret keys whose values are written only into that + managed secret (never onto this resource). Consumers bind a key into a container env var + via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. + properties: + name: + type: string + readOnly: true + description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`. + connectionString: + type: string + readOnly: true + description: The primary connection string used to connect to the queue. Mapped from the recipe module's output; delivered via the managed secret. required: [environment] diff --git a/deploy/manifest/built-in-providers/dev/redisCaches.yaml b/deploy/manifest/built-in-providers/dev/redisCaches.yaml index 4b080896b0..fb7fe5fac0 100644 --- a/deploy/manifest/built-in-providers/dev/redisCaches.yaml +++ b/deploy/manifest/built-in-providers/dev/redisCaches.yaml @@ -47,7 +47,11 @@ types: - CONNECTION_REDIS_HOST - CONNECTION_REDIS_PORT - - CONNECTION_REDIS_URL + + The `url` secret is NOT injected via the connection — it is materialized into + a managed `Radius.Security/secrets` resource. Bind it into a container env var + with a `secretKeyRef`, using `redis.properties.secrets.name` as the `secretName` + and key `url` (see the `secrets` property). apiVersions: '2025-08-01-preview': @@ -72,9 +76,21 @@ types: type: integer description: "(Read Only) The TLS port number used to connect to the cache. Mapped from the recipe module's `port` output (Azure Managed Redis uses 10000)." readOnly: true - url: - type: string - description: "(Read Only) The full TLS connection URL (`rediss://:@:`) used to connect to the cache, including the access key. Mapped from the recipe module's `primaryConnectionString` output." - x-radius-sensitive: true - readOnly: true + secrets: + type: object + description: >- + (Read-only) Recipe secrets. The reserved `name` sub-property references the managed + Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; + the other sub-properties declare secret keys whose values are written only into that + managed secret (never onto this resource). Consumers bind a key into a container env var + via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. + properties: + name: + type: string + readOnly: true + description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`. + url: + type: string + readOnly: true + description: "(Read Only) The full TLS connection URL (`rediss://:@:`) used to connect to the cache, including the access key. Mapped from the recipe module's `primaryConnectionString` output; delivered via the managed secret." required: [environment] diff --git a/deploy/manifest/built-in-providers/dev/search.yaml b/deploy/manifest/built-in-providers/dev/search.yaml index 1416963e95..549e957b6e 100644 --- a/deploy/manifest/built-in-providers/dev/search.yaml +++ b/deploy/manifest/built-in-providers/dev/search.yaml @@ -46,7 +46,11 @@ types: example the connection name is `search` so the environment variables will be: - CONNECTION_SEARCH_ENDPOINT - - CONNECTION_SEARCH_APIKEY + + The `apiKey` secret is NOT injected via the connection — it is materialized + into a managed `Radius.Security/secrets` resource. Bind it into a container + env var with a `secretKeyRef`, using `search.properties.secrets.name` as the + `secretName` and key `apiKey` (see the `secrets` property). apiVersions: '2025-08-01-preview': @@ -63,8 +67,21 @@ types: type: string description: The endpoint used to connect to the search service. Mapped from the recipe module's output. readOnly: true - apiKey: - type: string - description: The admin API key used to connect to the search service. Mapped from the recipe module's output. - readOnly: true + secrets: + type: object + description: >- + (Read-only) Recipe secrets. The reserved `name` sub-property references the managed + Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; + the other sub-properties declare secret keys whose values are written only into that + managed secret (never onto this resource). Consumers bind a key into a container env var + via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. + properties: + name: + type: string + readOnly: true + description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`. + apiKey: + type: