Recipe result object

A recipe returns data to Radius through a special output named result. After a recipe provisions its infrastructure, the result object carries the values, secrets, and resource IDs that Radius records on the resource that called the recipe. Radius surfaces those values to the resource and to any resources that connect to it, stores secrets securely, and tracks the returned resource IDs so it can manage their lifecycle. A recipe returns it from an output result object in Bicep or an output "result" in Terraform. For more information, visit the recipe authoring how-to guide.

Usage

• Terraform
• Bicep

variable "context" {
  description = "Radius-provided object containing information about the resource calling the recipe"
  type        = any
}

locals {
  namespace = var.context.runtime.kubernetes.namespace
}

# ... deploy your infrastructure here ...

output "result" {
  # Mark the output sensitive because values and secrets are combined into one object.
  sensitive = true
  value = {
    # Resource IDs that Radius should track as part of this resource's lifecycle.
    resources = [
      "/planes/kubernetes/local/namespaces/${local.namespace}/providers/core/Service/${kubernetes_service.redis.metadata[0].name}"
    ]
    # Non-sensitive values surfaced to the resource and its connections.
    values = {
      host = "${kubernetes_service.redis.metadata[0].name}.${local.namespace}.svc.cluster.local"
      port = 6379
    }
    # Sensitive values stored securely as secrets.
    secrets = {
      password = random_password.password.result
    }
  }
}

@description('Radius-provided object containing information about the resource calling the recipe')
param context object

// ... deploy your infrastructure here ...

// Example values produced by the infrastructure the recipe deploys.
var service = {
  metadata: {
    name: 'redis'
    namespace: context.runtime.kubernetes.namespace
  }
}
var password = 'example-password'

output result object = {
  // Resource IDs that Radius should track as part of this resource's lifecycle.
  resources: [
    '/planes/kubernetes/local/namespaces/${service.metadata.namespace}/providers/core/Service/${service.metadata.name}'
  ]
  // Non-sensitive values surfaced to the resource and its connections.
  values: {
    host: '${service.metadata.name}.${service.metadata.namespace}.svc.cluster.local'
    port: 6379
  }
  // Sensitive values stored securely as secrets.
  secrets: {
    #disable-next-line outputs-should-not-contain-secrets
    password: password
  }
}

Properties

values

values is a map of non-sensitive key/value pairs. Radius records each entry as a computed property on the resource that called the recipe and makes it available to any resource that connects to it—for example, a container reads them through connection environment variables.

secrets

secrets is a map of sensitive key/value pairs, such as passwords or connection strings. Radius stores these values securely and surfaces them to connecting resources without exposing them as plain values.

resources

resources is an array of fully qualified resource IDs. Radius associates each ID with the resource that called the recipe so it can manage the returned resources’ lifecycle—for example, deleting them when the resource is deleted.

How Radius uses the result

When a recipe finishes, Radius reads the result output and:

• Records the values as computed properties on the resource and passes them to any resource that connects to it (for example, as CONNECTION_<NAME>_<KEY> environment variables on a container).
• Stores the secrets securely and surfaces them to connecting resources without exposing them as plain values.
• Adds the resource IDs in resources to the resource’s list of tracked output resources so they are managed—and cleaned up—alongside the resource.

Radius also records status metadata about the recipe (such as the template kind and path) on the resource automatically. This metadata is not set in the result object.

When is the result required?

Returning a result object is optional, but it is required in the following cases:

• To populate the resource’s properties. When the resource type defines read-only properties that the recipe computes (such as host, port, or a connection string), those values must be returned under values so they appear on the resource and flow to connecting resources.
• To return secrets. Any sensitive value the consuming application needs—such as a password or connection string—must be returned under secrets.
• To track resources Radius can’t discover implicitly. Radius automatically tracks ARM and UCP resources that a Bicep recipe creates. Other resources—most commonly Kubernetes resources—are not returned automatically, so their IDs must be listed under resources for Radius to manage their lifecycle.

When a recipe doesn’t compute any properties or secrets and only creates resources that Radius tracks implicitly, the result output can be omitted entirely.