Radius Secret Store

Learn how to define a secret store

Note that only Kubernetes Secrets are currently supported with more to come in the future.

Resource format

Creating a new Secret Store

resource appCert 'Applications.Core/secretStores@2023-10-01-preview' = {
  name: 'appcert'
  properties:{
    application: app.id
    type: 'certificate'
    data: {
      'tls.key': {
        value: tlskey
      }
      'tls.crt': {
        value: tlscrt
      }
    }
  }
}

Referencing an existing Secret Store

resource existingAppCert 'Applications.Core/secretStores@2023-10-01-preview' = {
  name: 'existing-appcert'
  properties:{
    application: app.id
    resource: 'secret-app-existing-secret' // Reference to the name of an external secret store
    type: 'certificate' // The type of secret in your resource
    data: {
      // The keys in this object are the names of the secrets in an external secret store
      'tls.crt': {}
      'tls.key': {}
    }
  }
}

Top-level

KeyRequiredDescriptionExample
nameyThe name of your Secret Store.'secret'
locationyThe location of your resource. See common values for more information.global
propertiesyProperties of the resource.See below

properties

KeyRequiredDescriptionExample
applicationnThe ID of the application resource this resource belongs to.app.id
resourcenReference to the backing secret store resource, required only if valueFrom specifies referenced secret name.namespace/secretName
typeyThe type of secret in your resource.'certificate'
datayAn object to represent key-value type secrets.See below
data

This property is an object to represent key-value type secrets. You define your own key for each secret (e.g. 'tls.key'), with the encoding, value, and valueFrom properties representing each secret value:

KeyRequiredDescriptionExample
valueyThe value of the secret key.'secretString'
encodingnThe encoding type of the data value (default is 'raw').'base64'
valueFromnA reference to an external secret. This field is currently not in use, as it is meant for supporting more types of external secrets in the future.See below
valueFrom

Note: valueFrom is not supported for Kubernetes Secrets, but may be used for other secret store types in the future.

KeyRequiredDescriptionExample
nameyThe name of the secret or key of properties.resource.'secret_key1_name'
versionnThe version of the secret.1