string + readOnly: true + description: The admin API key used to connect to the search service. Mapped from the recipe module's output; delivered via the managed secret. required: [environment] diff --git a/deploy/manifest/built-in-providers/self-hosted/containerImages.svg b/deploy/manifest/built-in-providers/self-hosted/containerImages.svg new file mode 100644 index 0000000000..9fe55f8e58 --- /dev/null +++ b/deploy/manifest/built-in-providers/self-hosted/containerImages.svg @@ -0,0 +1,3 @@ + + + diff --git a/deploy/manifest/built-in-providers/self-hosted/kafka.yaml b/deploy/manifest/built-in-providers/self-hosted/kafka.yaml index 44cca5d509..12a0a1f736 100644 --- a/deploy/manifest/built-in-providers/self-hosted/kafka.yaml +++ b/deploy/manifest/built-in-providers/self-hosted/kafka.yaml @@ -43,7 +43,11 @@ types: connection name is `kafka` so the environment variables will be: - CONNECTION_KAFKA_HOST - - CONNECTION_KAFKA_CONNECTIONSTRING + + The `connectionString` secret is NOT injected via the connection — it is + materialized into a managed `Radius.Security/secrets` resource. Bind it into + a container env var with a `secretKeyRef`, using `kafka.properties.secrets.name` + as the `secretName` and key `connectionString` (see the `secrets` property). Portability note: the schema is platform-neutral so the same type works with Azure AVM (Bicep), AWS Terraform registry modules, and Kubernetes @@ -72,8 +76,21 @@ types: type: string description: The host name used to connect to the Kafka-compatible endpoint. For Azure Event Hubs this is the namespace name; the bootstrap server is `.servicebus.windows.net:9093`. readOnly: true - connectionString: - type: string - description: The connection string used to connect to the Kafka-compatible endpoint. Mapped from the recipe module's output. - readOnly: true + secrets: + type: object + description: >- + (Read-only) Recipe secrets. The reserved `name` sub-property references the managed + Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; + the other sub-properties declare secret keys whose values are written only into that + managed secret (never onto this resource). Consumers bind a key into a container env var + via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. + properties: + name: + type: string + readOnly: true + description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`. + connectionString: + type: string + readOnly: true + description: The connection string used to connect to the Kafka-compatible endpoint. Mapped from the recipe module's `primaryConnectionString` output; delivered via the managed secret. required: [environment] diff --git a/deploy/manifest/built-in-providers/self-hosted/models.yaml b/deploy/manifest/built-in-providers/self-hosted/models.yaml index 1a7735360d..b509105bb6 100644 --- a/deploy/manifest/built-in-providers/self-hosted/models.yaml +++ b/deploy/manifest/built-in-providers/self-hosted/models.yaml @@ -46,7 +46,11 @@ types: - CONNECTION_LLM_MODEL - CONNECTION_LLM_ENDPOINT - - CONNECTION_LLM_APIKEY + + The `apiKey` secret is NOT injected via the connection — it is materialized + into a managed `Radius.Security/secrets` resource. Bind it into a container + env var with a `secretKeyRef`, using `model.properties.secrets.name` as the + `secretName` and key `apiKey` (see the `secrets` property). apiVersions: '2025-08-01-preview': @@ -67,8 +71,21 @@ types: type: string description: "(Read Only) The base URL used to call the model inference endpoint. Mapped from the recipe module's output." readOnly: true - apiKey: - type: string - description: "(Read Only) The API key used to call the model inference endpoint. Mapped from the recipe module's `primaryKey` output." - readOnly: true + secrets: + type: object + description: >- + (Read-only) Recipe secrets. The reserved `name` sub-property references the managed + Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; + the other sub-properties declare secret keys whose values are written only into that + managed secret (never onto this resource). Consumers bind a key into a container env var + via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. + properties: + name: + type: string + readOnly: true + description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`. + apiKey: + type: string + readOnly: true + description: "(Read Only) The API key used to call the model inference endpoint. Mapped from the recipe module's `primaryKey` output; delivered via the managed secret." required: [environment] diff --git a/deploy/manifest/built-in-providers/self-hosted/mongoDatabases.yaml b/deploy/manifest/built-in-providers/self-hosted/mongoDatabases.yaml index 7af8e282c3..2791ed9893 100644 --- a/deploy/manifest/built-in-providers/self-hosted/mongoDatabases.yaml +++ b/deploy/manifest/built-in-providers/self-hosted/mongoDatabases.yaml @@ -45,7 +45,11 @@ types: - CONNECTION_MONGO_DATABASE - CONNECTION_MONGO_ENDPOINT - - CONNECTION_MONGO_CONNECTIONSTRING + + The `connectionString` secret is NOT injected via the connection — it is + materialized into a managed `Radius.Security/secrets` resource. Bind it into + a container env var with a `secretKeyRef`, using `mongo.properties.secrets.name` + as the `secretName` and key `connectionString` (see the `secrets` property). Portability note: this schema is platform-neutral so the same resource type works with Azure AVM, AWS Terraform modules, and Kubernetes recipes. @@ -71,8 +75,21 @@ types: type: string description: The endpoint used to connect to the database. Mapped from the recipe module's output. readOnly: true - connectionString: - type: string - description: The connection string used to connect to the database. Mapped from the recipe module's output. - readOnly: true + secrets: + type: object + description: >- + (Read-only) Recipe secrets. The reserved `name` sub-property references the managed + Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; + the other sub-properties declare secret keys whose values are written only into that + managed secret (never onto this resource). Consumers bind a key into a container env var + via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. + properties: + name: + type: string + readOnly: true + description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`. + connectionString: + type: string + readOnly: true + description: The connection string used to connect to the database. Mapped from the recipe module's output; delivered via the managed secret. required: [environment] diff --git a/deploy/manifest/built-in-providers/self-hosted/objectStorage.yaml b/deploy/manifest/built-in-providers/self-hosted/objectStorage.yaml index 2a5efd225f..a7337ddeaf 100644 --- a/deploy/manifest/built-in-providers/self-hosted/objectStorage.yaml +++ b/deploy/manifest/built-in-providers/self-hosted/objectStorage.yaml @@ -48,9 +48,14 @@ types: - CONNECTION_STORAGE_CONTAINERNAME - CONNECTION_STORAGE_ENDPOINT - - CONNECTION_STORAGE_CONNECTIONSTRING - CONNECTION_STORAGE_ACCOUNTNAME + The `connectionString` and `accountKey` secrets are NOT injected via the + connection — they are materialized into a managed `Radius.Security/secrets` + resource. Bind them into container env vars with a `secretKeyRef`, using + `store.properties.secrets.name` as the `secretName` and the desired key + (`connectionString` or `accountKey`; see the `secrets` property). + The schema is platform-neutral: the same developer-facing properties can be backed by Azure Blob Storage, AWS S3, or a Kubernetes object-store recipe by changing only the platform recipe's module source, parameters, and outputs. @@ -74,16 +79,29 @@ types: type: string description: The object storage endpoint used to connect to the store. Mapped from the recipe module's `primaryBlobEndpoint` output. readOnly: true - connectionString: - type: string - description: The storage account connection string. Mapped from the recipe module's `primaryConnectionString` output. - readOnly: true accountName: type: string description: The Azure Storage account name. Mapped from the recipe module's `name` output. readOnly: true - accountKey: - type: string - description: The Azure Storage account access key. Mapped from the recipe module's `primaryAccessKey` output. - readOnly: true + secrets: + type: object + description: >- + (Read-only) Recipe secrets. The reserved `name` sub-property references the managed + Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; + the