Resolve ${connection:<key>.<prop>} sentinels in container env values

[willdavsmith]

What

Teaches the Kubernetes Radius.Compute/containers recipe to resolve ${connection:<key>.<prop>} sentinels placed in a container env value. A new connectionTokens table is built from the same decrypted resourceConnections (and the same exclusions) as the existing connectionEnvVars, then each env value is passed through a reduce(... replace ...) that substitutes any sentinel with the connected resource's real property value. Both top-level connection properties and the nested properties bag are covered.

env: {
  API_KEY: { value: '${connection:provider.apiKey}' }
}

Why

Today an application can only receive connected-resource properties under the fixed CONNECTION_<KEY>_<PROP> names. Apps that expect a specific env var name (e.g. a third-party image) otherwise need a per-app startup shim or a custom image to remap the value. The sentinel lets the app author name the target env var directly and pull any single property — including a sensitive property that is delivered decrypted through connection injection — with no shim and no custom image.

Backward compatibility

• Env values with no sentinel pass through unchanged.
• Secrets-resource connections and disableDefaultEnvVars are skipped exactly as for the default connection env vars.

Dependency

The sensitive-value path relies on the connection being delivered decrypted at runtime, which comes from radius-project/radius#12286 (connection-injection decrypt + x-radius-retain). Non-sensitive properties resolve on radius main today; sensitive ones require #12286. Marking this draft until #12286 lands.

Verification

Proven end-to-end by a cloud-free kind-only test in resource-types-verification: a synthetic connected resource exposes a non-sensitive canary and a sensitive (x-radius-sensitive + x-radius-retain) canary; a busybox container consumes both via sentinels. The resolved Deployment-spec env showed the plain canary and the sensitive canary delivered decrypted:

PASS: plain sentinel resolved to the connection value
PASS: sensitive sentinel resolved to the DECRYPTED connection value

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None