Summary

A resource type schema can declare a default for a property, and Radius never applied it. schema.ApplyDefaults fills absent properties from the default declared in the schema, and a new UpdateFilter on the dynamic resource PUT path runs it before the resource is saved.

Explicit values are never overwritten, and required properties are never defaulted, so leaving one out still fails validation instead of being quietly satisfied.

Reason for change

Fixes #12532

Deploying a resource without setting an optional property puts a literal template expression into the ARM request. The Azure recipe pack writes parameters as expressions over the resource:

skuName: '{{context.resource.properties.size == "S" ? "Balanced_B0" : "Balanced_B1"}}'

Leave size unset and there's nothing to substitute, so the raw {{...}} string is handed to ARM as the SKU name and rejected against allowedValues.

The cause sits a level below the recipe. Validation checked a resource against its schema without filling anything in, so every default: key in every resource type has been inert — including the ones objectStorage, mongoDatabases, models, kafka and rabbitMQ already declare.

With the defaults from radius-project/resource-types-contrib#260 declared, the existing recipe expressions resolve on their own, and neither the resolver nor the recipe pack needs to change. That covers ten optional properties across the Azure pack, not just size:

Six of those defaults already existed, so half the fix is Radius finally reading what contrib already wrote down.

Two things reviewers should know. The filter sits ahead of the encryption filter, so a defaulted sensitive field is still encrypted. And defaults are reapplied on every write rather than carried forward from the previous version of the resource, which is what full-replace PUT semantics ask for — the consequence is that changing a declared default later changes what an existing resource gets on its next deployment, so a default is part of a resource type's API contract.

How to test

go test ./pkg/schema/... ./pkg/dynamicrp/... covers the new code directly. pkg/schema/defaults_test.go asserts that explicit values survive, required properties are never defaulted, read-only properties are skipped, absent nested objects aren't created, and map and slice defaults are deep copied so one resource can't mutate what the next one sees.

End to end, all ten optional properties above were run through ApplyDefaults and the parameter resolver against the real contrib schemas and the real recipepack/azure/aks-recipepack.bicep expressions. Every one emits a literal {{...}} without defaults and resolves to the value in the table with them, on the unmodified resolver and the unmodified recipe expressions.

go vet and gofmt are clean, and pkg/schema/..., pkg/dynamicrp/..., pkg/recipes/..., pkg/cli/manifest/... and pkg/ucp/integrationtests/resourceproviders/... all pass, including after rebasing onto the kin-openapi 0.144.0 bump in #12561.

Built-in resource types pick this up once radius-project/resource-types-contrib#260 merges and make update-resource-types bumps the pin in go.mod, since the manifests under deploy/manifest/built-in-providers are copies CI regenerates from it.

File change summary