other sub-properties declare secret keys whose values are written only into that + managed secret (never onto this resource). Consumers bind a key into a container env var + via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. + properties: + name: + type: string + readOnly: true + description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`. + connectionString: + type: string + readOnly: true + description: The storage account connection string. Mapped from the recipe module's `primaryConnectionString` output; delivered via the managed secret. + accountKey: + type: string + readOnly: true + description: The Azure Storage account access key. Mapped from the recipe module's `primaryAccessKey` output; delivered via the managed secret. required: [environment] diff --git a/deploy/manifest/built-in-providers/self-hosted/rabbitMQ.yaml b/deploy/manifest/built-in-providers/self-hosted/rabbitMQ.yaml index f3bfb23237..5026bd0f11 100644 --- a/deploy/manifest/built-in-providers/self-hosted/rabbitMQ.yaml +++ b/deploy/manifest/built-in-providers/self-hosted/rabbitMQ.yaml @@ -29,7 +29,11 @@ types: For a connection named `rabbitmq`, the variables are: - CONNECTION_RABBITMQ_HOST - - CONNECTION_RABBITMQ_CONNECTIONSTRING + + The `connectionString` secret is NOT injected via the connection — it is + materialized into a managed `Radius.Security/secrets` resource. Bind it into + a container env var with a `secretKeyRef`, using `rabbitmq.properties.secrets.name` + as the `secretName` and key `connectionString` (see the `secrets` property). apiVersions: '2025-08-01-preview': @@ -50,8 +54,21 @@ types: type: string description: The host or namespace name used to connect to the queue. Mapped from the recipe module's output. readOnly: true - connectionString: - type: string - description: The primary connection string used to connect to the queue. Mapped from the recipe module's output. - readOnly: true + secrets: + type: object + description: >- + (Read-only) Recipe secrets. The reserved `name` sub-property references the managed + Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; + the other sub-properties declare secret keys whose values are written only into that + managed secret (never onto this resource). Consumers bind a key into a container env var + via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. + properties: + name: + type: string + readOnly: true + description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`. + connectionString: + type: string + readOnly: true + description: The primary connection string used to connect to the queue. Mapped from the recipe module's output; delivered via the managed secret. required: [environment] diff --git a/deploy/manifest/built-in-providers/self-hosted/redisCaches.yaml b/deploy/manifest/built-in-providers/self-hosted/redisCaches.yaml index 4b080896b0..fb7fe5fac0 100644 --- a/deploy/manifest/built-in-providers/self-hosted/redisCaches.yaml +++ b/deploy/manifest/built-in-providers/self-hosted/redisCaches.yaml @@ -47,7 +47,11 @@ types: - CONNECTION_REDIS_HOST - CONNECTION_REDIS_PORT - - CONNECTION_REDIS_URL + + The `url` secret is NOT injected via the connection — it is materialized into + a managed `Radius.Security/secrets` resource. Bind it into a container env var + with a `secretKeyRef`, using `redis.properties.secrets.name` as the `secretName` + and key `url` (see the `secrets` property). apiVersions: '2025-08-01-preview': @@ -72,9 +76,21 @@ types: type: integer description: "(Read Only) The TLS port number used to connect to the cache. Mapped from the recipe module's `port` output (Azure Managed Redis uses 10000)." readOnly: true - url: - type: string - description: "(Read Only) The full TLS connection URL (`rediss://:@:`) used to connect to the cache, including the access key. Mapped from the recipe module's `primaryConnectionString` output." - x-radius-sensitive: true - readOnly: true + secrets: + type: object + description: >- + (Read-only) Recipe secrets. The reserved `name` sub-property references the managed + Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; + the other sub-properties declare secret keys whose values are written only into that + managed secret (never onto this