Add env terraform/bicep settings schema by ytimocin · Pull Request #10832 · radius-project/radius

ytimocin · 2025-11-18T01:07:59Z

Description

Add Radius.Core terraformSettings/bicepSettings TypeSpec resources, wire new env properties, and generate the preview SDK/OpenAPI/types.
TerraformSettings matches the terraformrc/backend/env/logging shape in the design doc.
BicepSettings now supports per-registry auth blocks for Basic (username/password secret), Azure Workload Identity (clientId/tenantId/secret), and AWS IRSA (roleArn/secret), with matching Go datamodels. (Codegen for the new Bicep auth shape still needs to be rerun.)

Examples:

resource corpTerraformSettings 'Radius.Core/terraformSettings@2025-08-01-preview' = {
  name: 'corpTerraformSettings'
  properties: {
    terraformrc: {
      provider_installation: {
        network_mirror: {
          url: 'https://mirror.corp.example.com/terraform/providers'
          include: ['*']
          exclude: ['hashicorp/azurerm']
        }
        direct: {
          exclude: ['hashicorp/azurerm']
        }
      }
      credentials: {
        'app.terraform.io': {
          secret: '/planes/radius/local/providers/Radius.Security/secrets/tfc-token'
        }
      }
    }
    backend: {
      type: 'kubernetes'
      config: {
        secret_suffix: 'prod-terraform-state'
        namespace: 'radius-system'
      }
    }
    env: {
      TF_LOG: 'TRACE'
      TF_REGISTRY_CLIENT_TIMEOUT: '15'
    }
    logging: {
      level: 'TRACE'
    }
  }
}

resource corpBicepSettings 'Radius.Core/bicepSettings@2025-08-01-preview' = {
  name: 'corpBicepSettings'
  properties: {
    authentication: {
      registries: {
        'bicep.azurecr.io': {
          basic: {
            username: 'bicep-user'
            secret: '/planes/radius/local/providers/Radius.Security/secrets/azurecr-creds'
          }
        }
        'modules.aws.corp.example.com': {
          awsIrsa: {
            roleArn: 'arn:aws:iam::123456789012:role/RadiusBicepModules'
            secret: '/planes/radius/local/providers/Radius.Security/secrets/aws-irsa-token'
          }
        }
        'internal.corp.example.com': {
          azureWorkloadIdentity: {
            clientId: '00000000-0000-0000-0000-000000000123'
            tenantId: '11111111-1111-1111-1111-111111111111'
            secret: '/planes/radius/local/providers/Radius.Security/secrets/internal-wi-token'
          }
        }
      }
    }
  }
}

Type of change

This pull request adds or changes features of Radius and has an approved issue (issue link required).

Fixes: #issue_number

Contributor checklist

Please verify that the PR meets the following requirements, where applicable:

An overview of proposed schema changes is included in a linked GitHub issue.
- Yes
- Not applicable
A design document PR is created in the design-notes repository, if new APIs are being introduced.
- Yes
- Not applicable
The design document has been reviewed and approved by Radius maintainers/approvers.
- Yes
- Not applicable
A PR for the samples repository is created, if existing samples are affected by the changes in this PR.
- Yes
- Not applicable
A PR for the documentation repository is created, if the changes in this PR affect the documentation or any user facing updates are made.
- Yes
- Not applicable
A PR for the recipes repository is created, if existing recipes are affected by the changes in this PR.
- Yes
- Not applicable

kachawla

@ytimocin could you share a link to the design doc for this, if we have one? If not, then github issue link where expected user experience is defined would be great!

ytimocin · 2025-11-18T21:06:22Z

@ytimocin could you share a link to the design doc for this, if we have one? If not, then github issue link where expected user experience is defined would be great!

radius-project/design-notes#117

codecov · 2025-11-20T20:50:36Z

Codecov Report

❌ Patch coverage is 66.66667% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 50.40%. Comparing base (f8770e9) to head (adf547e).
⚠️ Report is 37 commits behind head on features/terraform-bicep-settings.

