feat(demo): add private registries recipes#12080
feat(demo): add private registries recipes#12080DariuszPorowski with Copilot wants to merge 12 commits into
Conversation
|
|
||
| // SecretStore holding the username/password used to authenticate to the private | ||
| // OCI registry. For BasicAuth the secret store must expose 'username' and 'password'. | ||
| resource registrySecret 'Applications.Core/secretStores@2023-10-01-preview' = { |
There was a problem hiding this comment.
can you use the new Radius.Security/secretStores resource type instead?
It still won't work for these registry-auth secrets, and I confirmed it at the HTTP level. The secret loader builds the request URL with the type hardcoded: ( It only substitutes
|
14e8cdb to
891c958
Compare
Yes - PR #12181 ("Refactor recipe settings resources to match the feature spec and support Radius.Security/secrets", fixes #12122) directly removes the blocker I described. It makes the recipe secret loader parse the referenced secret ID and dispatch on type instead of hardcoding the Two things to note so the migration is done correctly when it lands - it's more than a type-string swap:
The migrated shape (from that PR's resource registryToken 'Radius.Security/secrets@2025-08-01-preview' = {
name: 'tfsec-registry-token'
properties: {
environment: secretsEnvironment
data: { token: { value: '...' } }
}
}
resource tfConfig 'Radius.Core/terraformSettings@2025-08-01-preview' = {
name: 'tfsec-terraform-config'
properties: {
terraformrc: { credentials: { 'app.terraform.io': { secret: registryToken.id } } }
}
}Status: #12181 is still open and not merged (currently shows merge conflicts with |
…ig resource types
Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
…equired by recipe config loader)
891c958 to
543c8f2
Compare
…Radius.Security/secrets (PR #12303) Co-authored-by: DariuszPorowski <3431813+DariuszPorowski@users.noreply.github.com>
Radius functional test overviewClick here to see the test run details
Test Status⌛ Building Radius and pushing container images for functional tests... |
There was a problem hiding this comment.
Pull request overview
This PR enhances the docs/demos/private-registries-recipes demo so it can be run end-to-end: it adds a prerequisites guide, introduces cross-platform E2E runner scripts, and updates the demo Bicep templates to use the newer Radius.Core/* resource types and Radius.Security/secrets for credentials.
Changes:
- Added a provider-agnostic prerequisites walkthrough for standing up private OCI (Bicep) and Terraform registries.
- Added Bash + PowerShell E2E runner scripts to automate publish/deploy/verify/cleanup across scenarios.
- Updated demo Bicep templates and README to reflect
Radius.Core/*Settingsresources andRadius.Security/secrets.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| docs/demos/private-registries-recipes/scripts/run-e2e.sh | Bash E2E runner for scenario orchestration (group/namespace setup, publish, deploy, verify, cleanup). |
| docs/demos/private-registries-recipes/scripts/run-e2e.ps1 | PowerShell (pwsh) E2E runner equivalent to the Bash runner. |
| docs/demos/private-registries-recipes/recipes/redis-recipe.bicep | Sample Kubernetes recipe to publish to a private OCI registry for Scenario 1. |
| docs/demos/private-registries-recipes/README.md | Full manual walkthrough plus runner documentation and updated resource-type guidance. |
| docs/demos/private-registries-recipes/PREREQUISITES.md | New high-level prerequisites guide to provision/obtain required private registries and credentials. |
| docs/demos/private-registries-recipes/bicep/bicep-private-registry.bicep | Scenario 1 template wiring Radius.Core/bicepSettings + Radius.Security/secrets. |
| docs/demos/private-registries-recipes/bicep/terraform-private-registry.bicep | Scenario 2 template wiring Radius.Core/terraformSettings + Radius.Security/secrets. |
| docs/demos/private-registries-recipes/bicep/combined.bicep | Scenario 3 template wiring both settings resources into a single environment. |
| setup_group() { | ||
| # Group may already exist; suppress only the duplicate notice on stdout | ||
| # while letting real errors surface. 'rad group switch' below validates it. | ||
| rad group create "${RAD_GROUP}" >/dev/null || true | ||
| rad group switch "${RAD_GROUP}" | ||
| } |
| function Initialize-Group { | ||
| # Group may already exist; allow that but let 'rad group switch' validate. | ||
| rad group create $RadGroup | Out-Null | ||
| rad group switch $RadGroup | ||
| } |
Description
The
private-registries-recipesdemo assumed a private registry already existed and never explained how to stand one up or run the walkthrough end-to-end. This adds a prerequisites guide, cross-platform runner scripts, accuracy touch-ups, and resource-type updates to the demo Bicep templates.PREREQUISITES.md(new): provider-agnostic setup mapped to the env vars the demo and runner consume.BICEP_REGISTRY/BICEP_RECIPE/BICEP_REGISTRY_USERNAME/BICEP_REGISTRY_PASSWORD).TF_REGISTRY_HOST/TF_RECIPE_LOCATION/TF_REGISTRY_TOKEN); HCP Terraform (cloud) and self-hosted OSS (Terralist) examples.scripts/run-e2e.{sh,ps1}(new): cross-platform (Bash +pwsh7+) runner automating group/namespace setup, recipe publish, deploy, verify, and--cleanupper scenario (bicep/terraform/combined/all); secrets read from env vars.Radius.Core/applications@2025-08-01-preview(onlyenvironmentrequired; validated againsttypespec/Radius.Core/applications.tsp).Applications.Core/secretStores@2023-10-01-preview. The new config resources require this:bicepConfigs.basicAuthSecretIdandterraformConfigs.credentials[].secretare typed asApplications.Core/SecretStoreIDs, and the recipe config loader resolves them with the v2023-10-01-preview SecretStores client (pkg/recipes/configloader/secrets.go).Radius.Security/secretStoresis not a registered type (theRadius.Securitynamespace only definessecrets), so it would not deploy or resolve.plainHttp: trueon therecipePacksrecipe entry (demo otherwise targets HTTPS).dynamic-rpforRadius.Core(this demo),applications-rpfor legacyApplications.Core- and show bothkubectl logscommands.README.md: linked the new doc and runner from the Prerequisites section and files table.Documentation- and script-only; no Radius functionality changes.
Type of change
Contributor checklist
Please verify that the PR meets the following requirements, where applicable:
eng/design-notes/in this repository, if new APIs are being introduced.