resource). Consumers bind a key into a container env var + via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. + properties: + name: + type: string + readOnly: true + description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`. + url: + type: string + readOnly: true + description: "(Read Only) The full TLS connection URL (`rediss://:@:`) used to connect to the cache, including the access key. Mapped from the recipe module's `primaryConnectionString` output; delivered via the managed secret." required: [environment] diff --git a/deploy/manifest/built-in-providers/self-hosted/search.yaml b/deploy/manifest/built-in-providers/self-hosted/search.yaml index 1416963e95..549e957b6e 100644 --- a/deploy/manifest/built-in-providers/self-hosted/search.yaml +++ b/deploy/manifest/built-in-providers/self-hosted/search.yaml @@ -46,7 +46,11 @@ types: example the connection name is `search` so the environment variables will be: - CONNECTION_SEARCH_ENDPOINT - - CONNECTION_SEARCH_APIKEY + + The `apiKey` secret is NOT injected via the connection — it is materialized + into a managed `Radius.Security/secrets` resource. Bind it into a container + env var with a `secretKeyRef`, using `search.properties.secrets.name` as the + `secretName` and key `apiKey` (see the `secrets` property). apiVersions: '2025-08-01-preview': @@ -63,8 +67,21 @@ types: type: string description: The endpoint used to connect to the search service. Mapped from the recipe module's output. readOnly: true - apiKey: - type: string - description: The admin API key used to connect to the search service. Mapped from the recipe module's output. - readOnly: true + secrets: + type: object + description: >- + (Read-only) Recipe secrets. The reserved `name` sub-property references the managed + Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; + the other sub-properties declare secret keys whose values are written only into that + managed secret (never onto this resource). Consumers bind a key into a container env var + via `secretKeyRef`, using `.properties.secrets.name` as `secretName`. + properties: + name: + type: string + readOnly: true + description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`. + apiKey: + type: string + readOnly: true + description: The admin API key used to connect to the search service. Mapped from the recipe module's output; delivered via the managed secret. required: [environment] diff --git a/go.mod b/go.mod index 79e7531118..71e2473ff4 100644 --- a/go.mod +++ b/go.mod @@ -76,7 +76,7 @@ require ( github.com/opencontainers/image-spec v1.1.1 github.com/projectcontour/contour v1.33.5 github.com/prometheus/client_golang v1.23.2 - github.com/radius-project/resource-types-contrib v0.0.0-20260708204524-ab9722ac7027 + github.com/radius-project/resource-types-contrib v0.0.0-20260709202112-cf57799dfa1c github.com/sanity-io/litter v1.5.8 github.com/sethvargo/go-retry v0.3.0 github.com/spf13/cobra v1.10.2 diff --git a/go.sum b/go.sum index d282871380..ef188604bd 100644 --- a/go.sum +++ b/go.sum @@ -543,8 +543,8 @@ github.com/prometheus/otlptranslator v1.0.0 h1:s0LJW/iN9dkIH+EnhiD3BlkkP5QVIUVEo github.com/prometheus/otlptranslator v1.0.0/go.mod h1:vRYWnXvI6aWGpsdY/mOT/cbeVRBlPWtBNDb7kGR3uKM= github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc= github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo= -github.com/radius-project/resource-types-contrib v0.0.0-20260708204524-ab9722ac7027 h1:2GVCCNDM3ELrxU1brwqpF4+HXw5meeyRhYyluVR1sPQ= -github.com/radius-project/resource-types-contrib v0.0.0-20260708204524-ab9722ac7027/go.mod h1:Bl5/B3MAJSCQMR0PNEFhkNdKy+nFsNoyC65O1iowhMU= +github.com/radius-project/resource-types-contrib v0.0.0-20260709202112-cf57799dfa1c h1:bCOSnUX3oTknfLjKG0ep76gRHWAzgUrihdTHDxkMFlk= +github.com/radius-project/resource-types-contrib v0.0.0-20260709202112-cf57799dfa1c/go.mod h1:Bl5/B3MAJSCQMR0PNEFhkNdKy+nFsNoyC65O1iowhMU= github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5 h1:EaDatTxkdHG+U3Bk4EUr+DZ7fOGwTfezUiUJMaIcaho= github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5/go.mod h1:fyalQWdtzDBECAQFBJuQe5bzQ02jGd5Qcbgb97Flm7U= github.com/redis/go-redis/extra/redisotel/v9 v9.0.5 h1:EfpWLLCyXw8PSM2/XNJLjI3Pb27yVE+gIAfeqp8LUCc=