Adopt the recipe secret-output pattern for secret-bearing resource types (#226)

## Summary

Adopts the recipe **secret-output** pattern for the seven secret-bearing
resource types, so their recipe-generated secrets are no longer stored
on the owning resource.

Today these types expose their secret (connection string / URL / API key
/ account key) as a **plain read-only property**, which is written onto
the resource and surfaced on reads, in logs, and in the application
graph. This PR moves each secret into a managed
`Radius.Security/secrets` resource and exposes only a read-only
reference on the owner.

## What changed (per type)

For **kafka, rabbitMQ, mongoDatabases, redisCaches, models, search,
objectStorage**:

- **Type schema (`<type>.yaml`)** — replace the plain secret property
with a single read-only `secrets` block: a reserved `name` sub-property
(the reference to the managed secret) plus the secret key(s). The block
is intentionally **not** marked `readOnly` (forward-compat for future
secret *inputs*); each sub-property's own `readOnly` flag is the
output/input discriminator. Descriptions updated to consume the secret
via `secretKeyRef`.
- **Recipe pack (`recipepack/azure/aks-recipepack.bicep`)** — nest the
secret module outputs under `outputs.secrets`. Also adds the
`objectStorage` `connectionString` mapping (declared on the type but
previously missing from the pack).
- **`test/app.bicep`** — bind the secret into a container env var via
`valueFrom.secretKeyRef` using `<resource>.properties.secrets.name`.
- **README** — reflect the `secrets` reference + `secretKeyRef`
consumption.

| Type | Secret key(s) | Non-secret (still connection-injected) |
|---|---|---|
| Messaging/kafka | `connectionString` | `host` |
| Messaging/rabbitMQ | `connectionString` | `host` |
| Data/mongoDatabases | `connectionString` | `endpoint` |
| Data/redisCaches | `url` | `host`, `port` |
| AI/models | `apiKey` | `endpoint` |
| AI/search | `apiKey` | `endpoint` |
| Storage/objectStorage | `connectionString`, `accountKey` | `endpoint`,
`accountName` |

## Decisions

- **Secret key names preserved** — redis keeps `url`, storage keeps
`accountKey`. This is a secret-handling *mechanism* change, not a
rename, so existing consumers of the key names are unaffected (the value
now arrives via the managed secret instead of a resource property).
- **SQL types out of scope** — `mySqlDatabases`, `postgreSqlDatabases`,
`sqlServerDatabases` use secret *inputs*, not outputs, and are
unchanged.
- **Testing/CI stays in `resource-types-verification`** — this PR only
updates the type definitions, recipe pack, and `test/app.bicep`; no CI
workflows are moved here.

## Dependency

Requires the engine support in **radius-project/radius#12344** (fold the
secret reference into the `secrets` block as `secrets.name`; read recipe
secret mappings from nested `outputs.secrets`). The
`validate-resource-types` CI runs against `rad edge`, so it will not go
green until #12344 is merged and released to `edge`. The same pattern is
validated end-to-end on real Azure across all seven types in
`resource-types-verification` (7 base + 7 app workflows green).

Kept as a **draft** pending the engine release.

Signed-off-by: willdavsmith <willdavsmith@gmail.com>

Author: willdavsmith

AI/models/README.md

@@ -14,7 +14,7 @@ Developer documentation is embedded in the resource type definition YAML file an
 | `application` | string | Optional | The Radius Application ID. |
 | `model` | string | Optional | The model deployment to provision. Defaults to `gpt-5-mini`. |
 | `endpoint` | string | Read only | The base URL used to call the model inference endpoint. Set from the Recipe module's output. |
-| `apiKey` | string | Read only | The API key used to call the model inference endpoint. Set from the Recipe module's output. |
+| `secrets` | object | Read only | Recipe secrets. `secrets.name` references the managed `Radius.Security/secrets` resource; `secrets.apiKey` is the secret key (delivered via that managed secret, never stored on the resource). |
 
 ## Recipe Packs
 
@@ -26,4 +26,4 @@ Recipes for this resource type are provided through the platform Recipe Packs at
 
 ## Using the resource type
 
-Add a `models` resource to your application and connect a container to it. Radius injects the model's connection properties into the container as environment variables named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>` (for example `CONNECTION_LLM_MODEL`, `CONNECTION_LLM_ENDPOINT`, and `CONNECTION_LLM_APIKEY`). See [`test/app.bicep`](test/app.bicep) for a complete example.
+Add a `models` resource to your application and connect a container to it. Radius injects the model's connection properties into the container as environment variables named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>` (for example `CONNECTION_LLM_MODEL` and `CONNECTION_LLM_ENDPOINT`). The `apiKey` secret is not injected — bind it from the managed `Radius.Security/secrets` resource with a container `secretKeyRef` using `model.properties.secrets.name`. See [`test/app.bicep`](test/app.bicep) for a complete example.

