From 8430cd4c4b18b76d05a924c7da4802ff1da918dd Mon Sep 17 00:00:00 2001 From: willdavsmith Date: Thu, 27 Aug 2026 18:48:04 -0700 Subject: [PATCH 1/3] Update PostgreSQL demo secret connection Signed-off-by: willdavsmith --- samples/demo/README.md | 7 +++++++ samples/demo/app-postgresql.bicep | 18 ++++++++++++++++++ samples/demo/src/db/repository.ts | 10 +++++++++- 3 files changed, 34 insertions(+), 1 deletion(-) diff --git a/samples/demo/README.md b/samples/demo/README.md index c804268c..5874e050 100644 --- a/samples/demo/README.md +++ b/samples/demo/README.md @@ -14,3 +14,10 @@ docker build \ --tag radius-demo:local \ samples/demo ``` + +## PostgreSQL variant + +`app-postgresql.bicep` uses the Kubernetes Container Recipe's direct Secret connection support to project the database password as `CONNECTION_POSTGRESQLCREDENTIALS_PASSWORD`. This requires a Radius edge installation containing the Kubernetes Recipe contract from +[`radius-project/resource-types-contrib#300`](https://github.com/radius-project/resource-types-contrib/pull/300). + +The demo image prefers that variable and retains `CONNECTION_POSTGRESQL_PASSWORD` as a compatibility fallback for older or mixed installations whose PostgreSQL Recipe still supplies the password. If both variables are present, they must match. Azure ACI does not project direct Secret connections, so this new password path is Kubernetes-only; its existing connection behavior is unchanged. diff --git a/samples/demo/app-postgresql.bicep b/samples/demo/app-postgresql.bicep index 98a29c18..b9c6ef09 100644 --- a/samples/demo/app-postgresql.bicep +++ b/samples/demo/app-postgresql.bicep @@ -37,6 +37,9 @@ resource demoContainer 'Radius.Compute/containers@2025-08-01-preview' = { postgresql: { source: postgresql.id } + postgresqlcredentials: { + source: postgresqlClientCredentials.id + } } } } @@ -52,3 +55,18 @@ resource postgresql 'Radius.Data/postgreSqlDatabases@2025-08-01-preview' = { password: password } } + +// Keep this distinct from the PostgreSQL Recipe-owned +// `postgresql-${environmentName}-credentials` Kubernetes Secret. +resource postgresqlClientCredentials 'Radius.Security/secrets@2025-08-01-preview' = { + name: 'postgresql-client-credentials-${environmentName}' + properties: { + environment: environment + application: demoApp.id + data: { + password: { + value: password + } + } + } +} diff --git a/samples/demo/src/db/repository.ts b/samples/demo/src/db/repository.ts index 6342566f..ee6e490d 100644 --- a/samples/demo/src/db/repository.ts +++ b/samples/demo/src/db/repository.ts @@ -66,11 +66,19 @@ export function createFactory(): RepositoryFactory { if (process.env.CONNECTION_POSTGRESQL_HOST) { console.log("Using PostgreSQL: found hostname in environment variable CONNECTION_POSTGRESQL_HOST"); + const secretConnectionPassword = process.env.CONNECTION_POSTGRESQLCREDENTIALS_PASSWORD; + const legacyConnectionPassword = process.env.CONNECTION_POSTGRESQL_PASSWORD; + if (secretConnectionPassword !== undefined && + legacyConnectionPassword !== undefined && + secretConnectionPassword !== legacyConnectionPassword) { + throw new Error("Conflicting PostgreSQL passwords found in CONNECTION_POSTGRESQLCREDENTIALS_PASSWORD and CONNECTION_POSTGRESQL_PASSWORD"); + } + const connection = { host: process.env.CONNECTION_POSTGRESQL_HOST!, port: process.env.CONNECTION_POSTGRESQL_PORT!, username: process.env.CONNECTION_POSTGRESQL_USERNAME || '', - password: process.env.CONNECTION_POSTGRESQL_PASSWORD || '', + password: secretConnectionPassword ?? legacyConnectionPassword ?? '', database: process.env.CONNECTION_POSTGRESQL_DATABASE || '', } const url = `postgresql://${connection.username}:${connection.password}@${connection.host}:${connection.port}/${connection.database}` From b45d2b0ed7a1019e8fb2216ab64f754fcd13034e Mon Sep 17 00:00:00 2001 From: willdavsmith Date: Thu, 27 Aug 2026 18:55:29 -0700 Subject: [PATCH 2/3] Remove PostgreSQL secret naming comment Signed-off-by: willdavsmith --- samples/demo/app-postgresql.bicep | 2 -- 1 file changed, 2 deletions(-) diff --git a/samples/demo/app-postgresql.bicep b/samples/demo/app-postgresql.bicep index b9c6ef09..6973e35a 100644 --- a/samples/demo/app-postgresql.bicep +++ b/samples/demo/app-postgresql.bicep @@ -56,8 +56,6 @@ resource postgresql 'Radius.Data/postgreSqlDatabases@2025-08-01-preview' = { } } -// Keep this distinct from the PostgreSQL Recipe-owned -// `postgresql-${environmentName}-credentials` Kubernetes Secret. resource postgresqlClientCredentials 'Radius.Security/secrets@2025-08-01-preview' = { name: 'postgresql-client-credentials-${environmentName}' properties: { From a10bb60c7c36d5d88c1a25647bb21134499efbc7 Mon Sep 17 00:00:00 2001 From: willdavsmith