chore/sync resource types contrib

deploy/manifest/built-in-providers/dev/kafka.yaml

@@ -43,7 +43,11 @@ types:
       connection name is `kafka` so the environment variables will be:
 
       - CONNECTION_KAFKA_HOST
-      - CONNECTION_KAFKA_CONNECTIONSTRING
+
+      The `connectionString` secret is NOT injected via the connection — it is
+      materialized into a managed `Radius.Security/secrets` resource. Bind it into
+      a container env var with a `secretKeyRef`, using `kafka.properties.secrets.name`
+      as the `secretName` and key `connectionString` (see the `secrets` property).
 
       Portability note: the schema is platform-neutral so the same type works
       with Azure AVM (Bicep), AWS Terraform registry modules, and Kubernetes
@@ -72,8 +76,21 @@ types:
               type: string
               description: The host name used to connect to the Kafka-compatible endpoint. For Azure Event Hubs this is the namespace name; the bootstrap server is `<host>.servicebus.windows.net:9093`.
               readOnly: true
-            connectionString:
-              type: string
-              description: The connection string used to connect to the Kafka-compatible endpoint. Mapped from the recipe module's output.
-              readOnly: true
+            secrets:
+              type: object
+              description: >-
+                (Read-only) Recipe secrets. The reserved `name` sub-property references the managed
+                Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`;
+                the other sub-properties declare secret keys whose values are written only into that
+                managed secret (never onto this resource). Consumers bind a key into a container env var
+                via `secretKeyRef`, using `<resource>.properties.secrets.name` as `secretName`.
+              properties:
+                name:
+                  type: string
+                  readOnly: true
+                  description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`.
+                connectionString:
+                  type: string
+                  readOnly: true
+                  description: The connection string used to connect to the Kafka-compatible endpoint. Mapped from the recipe module's `primaryConnectionString` output; delivered via the managed secret.
           required: [environment]

deploy/manifest/built-in-providers/dev/models.yaml

@@ -46,7 +46,11 @@ types:
 
       - CONNECTION_LLM_MODEL
       - CONNECTION_LLM_ENDPOINT
-      - CONNECTION_LLM_APIKEY
+
+      The `apiKey` secret is NOT injected via the connection — it is materialized
+      into a managed `Radius.Security/secrets` resource. Bind it into a container
+      env var with a `secretKeyRef`, using `model.properties.secrets.name` as the
+      `secretName` and key `apiKey` (see the `secrets` property).
 
     apiVersions:
       '2025-08-01-preview':
@@ -67,8 +71,21 @@ types:
               type: string
               description: "(Read Only) The base URL used to call the model inference endpoint. Mapped from the recipe module's output."
               readOnly: true
-            apiKey:
-              type: string
-              description: "(Read Only) The API key used to call the model inference endpoint. Mapped from the recipe module's `primaryKey` output."
-              readOnly: true
+            secrets:
+              type: object
+              description: >-
+                (Read-only) Recipe secrets. The reserved `name` sub-property references the managed
+                Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`;
+                the other sub-properties declare secret keys whose values are written only into that
+                managed secret (never onto this resource). Consumers bind a key into a container env var
+                via `secretKeyRef`, using `<resource>.properties.secrets.name` as `secretName`.
+              properties:
+                name:
+                  type: string
+                  readOnly: true
+                  description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`.
+                apiKey:
+                  type: string
+                  readOnly: true
+                  description: "(Read Only) The API key used to call the model inference endpoint. Mapped from the recipe module's `primaryKey` output; delivered via the managed secret."
           required: [environment]

deploy/manifest/built-in-providers/dev/mongoDatabases.yaml

@@ -45,7 +45,11 @@ types:
 
       - CONNECTION_MONGO_DATABASE
       - CONNECTION_MONGO_ENDPOINT
-      - CONNECTION_MONGO_CONNECTIONSTRING
+
+      The `connectionString` secret is NOT injected via the connection — it is
+      materialized into a managed `Radius.Security/secrets` resource. Bind it into
+      a container env var with a `secretKeyRef`, using `mongo.properties.secrets.name`
+      as the `secretName` and key `connectionString` (see the `secrets` property).
 