AI/models/models.yaml

@@ -46,7 +46,11 @@ types:
 
       - CONNECTION_LLM_MODEL
       - CONNECTION_LLM_ENDPOINT
-      - CONNECTION_LLM_APIKEY
+
+      The `apiKey` secret is NOT injected via the connection — it is materialized
+      into a managed `Radius.Security/secrets` resource. Bind it into a container
+      env var with a `secretKeyRef`, using `model.properties.secrets.name` as the
+      `secretName` and key `apiKey` (see the `secrets` property).
 
     apiVersions:
       '2025-08-01-preview':
@@ -67,8 +71,21 @@ types:
               type: string
               description: "(Read Only) The base URL used to call the model inference endpoint. Mapped from the recipe module's output."
               readOnly: true
-            apiKey:
-              type: string
-              description: "(Read Only) The API key used to call the model inference endpoint. Mapped from the recipe module's `primaryKey` output."
-              readOnly: true
+            secrets:
+              type: object
+              description: >-
+                (Read-only) Recipe secrets. The reserved `name` sub-property references the managed
+                Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`;
+                the other sub-properties declare secret keys whose values are written only into that
+                managed secret (never onto this resource). Consumers bind a key into a container env var
+                via `secretKeyRef`, using `<resource>.properties.secrets.name` as `secretName`.
+              properties:
+                name:
+                  type: string
+                  readOnly: true
+                  description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`.
+                apiKey:
+                  type: string
+                  readOnly: true
+                  description: "(Read Only) The API key used to call the model inference endpoint. Mapped from the recipe module's `primaryKey` output; delivered via the managed secret."
           required: [environment]

AI/models/test/app.bicep

@@ -27,6 +27,19 @@ resource democontainer 'Radius.Compute/containers@2025-08-01-preview' = {
     containers: {
       demo: {
         image: 'ghcr.io/radius-project/samples/demo:latest'
+        // The recipe's secret output(s) are materialized into a managed
+        // Radius.Security/secrets resource and consumed here BY REFERENCE via
+        // secretKeyRef — the value never lands on model state.
+        env: {
+          MODEL_APIKEY: {
+            valueFrom: {
+              secretKeyRef: {
+                secretName: model.properties.secrets.name
+                key: 'apiKey'
+              }
+            }
+          }
+        }
         ports: {
           web: {
             containerPort: 3000

AI/search/README.md

@@ -13,7 +13,7 @@ Developer documentation is embedded in the resource type definition YAML file an
 | `environment` | string | Required | The Radius Environment ID. Typically set by the `rad` CLI. |
 | `application` | string | Optional | The Radius Application ID. |
 | `endpoint` | string | Read only | The endpoint used to connect to the search service. Set from the Recipe module's output. |
-| `apiKey` | string | Read only | The admin API key used to connect to the search service. Set from the Recipe module's output. |
+| `secrets` | object | Read only | Recipe secrets. `secrets.name` references the managed `Radius.Security/secrets` resource; `secrets.apiKey` is the secret key (delivered via that managed secret, never stored on the resource). |
 
 ## Recipe Packs
 
@@ -25,4 +25,4 @@ Recipes for this resource type are provided through the platform Recipe Packs at
 
 ## Using the resource type
 
-Add a `search` resource to your application and connect a container to it. Radius injects the search service's connection properties into the container as environment variables named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>` (for example `CONNECTION_SEARCH_ENDPOINT` and `CONNECTION_SEARCH_APIKEY`). See [`test/app.bicep`](test/app.bicep) for a complete example.
+Add a `search` resource to your application and connect a container to it. Radius injects the search service's connection properties into the container as environment variables named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>` (for example `CONNECTION_SEARCH_ENDPOINT`). The `apiKey` secret is not injected — bind it from the managed `Radius.Security/secrets` resource with a container `secretKeyRef` using `search.properties.secrets.name`. See [`test/app.bicep`](test/app.bicep) for a complete example.

