Narrow managed secret environment variables to phase 1

Signed-off-by: willdavsmith <willdavsmith@gmail.com>

Author: willdavsmith

AI/models/README.md

@@ -26,4 +26,4 @@ Recipes for this resource type are provided through the platform Recipe Packs at
 
 ## Using the resource type
 
-Add a `models` resource to your application and connect a container to it. One connection named `llm` injects ordinary `CONNECTION_LLM_MODEL` and `CONNECTION_LLM_ENDPOINT` values plus the secret-backed `CONNECTION_LLM_APIKEY`. No second managed-Secret connection is needed. For custom Kubernetes configuration, `model.properties.secrets.name` remains available as the `secretName` for an explicitly authored `secretKeyRef`. See [`test/app.bicep`](test/app.bicep) for a complete example.
+Add a `models` resource to your application and connect a container to it. Radius injects the model's connection properties into the container as environment variables named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>` (for example `CONNECTION_LLM_MODEL` and `CONNECTION_LLM_ENDPOINT`). The `apiKey` secret is not injected — bind it from the managed `Radius.Security/secrets` resource with a container `secretKeyRef` using `model.properties.secrets.name`. See [`test/app.bicep`](test/app.bicep) for a complete example.

AI/models/models.yaml

@@ -46,12 +46,11 @@ types:
 
       - CONNECTION_LLM_MODEL
       - CONNECTION_LLM_ENDPOINT
-      - CONNECTION_LLM_APIKEY (secret-backed)
 
-      The same connection injects `apiKey` through a Kubernetes secret reference;
-      no second managed-Secret connection is needed. For custom Kubernetes
-      configuration, use `model.properties.secrets.name` as the `secretName` and
-      `apiKey` as the key in an explicitly authored `secretKeyRef`.
+      The `apiKey` secret is NOT injected via the connection — it is materialized
+      into a managed `Radius.Security/secrets` resource. Bind it into a container
+      env var with a `secretKeyRef`, using `model.properties.secrets.name` as the
+      `secretName` and key `apiKey` (see the `secrets` property).
 
     apiVersions:
       '2025-08-01-preview':

AI/models/test/app.bicep

@@ -27,6 +27,19 @@ resource democontainer 'Radius.Compute/containers@2025-08-01-preview' = {
     containers: {
       demo: {
         image: 'ghcr.io/radius-project/samples/demo:latest'
+        // The recipe's secret output(s) are materialized into a managed
+        // Radius.Security/secrets resource and consumed here BY REFERENCE via
+        // secretKeyRef — the value never lands on model state.
+        env: {
+          MODEL_APIKEY: {
+            valueFrom: {
+              secretKeyRef: {
+                secretName: model.properties.secrets.name
+                key: 'apiKey'
+              }
+            }
+          }
+        }
         ports: {
           web: {
             containerPort: 3000
@@ -35,7 +48,6 @@ resource democontainer 'Radius.Compute/containers@2025-08-01-preview' = {
       }
     }
     connections: {
-      // Injects model/endpoint plus secret-backed CONNECTION_LLM_APIKEY.
       llm: {
         source: model.id
       }

AI/search/README.md

@@ -25,4 +25,4 @@ Recipes for this resource type are provided through the platform Recipe Packs at
 
 ## Using the resource type
 
-Add a `search` resource to your application and connect a container to it. One connection named `search` injects the ordinary `CONNECTION_SEARCH_ENDPOINT` value plus the secret-backed `CONNECTION_SEARCH_APIKEY`. No second managed-Secret connection is needed. For custom Kubernetes configuration, `search.properties.secrets.name` remains available as the `secretName` for an explicitly authored `secretKeyRef`. See [`test/app.bicep`](test/app.bicep) for a complete example.
+Add a `search` resource to your application and connect a container to it. Radius injects the search service's connection properties into the container as environment variables named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>` (for example `CONNECTION_SEARCH_ENDPOINT`). The `apiKey` secret is not injected — bind it from the managed `Radius.Security/secrets` resource with a container `secretKeyRef` using `search.properties.secrets.name`. See [`test/app.bicep`](test/app.bicep) for a complete example.

AI/search/search.yaml

@@ -46,12 +46,11 @@ types:
       example the connection name is `search` so the environment variables will be:
 
       - CONNECTION_SEARCH_ENDPOINT
-      - CONNECTION_SEARCH_APIKEY (secret-backed)
 
-      The same connection injects `apiKey` through a Kubernetes secret reference;
-      no second managed-Secret connection is needed. For custom Kubernetes
-      configuration, use `search.properties.secrets.name` as the `secretName` and
-      `apiKey` as the key in an explicitly authored `secretKeyRef`.
+      The `apiKey` secret is NOT injected via the connection — it is materialized
+      into a managed `Radius.Security/secrets` resource. Bind it into a container
+      env var with a `secretKeyRef`, using `search.properties.secrets.name` as the
+      `secretName` and key `apiKey` (see the `secrets` property).
 
     apiVersions:
       '2025-08-01-preview':

AI/search/test/app.bicep

@@ -26,6 +26,19 @@ resource democontainer 'Radius.Compute/containers@2025-08-01-preview' = {
     containers: {
       demo: {
         image: 'ghcr.io/radius-project/samples/demo:latest'
+        // The recipe's secret output(s) are materialized into a managed
+        // Radius.Security/secrets resource and consumed here BY REFERENCE via
+        // secretKeyRef — the value never lands on searchService state.
+        env: {
+          SEARCH_APIKEY: {
+            valueFrom: {
+              secretKeyRef: {
+                secretName: searchService.properties.secrets.name
+                key: 'apiKey'
+              }
+            }
+          }
+        }
         ports: {
           web: {
             containerPort: 3000
@@ -34,7 +47,6 @@ resource democontainer 'Radius.Compute/containers@2025-08-01-preview' = {
       }
     }
     connections: {
-      // Injects endpoint plus secret-backed CONNECTION_SEARCH_APIKEY.
       search: {
         source: searchService.id
       }

Compute/containers/README.md

@@ -51,11 +51,11 @@ A list of available Recipes for this Resource Type, including links to the Bicep
 
 ### Connections and secrets
 
-For ordinary connections, the Kubernetes Recipes inject `context.resource.connections.<name>.properties` as `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>` environment variables. When a producer Recipe returns secrets, Radius supplies reference metadata under `context.resource.connections.<name>.secrets`; the same connection injects each secret through a Kubernetes `secretKeyRef`. For example, Redis connection `redis` supplies its ordinary `host` and `port` values together with the secret-backed `CONNECTION_REDIS_URL`.
+For ordinary connections, the Kubernetes Recipes preserve the existing behavior of injecting scalar metadata from `context.resource.connections.<name>` and values from `context.resource.connections.<name>.properties` as `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>` environment variables. When a producer Recipe returns secrets, Radius supplies reference metadata under `context.resource.connections.<name>.secrets`; the same connection injects each secret through a Kubernetes `secretKeyRef`. For example, Redis connection `redis` supplies its ordinary `host` and `port` values together with the secret-backed `CONNECTION_REDIS_URL`.
 
 Direct connections to user-authored `Radius.Security/secrets` resources remain supported and inject one secret-backed variable per data key. Both regular and init containers receive generated variables. Explicit container environment variables take precedence, managed secret references take precedence over ordinary properties with the same generated name, and `disableDefaultEnvVars: true` disables both ordinary and secret-backed variables for that connection.
 
-Connection names, property names, and secret names are uppercased when generating environment variable names. Names that collide after uppercasing are rejected. The Kubernetes Secret name is derived from the final segment of each full Radius Secret resource ID. Secret values remain in Kubernetes references and are never copied into Recipe output or plaintext container configuration.
+Connection names, property names, and secret names are uppercased when generating environment variable names. Secret names that collide after uppercasing are rejected. Direct Secret connections now fully uppercase the generated variable name, including the data key; this intentionally replaces the previous `envFrom` behavior, which preserved the Secret data key's casing after the uppercase connection prefix. The Kubernetes Secret name is derived from the final segment of each full Radius Secret resource ID. Secret values remain in Kubernetes references and are never copied into Recipe output or plaintext container configuration.
 
 The Azure ACI Recipe is unchanged and does not consume the Kubernetes secret reference metadata described above.
 

Compute/containers/recipes/kubernetes/bicep/kubernetes-containers.bicep

@@ -41,10 +41,11 @@ var connectionDefinitions = context.resource.properties.?connections ?? {}
 
 // Properties to exclude from connection environment variables
 var excludedProperties = ['recipe', 'secrets', 'status', 'provisioningState']
+var topLevelExcludedProperties = ['recipe', 'secrets', 'status', 'provisioningState', 'properties', 'secretName']
 
 // Identify direct Radius secret connections from resolved resource metadata.
 var isSecretsResource = reduce(items(resourceConnections), {}, (acc, conn) => union(acc, {
-  '${conn.key}': string(conn.value.?type ?? '') == 'Radius.Security/secrets'
+  '${conn.key}': string(conn.value.?type ?? '') == 'Radius.Security/secrets' || (contains(connectionDefinitions, conn.key) && contains(string(connectionDefinitions[conn.key].?source ?? ''), 'Radius.Security/secrets'))
 }))
 
 // Resolved and declared connection maps can briefly differ while dependencies update.
@@ -73,12 +74,7 @@ var directSecretEnvVars = reduce(items(resourceConnections), [], (acc, conn) =>
 )
 
 // Producer Recipe secrets arrive as reference metadata, separate from ordinary properties.
-var managedSecretReferencesValid = reduce(items(resourceConnections), true, (connectionsValid, conn) =>
-  connectionsValid && reduce(items(conn.value.?secrets ?? {}), true, (secretsValid, secret) =>
-    secretsValid && secret.value.?source != null && secret.value.?key != null
-  )
-)
-var managedSecretEnvVars = managedSecretReferencesValid ? reduce(items(resourceConnections), [], (acc, conn) =>
+var managedSecretEnvVars = reduce(items(resourceConnections), [], (acc, conn) =>
   disableDefaultEnvVars[conn.key] || isSecretsResource[conn.key]
     ? acc
     : concat(
@@ -93,7 +89,7 @@ var managedSecretEnvVars = managedSecretReferencesValid ? reduce(items(resourceC
           }
         }]))
       )
-) : fail('Managed connection secret references must include source and key.')
+)
 
 var secretConnectionEnvVars = concat(directSecretEnvVars, managedSecretEnvVars)
 var secretConnectionEnvVarNames = map(secretConnectionEnvVars, envVar => envVar.name)
@@ -122,7 +118,8 @@ var secretNameEnvFrom = reduce(items(resourceConnections), [], (acc, conn) =>
         : acc
 )
 
-// Ordinary producer properties become CONNECTION_<CONNECTION_NAME>_<PROPERTY_NAME>.
+// Ordinary top-level scalar values and nested producer properties become
+// CONNECTION_<CONNECTION_NAME>_<PROPERTY_NAME>.
 // Null-valued properties are skipped: sensitive properties (e.g. a database
 // password marked x-radius-sensitive) are redacted to null on reads, and
 // string(null) fails ARM template validation with "InvalidTemplate".
@@ -131,6 +128,14 @@ var rawConnectionEnvVars = reduce(items(resourceConnections), [], (acc, conn) =>
     ? acc
     : concat(
         acc,
+        reduce(items(conn.value ?? {}), [], (envAcc, prop) =>
+          (contains(topLevelExcludedProperties, prop.key) || prop.value == null)
+            ? envAcc
+            : concat(envAcc, [{
+                name: toUpper('CONNECTION_${conn.key}_${prop.key}')
+                value: string(prop.value)
+              }])
+        ),
         reduce(items(conn.value.?properties ?? {}), [], (envAcc, prop) =>
           (prop.key == 'secretName' || contains(excludedProperties, prop.key) || prop.value == null)
             ? envAcc
@@ -141,13 +146,9 @@ var rawConnectionEnvVars = reduce(items(resourceConnections), [], (acc, conn) =>
         )
       )
 )
-var connectionEnvVarNames = map(rawConnectionEnvVars, envVar => envVar.name)
-var validatedConnectionEnvVars = length(connectionEnvVarNames) == length(union(connectionEnvVarNames, connectionEnvVarNames))
-  ? rawConnectionEnvVars
-  : fail('Connection properties must produce unique environment variable names after uppercasing.')
 
 // Managed secret references take precedence over an ordinary output with the same name.
-var connectionEnvVars = filter(validatedConnectionEnvVars, envVar => !contains(secretConnectionEnvVarNames, envVar.name))
+var connectionEnvVars = filter(rawConnectionEnvVars, envVar => !contains(secretConnectionEnvVarNames, envVar.name))
 
 // Use replicas from properties, default to 1 if not specified
 var replicaCount = resourceProperties.?replicas != null ? int(resourceProperties.replicas) : 1

Compute/containers/recipes/kubernetes/terraform/main.tf

@@ -44,11 +44,20 @@ locals {
 
   # Properties to exclude from connection environment variables
   excluded_properties = ["recipe", "secrets", "status", "provisioningState"]
+  top_level_excluded_properties = [
+    "recipe",
+    "secrets",
+    "status",
+    "provisioningState",
+    "properties",
+    "secretName",
+  ]
 
   # Identify direct Radius secret connections from resolved resource metadata.
   is_secrets_resource = {
     for conn_name, conn in local.connections :
-    conn_name => try(conn.type, "") == "Radius.Security/secrets"
+    conn_name => try(conn.type, "") == "Radius.Security/secrets" ||
+    can(regex("Radius.Security/secrets", try(local.connection_definitions[conn_name].source, "")))
   }
 
   # Direct Radius.Security/secrets connections inject every declared data key.
@@ -90,14 +99,6 @@ locals {
     ]
     : []
   ])
-  managed_secret_references_valid = alltrue(flatten([
-    for conn_name, conn in local.connections : [
-      for secret_name, secret_ref in try(conn.secrets, {}) :
-      can(tostring(secret_ref.source)) && can(tostring(secret_ref.key))
-    ]
-    if !try(local.is_secrets_resource[conn_name], false)
-  ]))
-
   secret_connection_env_vars = concat(local.direct_secret_env_vars, local.managed_secret_env_vars)
   secret_connection_env_var_names = [
     for env in local.secret_connection_env_vars : env.name
@@ -116,24 +117,31 @@ locals {
     (can(tostring(conn.secretName)) || can(tostring(conn.properties.secretName)))
   ]
 
-  # Ordinary producer properties become CONNECTION_<CONNECTION_NAME>_<PROPERTY_NAME>.
+  # Ordinary top-level scalar values and nested producer properties become
+  # CONNECTION_<CONNECTION_NAME>_<PROPERTY_NAME>.
   # Note: disableDefaultEnvVars is on connection_definitions, not the merged connections data
   raw_connection_env_vars = flatten([
     for conn_name, conn in local.connections :
     !try(local.is_secrets_resource[conn_name], false) &&
     try(local.connection_definitions[conn_name].disableDefaultEnvVars, false) != true
-    ? [
-      for prop_name, prop_value in try(conn.properties, {}) : {
-        name  = upper("CONNECTION_${conn_name}_${prop_name}")
-        value = tostring(prop_value)
-      }
-      if prop_name != "secretName" && !contains(local.excluded_properties, prop_name) && can(tostring(prop_value))
-    ]
+    ? concat(
+      [
+        for prop_name, prop_value in conn : {
+          name  = upper("CONNECTION_${conn_name}_${prop_name}")
+          value = tostring(prop_value)
+        }
+        if !contains(local.top_level_excluded_properties, prop_name) && can(tostring(prop_value))
+      ],
+      [
+        for prop_name, prop_value in try(conn.properties, {}) : {
+          name  = upper("CONNECTION_${conn_name}_${prop_name}")
+          value = tostring(prop_value)
+        }
+        if prop_name != "secretName" && !contains(local.excluded_properties, prop_name) && can(tostring(prop_value))
+      ]
+    )
     : []
   ])
-  connection_env_var_names = [
-    for env in local.raw_connection_env_vars : env.name
-  ]
 
   # Managed secret references take precedence over ordinary outputs with the same name.
   connection_env_vars = [
@@ -353,14 +361,6 @@ resource "kubernetes_deployment" "deployment" {
       condition     = length(local.secret_connection_env_var_names) == length(distinct(local.secret_connection_env_var_names))
       error_message = "Connection secret keys must produce unique environment variable names after uppercasing."
     }
-    precondition {
-      condition     = local.managed_secret_references_valid
-      error_message = "Managed connection secret references must include source and key."
-    }
-    precondition {
-      condition     = length(local.connection_env_var_names) == length(distinct(local.connection_env_var_names))
-      error_message = "Connection properties must produce unique environment variable names after uppercasing."
-    }
   }
 
   metadata {

Data/mongoDatabases/README.md

@@ -26,4 +26,4 @@ Recipes for this resource type are provided through the platform Recipe Packs at
 
 ## Using the resource type
 
-Add a `mongoDatabases` resource to your application and connect a container to it. One connection named `mongodb` injects ordinary `CONNECTION_MONGODB_DATABASE` and `CONNECTION_MONGODB_ENDPOINT` values plus the secret-backed `CONNECTION_MONGODB_CONNECTIONSTRING`. No second managed-Secret connection is needed. For custom Kubernetes configuration, `mongo.properties.secrets.name` remains available as the `secretName` for an explicitly authored `secretKeyRef`. See [`test/app.bicep`](test/app.bicep) for a complete example.
+Add a `mongoDatabases` resource to your application and connect a container to it. Radius injects the database's connection properties into the container as environment variables named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>` (for example `CONNECTION_MONGODB_DATABASE` and `CONNECTION_MONGODB_ENDPOINT`). The `connectionString` secret is not injected — bind it from the managed `Radius.Security/secrets` resource with a container `secretKeyRef` using `mongo.properties.secrets.name`. See [`test/app.bicep`](test/app.bicep) for a complete example.