Files with missing lines	Patch %	Lines
...corerp/datamodel/bicepsettings_v20250801preview.go	0.00%	2 Missing ⚠️
...rp/datamodel/terraformsettings_v20250801preview.go	0.00%	2 Missing ⚠️

Additional details and impacted files

@@                          Coverage Diff                          @@
##           features/terraform-bicep-settings   #10832      +/-   ##
=====================================================================
- Coverage                              50.40%   50.40%   -0.01%     
=====================================================================
  Files                                    664      666       +2     
  Lines                                  41277    41289      +12     
=====================================================================
+ Hits                                   20807    20813       +6     
- Misses                                 18497    18502       +5     
- Partials                                1973     1974       +1

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Signed-off-by: ytimocin <ytimocin@microsoft.com>

radius-functional-tests · 2025-11-21T01:55:54Z

Radius functional test overview

🔍 Go to test action run

Click here to see the test run details

Name	Value
Repository	ytimocin/radius
Commit ref	`adf547e`
Unique ID	func084425fed0
Image tag	pr-func084425fed0

gotestsum 1.13.0
KinD: v0.29.0
Dapr:
Azure KeyVault CSI driver: 1.4.2
Azure Workload identity webhook: 1.3.0
Bicep recipe location ghcr.io/radius-project/dev/test/testrecipes/test-bicep-recipes/<name>:pr-func084425fed0
Terraform recipe location http://tf-module-server.radius-test-tf-module-server.svc.cluster.local/<name>.zip (in cluster)
applications-rp test image location: ghcr.io/radius-project/dev/applications-rp:pr-func084425fed0
dynamic-rp test image location: ghcr.io/radius-project/dev/dynamic-rp:pr-func084425fed0
controller test image location: ghcr.io/radius-project/dev/controller:pr-func084425fed0
ucp test image location: ghcr.io/radius-project/dev/ucpd:pr-func084425fed0
deployment-engine test image location: ghcr.io/radius-project/deployment-engine:latest

Test Status

⌛ Building Radius and pushing container images for functional tests...
✅ Container images build succeeded
⌛ Publishing Bicep Recipes for functional tests...
✅ Recipe publishing succeeded
⌛ Starting ucp-cloud functional tests...
⌛ Starting corerp-cloud functional tests...
✅ ucp-cloud functional tests succeeded
✅ corerp-cloud functional tests succeeded

kachawla · 2025-12-01T23:29:31Z

+  credentials?: Record<TerraformCredentialConfiguration>;
+}


Looking at the design, should this also consist a key for url/hostname: Record<string, TerraformCredentialConfiguration>

credentials: [ <url>: { secret: providerSecret.id } ]

https://github.com/radius-project/design-notes/blob/84c37201a020e5ddfbb514cfe9d0cfd483260dde/features/2025-08-14-terraform-bicep-settings.md

kachawla · 2025-12-01T23:33:48Z

+#suppress "@azure-tools/typespec-azure-core/bad-record-type"
+@doc("Terraform backend configuration matching the terraform block.")
+model TerraformBackendConfiguration extends Record<unknown> {
+  @doc("Backend type (for example 'kubernetes').")
+  type: string;
+
+  @doc("Backend-specific configuration values.")
+  config?: Record<unknown>;
+}


Do backend config values ever need to be anything other than strings? I think Terraform passes all backend settings as map[string]string, so we should tighten this to Record instead of an open map.

kachawla · 2025-12-01T23:37:56Z

+  provisioningState?: ProvisioningState;
+
+  @doc("Authentication settings for private registries.")
+  authentication?: BicepAuthenticationConfiguration;


Just to confirm - The example schema in design doc has it as "registryAuthentication".. did we decide to change it to "authentication"?

kachawla · 2025-12-01T23:40:47Z

 	// Providers specifies the Terraform provider configurations. Controls how Terraform interacts with cloud providers, SaaS providers, and other APIs: https://developer.hashicorp.com/terraform/language/providers/configuration.// Providers specifies the Terraform provider configurations.
 	Providers map[string][]ProviderConfigProperties `json:"providers,omitempty"`
+
+	// ProviderMirror specifies the Terraform provider mirror configuration.


Could you please add a link to relevant Terraform's docs here for reference?

kachawla · 2025-12-01T23:43:18Z

+	ModuleRegistries map[string]*TerraformModuleRegistryConfig `json:"moduleRegistries,omitempty"`
+
+	// Version specifies the Terraform binary version and the URL to download it from.
+	Version *TerraformVersionConfig `json:"version,omitempty"`


Should we rename it to be more explicit?

Suggested change

Version *TerraformVersionConfig `json:"version,omitempty"`

Version *TerraformBinaryConfig `json:"version,omitempty"`

kachawla · 2025-12-01T23:44:00Z

+type TerraformModuleRegistryConfig struct {
+	// URL is the URL of the module registry.
+	// Example: 'app.terraform.io' for Terraform Cloud or 'terraform.example.com' for Terraform Enterprise
+	URL string `json:"url,omitempty"`


Is this a fixed list of URLs or open ended?

sylvainsf · 2025-12-09T23:37:19Z

+	ProviderMappings map[string]string `json:"providerMappings,omitempty"`
+
+	// Authentication configuration for accessing private Terraform provider mirrors.
+	Authentication RegistryAuthConfig `json:"authentication,omitempty"`


Why is the provider mirror using the module registry auth? they are different protocols and potentially different hosts.

sylvainsf · 2025-12-09T23:38:02Z

+	// Authentication configuration for accessing private Terraform provider mirrors.
+	Authentication RegistryAuthConfig `json:"authentication,omitempty"`
+
+	// TLS configuration for connecting to the Terraform provider registry mirror or for downloading the filesystem mirror.


