Remove read-only secrets property from Radius.Messaging/rabbitMQ schema

The rabbitMQ schema exposed a read-only `secrets` object (name/password)
that surfaced the Recipe's managed fallback secret. Remove that property so
the type describes the broker password solely through the supplied
`Radius.Security/secrets` resource passed on `password`.

Update the type description, README, and test app comment to match. The
Kubernetes Recipe still generates a random password for the broker when
`password` is omitted; only the surfaced read-only property is removed.

Related to radius-project/radius#12688.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Signed-off-by: sk593 <shruthikumar@microsoft.com>

Author: sk593

Messaging/rabbitMQ/README.md

@@ -14,10 +14,9 @@ Developer documentation is embedded in the resource type definition YAML file an
 | `application` | string | Optional | The Radius Application ID. |
 | `queue` | string | Optional | The name of the queue to pre-provision on the broker. The Recipe creates this durable queue when the broker starts. Defaults to `jobs`. |
 | `username` | string | Optional | The username the broker is provisioned with. Defaults to `radius`. Avoid `guest` (loopback-only in RabbitMQ). Not sensitive; exposed as a read-only connection value. |
-| `password` | string | Optional | The resource ID of a `Radius.Security/secrets` resource containing the broker password under key `password`. If omitted, the Kubernetes Recipe generates a random password and returns it through a managed secret. |
+| `password` | string | Optional | The resource ID of a `Radius.Security/secrets` resource containing the broker password under key `password`. If omitted, the Kubernetes Recipe generates a random password for the broker. |
 | `host` | string | Read only | The host name used to connect to the broker. Set from the Recipe's Service DNS name. |
 | `port` | integer | Read only | The port used to connect to the broker over AMQP 0-9-1 (5672). Set from the Recipe's output. |
-| `secrets` | object | Read only | Managed Recipe secrets created when `password` is omitted. Use `secrets.name` as the `secretName` and `password` as the key in a container `secretKeyRef`. |
 
 ## Recipe Packs
 
@@ -30,4 +29,4 @@ Recipes for this resource type are provided through the platform Recipe Packs at
 
 ## Using the resource type
 
-Add a `rabbitMQ` resource and connect a container to it. You can provide the ID of a `Radius.Security/secrets` resource through `password`; the broker uses its materialized Kubernetes Secret directly. If you omit `password`, the Kubernetes Recipe creates broker credentials with a random fallback and Radius materializes the same value into a managed `Radius.Security/secrets` resource. Bind the supplied or generated secret with a container `secretKeyRef` using key `password`. Radius injects the queue's non-secret connection properties as `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>` variables. See [`test/app.bicep`](test/app.bicep) for a complete fallback example.
+Add a `rabbitMQ` resource and connect a container to it. Provide the ID of a `Radius.Security/secrets` resource through `password`; the broker uses its materialized Kubernetes Secret directly, and you bind the same secret into your workload with a container `secretKeyRef` using key `password`. If you omit `password`, the Kubernetes Recipe generates a random password for the broker. Radius injects the queue's non-secret connection properties as `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>` variables. See [`test/app.bicep`](test/app.bicep) for a complete example.

Messaging/rabbitMQ/rabbitMQ.yaml

@@ -11,11 +11,10 @@ types:
       that speaks AMQP 0-9-1. It allows developers to create and connect to a queue
       as part of their Radius applications.
 
-      You can provision the broker password by creating a `Radius.Security/secrets`
-      resource and passing its resource ID on the optional `password` property. If
-      omitted, the Kubernetes Recipe generates a random password and returns it
-      through the resource's managed secrets. In both cases, the password is mounted
-      into the broker via `secretKeyRef`.
+      You provide the broker password by creating a `Radius.Security/secrets`
+      resource and passing its resource ID on the optional `password` property. When
+      omitted, the Kubernetes Recipe generates a random password for the broker. The
+      password is mounted into the broker via `secretKeyRef`.
       ```bicep
       @secure()
       param password string
@@ -54,10 +53,9 @@ types:
       - CONNECTION_RABBITMQ_PORT
       - CONNECTION_RABBITMQ_USERNAME
 
-      When `password` is supplied, bind the same `Radius.Security/secrets` resource
-      into the workload. When it is omitted, bind the Recipe-generated managed
-      secret using `queue.properties.secrets.name` as the `secretName`. In both cases,
-      use key `password`.
+      To read the password from your workload, supply a `Radius.Security/secrets`
+      resource on `password` and bind that same resource into the workload with a
+      `secretKeyRef` using key `password`.
 
     apiVersions:
       '2025-08-01-preview':
@@ -80,7 +78,7 @@ types:
               description: "(Optional) The username the broker is provisioned with and that clients authenticate as. Defaults to `radius` if not provided. Avoid `guest`, which RabbitMQ restricts to loopback connections. The username is not sensitive and is exposed as a read-only connection value."
             password:
               type: string
-              description: "(Optional) The resource ID of the `Radius.Security/secrets` resource that holds the broker password under the data key `password`. Set to `<secretResource>.id`. If omitted, the Kubernetes Recipe generates a random password and returns it through the managed `secrets.password` output."
+              description: "(Optional) The resource ID of the `Radius.Security/secrets` resource that holds the broker password under the data key `password`. Set to `<secretResource>.id`. If omitted, the Kubernetes Recipe generates a random password for the broker."
             host:
               type: string
               description: (Read Only) The host name used to connect to the broker. Mapped from the recipe's Service DNS name.
@@ -89,19 +87,4 @@ types:
               type: integer
               description: (Read Only) The port used to connect to the broker over AMQP 0-9-1 (5672). Mapped from the recipe's output.
               readOnly: true
-            secrets:
-              type: object
-              description: >-
-                (Read Only) Recipe-generated secrets. The reserved `name` sub-property references
-                the managed Radius.Security/secrets resource Radius materializes from the Recipe's
-                `outputs.secrets`. Consumers bind a key into a container env var via `secretKeyRef`.
-              properties:
-                name:
-                  type: string
-                  readOnly: true
-                  description: (Read Only) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`.
-                password:
-                  type: string
-                  readOnly: true
-                  description: (Read Only) The Recipe-generated fallback password, delivered through the managed secret when the `password` input is omitted.
           required: [environment]

Messaging/rabbitMQ/test/app.bicep

@@ -16,8 +16,7 @@ resource app 'Radius.Core/applications@2025-08-01-preview' = {
 
 // The broker password is supplied via a Radius.Security/secrets resource and its ID
 // is passed on the rabbitMQ `password` property. When `password` is omitted, the
-// Recipe instead generates a random fallback and returns it through the resource's
-// own managed Radius.Security/secrets resource (queue.properties.secrets).
+// Recipe instead generates a random password for the broker.
 resource rabbitmqSecret 'Radius.Security/secrets@2025-08-01-preview' = {
   name: 'rabbitmq-credentials'
   properties: {