       Portability note: this schema is platform-neutral so the same resource
       type works with Azure AVM, AWS Terraform modules, and Kubernetes recipes.
@@ -71,8 +75,21 @@ types:
               type: string
               description: The endpoint used to connect to the database. Mapped from the recipe module's output.
               readOnly: true
-            connectionString:
-              type: string
-              description: The connection string used to connect to the database. Mapped from the recipe module's output.
-              readOnly: true
+            secrets:
+              type: object
+              description: >-
+                (Read-only) Recipe secrets. The reserved `name` sub-property references the managed
+                Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`;
+                the other sub-properties declare secret keys whose values are written only into that
+                managed secret (never onto this resource). Consumers bind a key into a container env var
+                via `secretKeyRef`, using `<resource>.properties.secrets.name` as `secretName`.
+              properties:
+                name:
+                  type: string
+                  readOnly: true
+                  description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`.
+                connectionString:
+                  type: string
+                  readOnly: true
+                  description: The connection string used to connect to the database. Mapped from the recipe module's output; delivered via the managed secret.
           required: [environment]

deploy/manifest/built-in-providers/dev/objectStorage.yaml

@@ -48,9 +48,14 @@ types:
 
       - CONNECTION_STORAGE_CONTAINERNAME
       - CONNECTION_STORAGE_ENDPOINT
-      - CONNECTION_STORAGE_CONNECTIONSTRING
       - CONNECTION_STORAGE_ACCOUNTNAME
 
+      The `connectionString` and `accountKey` secrets are NOT injected via the
+      connection — they are materialized into a managed `Radius.Security/secrets`
+      resource. Bind them into container env vars with a `secretKeyRef`, using
+      `store.properties.secrets.name` as the `secretName` and the desired key
+      (`connectionString` or `accountKey`; see the `secrets` property).
+
       The schema is platform-neutral: the same developer-facing properties can be
       backed by Azure Blob Storage, AWS S3, or a Kubernetes object-store recipe by
       changing only the platform recipe's module source, parameters, and outputs.
@@ -74,16 +79,29 @@ types:
               type: string
               description: The object storage endpoint used to connect to the store. Mapped from the recipe module's `primaryBlobEndpoint` output.
               readOnly: true
-            connectionString:
-              type: string
-              description: The storage account connection string. Mapped from the recipe module's `primaryConnectionString` output.
-              readOnly: true
             accountName:
               type: string
               description: The Azure Storage account name. Mapped from the recipe module's `name` output.
               readOnly: true
-            accountKey:
-              type: string
-              description: The Azure Storage account access key. Mapped from the recipe module's `primaryAccessKey` output.
-              readOnly: true
+            secrets:
+              type: object
+              description: >-
+                (Read-only) Recipe secrets. The reserved `name` sub-property references the managed
+                Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`;
+                the other sub-properties declare secret keys whose values are written only into that
+                managed secret (never onto this resource). Consumers bind a key into a container env var
+                via `secretKeyRef`, using `<resource>.properties.secrets.name` as `secretName`.
+              properties:
+                name:
+                  type: string
+                  readOnly: true
+                  description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`.
+                connectionString:
+                  type: string
+                  readOnly: true
+                  description: The storage account connection string. Mapped from the recipe module's `primaryConnectionString` output; delivered via the managed secret.
+                accountKey:
+                  type: string
+                  readOnly: true
+                  description: The Azure Storage account access key. Mapped from the recipe module's `primaryAccessKey` output; delivered via the managed secret.
           required: [environment]

deploy/manifest/built-in-providers/dev/rabbitMQ.yaml

@@ -29,7 +29,11 @@ types:
       For a connection named `rabbitmq`, the variables are:
 
       - CONNECTION_RABBITMQ_HOST
-      - CONNECTION_RABBITMQ_CONNECTIONSTRING
+
+      The `connectionString` secret is NOT injected via the connection — it is
+      materialized into a managed `Radius.Security/secrets` resource. Bind it into
+      a container env var with a `secretKeyRef`, using `rabbitmq.properties.secrets.name`
+      as the `secretName` and key `connectionString` (see the `secrets` property).
 
     apiVersions:
       '2025-08-01-preview':
@@ -50,8 +54,21 @@ types:
               type: string
               description: The host or namespace name used to connect to the queue. Mapped from the recipe module's output.
               readOnly: true
-            connectionString:
-              type: string
-              description: The primary connection string used to connect to the queue. Mapped from the recipe module's output.
-              readOnly: true
+            secrets:
+              type: object
+              description: >-
+                (Read-only) Recipe secrets. The reserved `name` sub-property references the managed
+                Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`;
+                the other sub-properties declare secret keys whose values are written only into that
+                managed secret (never onto this resource). Consumers bind a key into a container env var
+                via `secretKeyRef`, using `<resource>.properties.secrets.name` as `secretName`.
+              properties:
+                name:
+                  type: string
+                  readOnly: true
+                  description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`.
+                connectionString:
+                  type: string
+                  readOnly: true
+                  description: The primary connection string used to connect to the queue. Mapped from the recipe module's output; delivered via the managed secret.
           required: [environment]

deploy/manifest/built-in-providers/dev/redisCaches.yaml

@@ -47,7 +47,11 @@ types:
 
       - CONNECTION_REDIS_HOST
       - CONNECTION_REDIS_PORT
-      - CONNECTION_REDIS_URL
+
+      The `url` secret is NOT injected via the connection — it is materialized into
+      a managed `Radius.Security/secrets` resource. Bind it into a container env var
+      with a `secretKeyRef`, using `redis.properties.secrets.name` as the `secretName`
+      and key `url` (see the `secrets` property).
 
     apiVersions:
       '2025-08-01-preview':
@@ -72,9 +76,21 @@ types:
               type: integer
               description: "(Read Only) The TLS port number used to connect to the cache. Mapped from the recipe module's `port` output (Azure Managed Redis uses 10000)."
               readOnly: true
-            url:
-              type: string
-              description: "(Read Only) The full TLS connection URL (`rediss://:<access-key>@<host>:<port>`) used to connect to the cache, including the access key. Mapped from the recipe module's `primaryConnectionString` output."
-              x-radius-sensitive: true
-              readOnly: true
+            secrets:
+              type: object
+              description: >-
+                (Read-only) Recipe secrets. The reserved `name` sub-property references the managed
+                Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`;
+                the other sub-properties declare secret keys whose values are written only into that
+                managed secret (never onto this resource). Consumers bind a key into a container env var
+                via `secretKeyRef`, using `<resource>.properties.secrets.name` as `secretName`.
+              properties:
+                name:
+                  type: string
+                  readOnly: true
+                  description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`.
+                url:
+                  type: string
+                  readOnly: true
+                  description: "(Read Only) The full TLS connection URL (`rediss://:<access-key>@<host>:<port>`) used to connect to the cache, including the access key. Mapped from the recipe module's `primaryConnectionString` output; delivered via the managed secret."
           required: [environment]

deploy/manifest/built-in-providers/dev/search.yaml

@@ -46,7 +46,11 @@ types:
       example the connection name is `search` so the environment variables will be:
 
       - CONNECTION_SEARCH_ENDPOINT
-      - CONNECTION_SEARCH_APIKEY
+
+      The `apiKey` secret is NOT injected via the connection — it is materialized
+      into a managed `Radius.Security/secrets` resource. Bind it into a container
+      env var with a `secretKeyRef`, using `search.properties.secrets.name` as the
+      `secretName` and key `apiKey` (see the `secrets` property).
 
     apiVersions:
       '2025-08-01-preview':
@@ -63,8 +67,21 @@ types:
               type: string
               description: The endpoint used to connect to the search service. Mapped from the recipe module's output.
               readOnly: true
-            apiKey:
-              type: string
-              description: The admin API key used to connect to the search service. Mapped from the recipe module's output.
-              readOnly: true
+            secrets:
+              type: object
+              description: >-
+                (Read-only) Recipe secrets. The reserved `name` sub-property references the managed
+                Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`;
+                the other sub-properties declare secret keys whose values are written only into that
+                managed secret (never onto this resource). Consumers bind a key into a container env var
+                via `secretKeyRef`, using `<resource>.properties.secrets.name` as `secretName`.
+              properties:
+                name:
+                  type: string
+                  readOnly: true
+                  description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`.
+                apiKey:
+                  type: string
+                  readOnly: true
+                  description: The admin API key used to connect to the search service. Mapped from the recipe module's output; delivered via the managed secret.
           required: [environment]