AI/search/search.yaml

@@ -46,7 +46,11 @@ types:
       example the connection name is `search` so the environment variables will be:
 
       - CONNECTION_SEARCH_ENDPOINT
-      - CONNECTION_SEARCH_APIKEY
+
+      The `apiKey` secret is NOT injected via the connection — it is materialized
+      into a managed `Radius.Security/secrets` resource. Bind it into a container
+      env var with a `secretKeyRef`, using `search.properties.secrets.name` as the
+      `secretName` and key `apiKey` (see the `secrets` property).
 
     apiVersions:
       '2025-08-01-preview':
@@ -63,8 +67,21 @@ types:
               type: string
               description: The endpoint used to connect to the search service. Mapped from the recipe module's output.
               readOnly: true
-            apiKey:
-              type: string
-              description: The admin API key used to connect to the search service. Mapped from the recipe module's output.
-              readOnly: true
+            secrets:
+              type: object
+              description: >-
+                (Read-only) Recipe secrets. The reserved `name` sub-property references the managed
+                Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`;
+                the other sub-properties declare secret keys whose values are written only into that
+                managed secret (never onto this resource). Consumers bind a key into a container env var
+                via `secretKeyRef`, using `<resource>.properties.secrets.name` as `secretName`.
+              properties:
+                name:
+                  type: string
+                  readOnly: true
+                  description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`.
+                apiKey:
+                  type: string
+                  readOnly: true
+                  description: The admin API key used to connect to the search service. Mapped from the recipe module's output; delivered via the managed secret.
           required: [environment]

AI/search/test/app.bicep

@@ -26,6 +26,19 @@ resource democontainer 'Radius.Compute/containers@2025-08-01-preview' = {
     containers: {
       demo: {
         image: 'ghcr.io/radius-project/samples/demo:latest'
+        // The recipe's secret output(s) are materialized into a managed
+        // Radius.Security/secrets resource and consumed here BY REFERENCE via
+        // secretKeyRef — the value never lands on searchService state.
+        env: {
+          SEARCH_APIKEY: {
+            valueFrom: {
+              secretKeyRef: {
+                secretName: searchService.properties.secrets.name
+                key: 'apiKey'
+              }
+            }
+          }
+        }
         ports: {
           web: {
             containerPort: 3000

Data/mongoDatabases/README.md

@@ -14,7 +14,7 @@ Developer documentation is embedded in the resource type definition YAML file an
 | `application` | string | Optional | The Radius Application ID. |
 | `database` | string | Optional | The Mongo database name. Defaults to `mongo_db`. |
 | `endpoint` | string | Read only | The endpoint used to connect to the database. Set from the Recipe module's output. |
-| `connectionString` | string | Read only | The connection string used to connect to the database. Set from the Recipe module's output. |
+| `secrets` | object | Read only | Recipe secrets. `secrets.name` references the managed `Radius.Security/secrets` resource; `secrets.connectionString` is the secret key (delivered via that managed secret, never stored on the resource). |
 
 ## Recipe Packs
 
@@ -26,4 +26,4 @@ Recipes for this resource type are provided through the platform Recipe Packs at
 
 ## Using the resource type
 
-Add a `mongoDatabases` resource to your application and connect a container to it. Radius injects the database's connection properties into the container as environment variables named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>` (for example `CONNECTION_MONGODB_DATABASE`, `CONNECTION_MONGODB_ENDPOINT`, and `CONNECTION_MONGODB_CONNECTIONSTRING`). See [`test/app.bicep`](test/app.bicep) for a complete example.
+Add a `mongoDatabases` resource to your application and connect a container to it. Radius injects the database's connection properties into the container as environment variables named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>` (for example `CONNECTION_MONGODB_DATABASE` and `CONNECTION_MONGODB_ENDPOINT`). The `connectionString` secret is not injected — bind it from the managed `Radius.Security/secrets` resource with a container `secretKeyRef` using `mongo.properties.secrets.name`. See [`test/app.bicep`](test/app.bicep) for a complete example.

