Demonstrate Redis connection secret variables - #2650
Closed
willdavsmith wants to merge 4 commits into
Closed
Conversation
Signed-off-by: willdavsmith <willdavsmith@gmail.com>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
Signed-off-by: willdavsmith <willdavsmith@gmail.com>
Signed-off-by: willdavsmith <willdavsmith@gmail.com>
Signed-off-by: willdavsmith <willdavsmith@gmail.com>
willdavsmith
changed the title
willdavsmith
changed the title
willdavsmith
changed the title
pull Bot
pushed a commit
to TheTechOddBug/radius
that referenced
this pull request
Aug 24, 2026
## Summary Enables one connection to a Recipe-backed producer to carry both ordinary values and non-sensitive managed Secret references. This PR and radius-project/resource-types-contrib#300 together enable the complete Kubernetes behavior. Either side safely tolerates the other being absent, but producer-managed secret variables are available only after both are deployed. - Materializes Recipe secret outputs into the existing managed `Radius.Security/secrets` resource. - Keeps the managed Secret as the source of truth instead of persisting duplicate reference metadata on the producer. - Resolves the producer's `properties.secrets.name`, reads only the backing Secret's stored `properties.data` keys, and derives `{source,key}` references while constructing connection context. Secret values are not decrypted or exposed. - Exposes references to consuming Recipes as `context.resource.connections.<name>.secrets.<key>`. - Keeps ordinary properties under `connections.<name>.properties`. - Preserves the public `properties.secrets.name` contract; no `properties.secrets.id` is added. - Reclaims the deterministically named managed Secret during output shrinkage, schema removal, empty output, and deletion. ## Scope exclusions - No generic `{{context.resource.connections.*.secrets.*}}` parameter interpolation. - No catalog-wide schema/example migration. - No sample or agent-guidance changes. - No ACI behavior change. - No functional fixture that depends on the unmerged Container Recipe from contrib #300; coordinated end-to-end coverage belongs in resource-types-verification after both changes are available. ## Validation - Targeted Go tests for dynamic-resource processing, backing-Secret reference resolution, malformed and missing backing Secrets, public API conversion, connected-resource enrichment, Recipe context serialization, and lifecycle behavior. - Architecture Markdown checks. - An isolated manual kind deployment previously confirmed one Redis connection generated ordinary host/port variables and secret-backed `CONNECTION_REDIS_URL`, with no plaintext in the producer or Deployment, API redaction, runtime Redis connectivity, Todo CRUD, direct authored-Secret projection, and managed Secret cascade deletion. ## Related PRs - Container Recipe support: radius-project/resource-types-contrib#300 - Sample adoption: radius-project/samples#2650 - Released-stack verification: radius-project/resource-types-verification#41 --------- Signed-off-by: willdavsmith <willdavsmith@gmail.com> Copilot-Session: 3f464dd8-0c43-447b-b5a6-5d4b078b69bc
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
redisconnection whose source isredis.idCONNECTION_REDIS_HOSTandCONNECTION_REDIS_PORTas normal environment values from that connectionCONNECTION_REDIS_URLas a secret-backed environment value injected through KubernetessecretKeyRefCONNECTION_REDIS_URL, removing legacy URL and host/port construction fallbacksDependencies
Depends on radius-project/radius#12709 and radius-project/resource-types-contrib#300. This PR demonstrates the runtime capability but does not implement it.
Validation
bicep format samples/demo/app-redis.bicepbicep build samples/demo/app-redis.bicep --stdoutnpm --prefix samples/demo run build.github/workflows/test.yamlgit diff --checkNotes
The existing native Kubernetes
secretKeyRefsamples continue to use<producer>.properties.secrets.name; this PR does not change those consumers.