diff --git a/Data/mySqlDatabases/mySqlDatabases.yaml b/Data/mySqlDatabases/mySqlDatabases.yaml index 5d498d0b..b5522e3b 100644 --- a/Data/mySqlDatabases/mySqlDatabases.yaml +++ b/Data/mySqlDatabases/mySqlDatabases.yaml @@ -2,14 +2,16 @@ namespace: Radius.Data types: mySqlDatabases: description: | - The Radius.Data/mySqlDatabases Resource Type deploys a MySQL database. To deploy a new MySQL database, first add a secret resource with the database credentials to the application definition Bicep file, then add a mySqlDatabases resource referencing the secret name. + The Radius.Data/mySqlDatabases Resource Type deploys a MySQL database. To deploy a new MySQL database, first add a secret resource with the database credentials to the application definition Bicep file, then add a mySqlDatabases resource listing that secret in its `secrets` array. ``` resource mysql 'Radius.Data/mySqlDatabases@2025-08-01-preview' = { name: 'mysql' properties: { environment: environment application: myApplication.id - secretName: dbCredentials.name + secrets: [ + dbCredentials.id + ] } } @@ -19,11 +21,11 @@ types: environment: environment application: myApplication.id data: { - USERNAME: { + username: { value: 'admin' } - PASSWORD: { - # From password parameter passed in via CLI + password: { + // From password parameter passed in via CLI value: password } } @@ -79,9 +81,13 @@ types: database: type: string description: "(Optional) The name of the database. Defaults to `mysql_db` if not provided." - secretName: - type: string - description: "(Required) The name of the secret containing the database credentials." + secrets: + type: array + x-radius-secret-binding: true + description: "(Required) The Radius.Security/secrets resources holding the credentials this database needs. Each entry is a secret resource ID (for example `dbSecret.id`). Radius loads every key of each listed secret and exposes it to the recipe as `{{context.resource.secrets..}}`, where `` is the secret resource's name and `` is a key in its `data`." + items: + type: string + description: "The resource ID of a Radius.Security/secrets resource (for example `dbSecret.id`)." version: type: string enum: ['5.7', '8.0', '8.4'] @@ -94,4 +100,4 @@ types: type: integer description: "(Read-only) The port number used to connect to the database." readOnly: true - required: [environment,secretName] + required: [environment,secrets] diff --git a/Data/postgreSqlDatabases/postgreSqlDatabases.yaml b/Data/postgreSqlDatabases/postgreSqlDatabases.yaml index 1aa94124..2b671d2a 100644 --- a/Data/postgreSqlDatabases/postgreSqlDatabases.yaml +++ b/Data/postgreSqlDatabases/postgreSqlDatabases.yaml @@ -2,7 +2,7 @@ namespace: Radius.Data types: postgreSqlDatabases: description: | - The Radius.Data/postgreSqlDatabases Resource Type deploys a PostgreSQL database. To deploy a PostgreSQL database, first add a secret resource with the database credentials to the application definition Bicep file, then add a postgreSqlDatabases resource referencing the secret name. + The Radius.Data/postgreSqlDatabases Resource Type deploys a PostgreSQL database. Provide the administrator `username` and `password` directly on the resource. The `password` property is marked `x-radius-sensitive`, so Radius encrypts it at rest, redacts it on reads, and exposes it (decrypted) only to the recipe that provisions the database. ``` resource postgresql 'Radius.Data/postgreSqlDatabases@2025-08-01-preview' = { name: 'postgresql' @@ -10,28 +10,14 @@ types: environment: environment application: myApplication.id size: 'S' - secretName: dbCredentials.name - } - } - - resource dbCredentials 'Radius.Security/secrets@2025-08-01-preview' = { - name: 'db-creds' - properties: { - environment: environment - application: myApplication.id - data: { - username: { - value: 'admin' - } - password: { - // From password parameter passed in via CLI - value: password - } - } + database: 'appdb' + username: 'myadmin' + // From a @secure() password parameter passed in via the CLI + password: password } } ``` - + When deploying the application definition, provide the database password value as a parameter. It is recommended to use a password generator such as `openssl` or equivalent. For example, `rad deploy app.bicep -p password=$(openssl rand -hex 16)`. To connect your container to the database, create a connection from the Container resource to the database as shown below. @@ -81,9 +67,20 @@ types: type: string enum: ['S', 'M', 'L'] description: "(Optional) The size of the PostgreSQL database. Defaults to `S` if not provided." - secretName: + username: + type: string + description: "(Required) The administrator username for the PostgreSQL database. Provided directly on the resource and passed to the recipe as `{{context.resource.properties.username}}`." + password: type: string - description: "(Required) The name of the secret containing the database credentials." + x-radius-sensitive: true + description: "(Required) The administrator password for the PostgreSQL database. Marked `x-radius-sensitive`: Radius encrypts it at rest, redacts it on reads, and exposes it decrypted only to the recipe as `{{context.resource.properties.password}}`." + secrets: + type: array + x-radius-secret-binding: true + description: "(Optional, legacy) An alternative to the direct `username`/`password` properties: a list of Radius.Security/secrets resource IDs holding the credentials this database needs (for example `dbSecret.id`). Radius loads every key of each listed secret and exposes it to the recipe as `{{context.resource.secrets..}}`, where `` is the secret resource's name and `` is a key in its `data`." + items: + type: string + description: "The resource ID of a Radius.Security/secrets resource (for example `dbSecret.id`)." database: type: string description: "(Optional) The name of the database. Defaults to `postgres_db` if not provided." @@ -98,4 +95,4 @@ types: type: string description: The port number used to connect to the database. readOnly: true - required: [environment,secretName] \ No newline at end of file + required: [environment,username,password] \ No newline at end of file diff --git a/Security/secrets/secrets.yaml b/Security/secrets/secrets.yaml index 9f8151a4..47b9d0cd 100644 --- a/Security/secrets/secrets.yaml +++ b/Security/secrets/secrets.yaml @@ -77,6 +77,7 @@ types: value: type: string x-radius-sensitive: true + x-radius-retain: true description: (Required) The string value of the secret unless encoding is set to 'base64'. required: [value] required: