Make RabbitMQ password optional

.radius/app.bicep

@@ -0,0 +1,39 @@
+extension radius
+
+@description('The ID of the Radius Environment to deploy into.')
+param environment string
+
+@description('The RabbitMQ broker password.')
+@secure()
+param password string
+
+resource app 'Applications.Core/applications@2023-10-01-preview' = {
+  name: 'resource-types-contrib'
+  properties: {
+    environment: environment
+  }
+}
+
+resource rabbitmqSecret 'Radius.Security/secrets@2025-08-01-preview' = {
+  name: 'rabbitmq-credentials'
+  properties: {
+    environment: environment
+    application: app.id
+    data: {
+      password: {
+        value: password
+      }
+    }
+  }
+}
+
+resource queue 'Radius.Messaging/rabbitMQ@2025-08-01-preview' = {
+  name: 'rabbitmq'
+  properties: {
+    environment: environment
+    application: app.id
+    queue: 'jobs'
+    username: 'radius'
+    password: rabbitmqSecret.id
+  }
+}

Messaging/rabbitMQ/README.md

@@ -14,7 +14,7 @@ Developer documentation is embedded in the resource type definition YAML file an
 | `application` | string | Optional | The Radius Application ID. |
 | `queue` | string | Optional | The name of the queue to pre-provision on the broker. The Recipe creates this durable queue when the broker starts. Defaults to `jobs`. |
 | `username` | string | Optional | The username the broker is provisioned with. Defaults to `radius`. Avoid `guest` (loopback-only in RabbitMQ). Not sensitive; exposed as a read-only connection value. |
-| `password` | string | Required | The resource ID of the `Radius.Security/secrets` resource that holds the broker password under key `password` (set to `<secretResource>.id`). The Recipe mounts the password into the broker via `secretKeyRef`, so the plaintext password never lands in the pod spec or on this resource. |
+| `password` | string | Optional | The resource ID of the `Radius.Security/secrets` resource that holds the broker password under key `password` (set to `<secretResource>.id`). Recipes that use this property mount the password via `secretKeyRef`, so the plaintext password never lands in the pod spec or on this resource. |
 | `host` | string | Read only | The host name used to connect to the broker. Set from the Recipe's Service DNS name. |
 | `port` | integer | Read only | The port used to connect to the broker over AMQP 0-9-1 (5672). Set from the Recipe's output. |
 

Messaging/rabbitMQ/rabbitMQ.yaml

@@ -81,7 +81,7 @@ types:
               description: "(Optional) The username the broker is provisioned with and that clients authenticate as. Defaults to `radius` if not provided. Avoid `guest`, which RabbitMQ restricts to loopback connections. The username is not sensitive and is exposed as a read-only connection value."
             password:
               type: string
-              description: "(Required) The resource ID of the `Radius.Security/secrets` resource that holds the broker password under the data key `password`. Set to `<secretResource>.id`. The Kubernetes Recipe references the materialized Kubernetes Secret by name and mounts the password into the broker via `secretKeyRef`, so the plaintext password is never written into the pod spec or onto this resource."
+              description: "(Optional) The resource ID of the `Radius.Security/secrets` resource that holds the broker password under the data key `password`. Set to `<secretResource>.id`. Recipes that use this property reference the materialized secret without writing the plaintext password into the resource or workload specification."
             host:
               type: string
               description: (Read Only) The host name used to connect to the broker. Mapped from the recipe's Service DNS name.
@@ -90,4 +90,4 @@ types:
               type: integer
               description: (Read Only) The port used to connect to the broker over AMQP 0-9-1 (5672). Mapped from the recipe's output.
               readOnly: true
-          required: [environment, password]
+          required: [environment]