Date: Wed, 2 Sep 2026 13:09:48 -0700 Subject: [PATCH 3/3] Address PostgreSQL sample review feedback Signed-off-by: willdavsmith --- samples/demo/README.md | 5 ++--- samples/demo/app-postgresql.bicep | 8 ++++---- samples/demo/src/db/repository.ts | 12 ++++++------ 3 files changed, 12 insertions(+), 13 deletions(-) diff --git a/samples/demo/README.md b/samples/demo/README.md index 5874e050..5a5feab8 100644 --- a/samples/demo/README.md +++ b/samples/demo/README.md @@ -17,7 +17,6 @@ docker build \ ## PostgreSQL variant -`app-postgresql.bicep` uses the Kubernetes Container Recipe's direct Secret connection support to project the database password as `CONNECTION_POSTGRESQLCREDENTIALS_PASSWORD`. This requires a Radius edge installation containing the Kubernetes Recipe contract from -[`radius-project/resource-types-contrib#300`](https://github.com/radius-project/resource-types-contrib/pull/300). +`app-postgresql.bicep` uses the Kubernetes Container Recipe's direct Secret connection support to project the database password as `CONNECTION_POSTGRESQLCREDENTIALS_PASSWORD`. This requires Radius 0.61.0 or later, or a current edge installation. -The demo image prefers that variable and retains `CONNECTION_POSTGRESQL_PASSWORD` as a compatibility fallback for older or mixed installations whose PostgreSQL Recipe still supplies the password. If both variables are present, they must match. Azure ACI does not project direct Secret connections, so this new password path is Kubernetes-only; its existing connection behavior is unchanged. +The demo image prefers that variable and retains `CONNECTION_POSTGRESQL_PASSWORD` as a compatibility fallback for older or mixed installations whose PostgreSQL Recipe still supplies the password. If both variables are set to different values, the demo logs a warning and uses `CONNECTION_POSTGRESQLCREDENTIALS_PASSWORD`. Azure ACI does not project direct Secret connections, so this new password path is Kubernetes-only; its existing connection behavior is unchanged. diff --git a/samples/demo/app-postgresql.bicep b/samples/demo/app-postgresql.bicep index 6973e35a..868e2846 100644 --- a/samples/demo/app-postgresql.bicep +++ b/samples/demo/app-postgresql.bicep @@ -37,8 +37,8 @@ resource demoContainer 'Radius.Compute/containers@2025-08-01-preview' = { postgresql: { source: postgresql.id } - postgresqlcredentials: { - source: postgresqlClientCredentials.id + postgresqlCredentials: { + source: postgresqlCredentials.id } } } @@ -56,8 +56,8 @@ resource postgresql 'Radius.Data/postgreSqlDatabases@2025-08-01-preview' = { } } -resource postgresqlClientCredentials 'Radius.Security/secrets@2025-08-01-preview' = { - name: 'postgresql-client-credentials-${environmentName}' +resource postgresqlCredentials 'Radius.Security/secrets@2025-08-01-preview' = { + name: 'postgresql-credentials-${environmentName}' properties: { environment: environment application: demoApp.id diff --git a/samples/demo/src/db/repository.ts b/samples/demo/src/db/repository.ts index ee6e490d..f53c01dd 100644 --- a/samples/demo/src/db/repository.ts +++ b/samples/demo/src/db/repository.ts @@ -66,19 +66,19 @@ export function createFactory(): RepositoryFactory { if (process.env.CONNECTION_POSTGRESQL_HOST) { console.log("Using PostgreSQL: found hostname in environment variable CONNECTION_POSTGRESQL_HOST"); - const secretConnectionPassword = process.env.CONNECTION_POSTGRESQLCREDENTIALS_PASSWORD; - const legacyConnectionPassword = process.env.CONNECTION_POSTGRESQL_PASSWORD; - if (secretConnectionPassword !== undefined && - legacyConnectionPassword !== undefined && + const secretConnectionPassword = process.env.CONNECTION_POSTGRESQLCREDENTIALS_PASSWORD || undefined; + const legacyConnectionPassword = process.env.CONNECTION_POSTGRESQL_PASSWORD || undefined; + if (secretConnectionPassword && + legacyConnectionPassword && secretConnectionPassword !== legacyConnectionPassword) { - throw new Error("Conflicting PostgreSQL passwords found in CONNECTION_POSTGRESQLCREDENTIALS_PASSWORD and CONNECTION_POSTGRESQL_PASSWORD"); + console.warn("Conflicting PostgreSQL passwords found; using CONNECTION_POSTGRESQLCREDENTIALS_PASSWORD instead of CONNECTION_POSTGRESQL_PASSWORD"); } const connection = { host: process.env.CONNECTION_POSTGRESQL_HOST!, port: process.env.CONNECTION_POSTGRESQL_PORT!, username: process.env.CONNECTION_POSTGRESQL_USERNAME || '', - password: secretConnectionPassword ?? legacyConnectionPassword ?? '', + password: secretConnectionPassword || legacyConnectionPassword || '', database: process.env.CONNECTION_POSTGRESQL_DATABASE || '', } const url = `postgresql://${connection.username}:${connection.password}@${connection.host}:${connection.port}/${connection.database}`