Data/mongoDatabases/mongoDatabases.yaml

@@ -45,7 +45,11 @@ types:
 
       - CONNECTION_MONGO_DATABASE
       - CONNECTION_MONGO_ENDPOINT
-      - CONNECTION_MONGO_CONNECTIONSTRING
+
+      The `connectionString` secret is NOT injected via the connection — it is
+      materialized into a managed `Radius.Security/secrets` resource. Bind it into
+      a container env var with a `secretKeyRef`, using `mongo.properties.secrets.name`
+      as the `secretName` and key `connectionString` (see the `secrets` property).
 
       Portability note: this schema is platform-neutral so the same resource
       type works with Azure AVM, AWS Terraform modules, and Kubernetes recipes.
@@ -71,8 +75,21 @@ types:
               type: string
               description: The endpoint used to connect to the database. Mapped from the recipe module's output.
               readOnly: true
-            connectionString:
-              type: string
-              description: The connection string used to connect to the database. Mapped from the recipe module's output.
-              readOnly: true
+            secrets:
+              type: object
+              description: >-
+                (Read-only) Recipe secrets. The reserved `name` sub-property references the managed
+                Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`;
+                the other sub-properties declare secret keys whose values are written only into that
+                managed secret (never onto this resource). Consumers bind a key into a container env var
+                via `secretKeyRef`, using `<resource>.properties.secrets.name` as `secretName`.
+              properties:
+                name:
+                  type: string
+                  readOnly: true
+                  description: (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`.
+                connectionString:
+                  type: string
+                  readOnly: true
+                  description: The connection string used to connect to the database. Mapped from the recipe module's output; delivered via the managed secret.
           required: [environment]

Data/mongoDatabases/test/app.bicep

@@ -29,6 +29,19 @@ resource democontainer 'Radius.Compute/containers@2025-08-01-preview' = {
     containers: {
       demo: {
         image: 'ghcr.io/radius-project/samples/demo:latest'
+        // The recipe's secret output(s) are materialized into a managed
+        // Radius.Security/secrets resource and consumed here BY REFERENCE via
+        // secretKeyRef — the value never lands on mongo state.
+        env: {
+          MONGODB_CONNECTIONSTRING: {
+            valueFrom: {
+              secretKeyRef: {
+                secretName: mongo.properties.secrets.name
+                key: 'connectionString'
+              }
+            }
+          }
+        }
         ports: {
           web: {
             containerPort: 3000

Data/redisCaches/README.md

@@ -15,7 +15,7 @@ Developer documentation is embedded in the resource type definition YAML file an
 | `size` | string (`S`, `M`, `L`) | Optional | The size of the Redis cache. Defaults to `S`. The Recipe maps the size onto a concrete cloud SKU. |
 | `host` | string | Read only | The host name used to connect to the cache. Set from the Recipe module's output. |
 | `port` | integer | Read only | The TLS port number used to connect to the cache. Set from the Recipe module's output. |
-| `url` | string | Read only | The full TLS connection URL (`rediss://:<access-key>@<host>:<port>`), including the access key. Set from the Recipe module's output. |
+| `secrets` | object | Read only | Recipe secrets. `secrets.name` references the managed `Radius.Security/secrets` resource; `secrets.url` is the secret key (delivered via that managed secret, never stored on the resource). |
 
 ## Recipe Packs
 
@@ -27,4 +27,4 @@ Recipes for this resource type are provided through the platform Recipe Packs at
 
 ## Using the resource type
 
-Add a `redisCaches` resource to your application and connect a container to it. Radius injects the cache's connection properties into the container as environment variables named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>` (for example `CONNECTION_REDIS_HOST`, `CONNECTION_REDIS_PORT`, and `CONNECTION_REDIS_URL`). See [`test/app.bicep`](test/app.bicep) for a complete example.
+Add a `redisCaches` resource to your application and connect a container to it. Radius injects the cache's connection properties into the container as environment variables named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>` (for example `CONNECTION_REDIS_HOST` and `CONNECTION_REDIS_PORT`). The `url` secret is not injected — bind it from the managed `Radius.Security/secrets` resource with a container `secretKeyRef` using `redis.properties.secrets.name`. See [`test/app.bicep`](test/app.bicep) for a complete example.