Terraform has module registries and provider mirrors, provider registry mirror is confusing.

sylvainsf · 2025-12-09T23:39:38Z

+	Authentication RegistryAuthConfig `json:"authentication,omitempty"`
+
+	// TLS configuration for connecting to the Terraform provider registry mirror or for downloading the filesystem mirror.
+	TLS *TLSConfig `json:"tls,omitempty"`


What is the scenario for TLS config here? In the situation where users have an internal CA we use an init container to add the internal CA certs to the Radius container root CA directory.

We are not going to have init container anymore.

sylvainsf · 2025-12-09T23:40:35Z

+type TLSConfig struct {
+	// CACertificate is a reference to a secret containing a custom CA certificate bundle to use for TLS verification.
+	// The secret must contain a key named 'ca-cert' with the PEM-encoded certificate bundle.
+	CACertificate *SecretReference `json:"caCertificate,omitempty"`


This must be done at the container level.

sylvainsf · 2025-12-09T23:51:29Z

+}
+
+// TerraformProviderInstallationConfiguration describes network mirror and direct rules.
+type TerraformProviderInstallationConfiguration struct {


This looks like a Terraform Provider Mirror has been split into two abstractions; ProviderInstallation and NetworkMirror. Why?

sylvainsf · 2025-12-09T23:52:18Z

+}
+
+// TerraformDirectInstallationConfiguration controls direct installation rules.
+type TerraformDirectConfiguration struct {


What is a direct installation?

vishwahiremat · 2025-12-10T18:27:50Z

could you please run make generate again? as I see fake clients for Bicep/Terraform settings are not generated : https://github.com/radius-project/radius/blob/9bdba6ff49102ed7dfd4ce78d0fe82b1886fccf4/pkg/corerp/api/v20250801preview/fake

ytimocin requested review from a team as code owners November 18, 2025 01:08

ytimocin had a problem deploying to functional-tests November 18, 2025 01:08 — with GitHub Actions Failure

ytimocin temporarily deployed to publish-bicep November 18, 2025 01:08 — with GitHub Actions Inactive

kachawla reviewed Nov 18, 2025

View reviewed changes

ytimocin changed the base branch from main to features/terraform-bicep-settings November 20, 2025 20:35

ytimocin force-pushed the ytimocin/terraform-bicep-settings/env-typespec-datamodel branch from 713613f to 2eebf49 Compare November 20, 2025 20:36

ytimocin had a problem deploying to functional-tests November 20, 2025 20:36 — with GitHub Actions Failure

ytimocin temporarily deployed to publish-bicep November 20, 2025 20:36 — with GitHub Actions Inactive

Add env terraform/bicep settings schema

adf547e

Signed-off-by: ytimocin <ytimocin@microsoft.com>

ytimocin force-pushed the ytimocin/terraform-bicep-settings/env-typespec-datamodel branch from 2eebf49 to adf547e Compare November 21, 2025 01:50

ytimocin temporarily deployed to functional-tests November 21, 2025 01:50 — with GitHub Actions Inactive

ytimocin temporarily deployed to publish-bicep November 21, 2025 01:50 — with GitHub Actions Inactive

kachawla reviewed Dec 1, 2025

View reviewed changes

sylvainsf reviewed Dec 9, 2025

View reviewed changes

ytimocin closed this Jan 7, 2026

ytimocin deleted the ytimocin/terraform-bicep-settings/env-typespec-datamodel branch January 7, 2026 05:17

kachawla mentioned this pull request Jan 7, 2026

Add env terraform/bicep settings schema #11013

Merged

12 tasks

	Version *TerraformVersionConfig `json:"version,omitempty"`
	Version *TerraformBinaryConfig `json:"version,omitempty"`

Conversation

ytimocin commented Nov 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Examples:

Type of change

Contributor checklist

Uh oh!

kachawla left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ytimocin commented Nov 18, 2025

Uh oh!

codecov Bot commented Nov 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

radius-functional-tests Bot commented Nov 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Radius functional test overview

Test Status

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vishwahiremat commented Dec 10, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

ytimocin commented Nov 18, 2025 •

edited

Loading

kachawla left a comment •

edited

Loading

codecov Bot commented Nov 20, 2025 •

edited

Loading

radius-functional-tests Bot commented Nov 21, 2025 •

edited

Loading