Add backend, GET, LIST controller for secret redaction by sk593 · Pull Request #11195 · radius-project/radius

sk593 · 2026-02-06T17:11:12Z

Description

This PR adds support for the backend controller, GET controller, and LIST controller for secret decryption and redaction

Type of change

This pull request fixes a bug in Radius and has an approved issue (issue link required).
This pull request adds or changes features of Radius and has an approved issue (issue link required).
This pull request is a minor refactor, code cleanup, test improvement, or other maintenance task and doesn't change the functionality of Radius (issue link optional).

Fixes: #11093 and #11095

Contributor checklist

Please verify that the PR meets the following requirements, where applicable:

An overview of proposed schema changes is included in a linked GitHub issue.
- Yes
- Not applicable
A design document PR is created in the design-notes repository, if new APIs are being introduced.
- Yes
- Not applicable
The design document has been reviewed and approved by Radius maintainers/approvers.
- Yes
- Not applicable
A PR for the samples repository is created, if existing samples are affected by the changes in this PR.
- Yes
- Not applicable
A PR for the documentation repository is created, if the changes in this PR affect the documentation or any user facing updates are made.
- Yes
- Not applicable
A PR for the recipes repository is created, if existing recipes are affected by the changes in this PR.
- Yes
- Not applicable

pkg/dynamicrp/frontend/getresource.go

pkg/dynamicrp/frontend/updatefilter.go

pkg/dynamicrp/frontend/getresource_test.go

lakshmimsft · 2026-02-12T18:18:26Z

pkg/dynamicrp/frontend/getresource.go

+
+// parseRedactPath parses a field path like "credentials.password" or "secrets[*].value"
+// into path segments for traversal.
+func parseRedactPath(path string) []redactPathSegment {


this seems similar to schema.parseSensitivePath() below and encryption.parseFieldPath().. split dot-separated paths with [*] wildcards. Can we consider a shared utility function.

lakshmimsft · 2026-02-12T18:27:31Z

pkg/dynamicrp/frontend/getresource.go

+		if err != nil {
+			logger.Error(err, "Failed to fetch sensitive field paths for GET redaction",
+				"resourceType", resourceType, "apiVersion", apiVersion)
+			// Continue without redaction on error - don't fail the GET


if there was an error here we want to raise it. if there are no paths sensitiveFieldPaths will be empty.

lakshmimsft · 2026-02-12T18:46:26Z

pkg/dynamicrp/frontend/getresource.go

+	if provisioningState != v1.ProvisioningStateSucceeded && resource.Properties != nil {
+		resourceID := serviceCtx.ResourceID.String()
+		resourceType := serviceCtx.ResourceID.Type()
+		apiVersion := getResourceAPIVersion(serviceCtx.APIVersion, resource)


we should not be updating the internalMetadata or using a fallbackAPIversion. ln~86-97 should be removed. schema should be retrieved for the apiVersion resource was created with.
apiVersion := resource.InternalMetadata.UpdatedAPIVersion

pkg/dynamicrp/frontend/listresources.go

lakshmimsft · 2026-02-12T19:43:58Z

pkg/dynamicrp/frontend/listresources.go

+	}
+
+	// Cache sensitive field paths for this resource type (same for all items)
+	var sensitiveFieldPaths []string


we should probably cache this per apiversion ( use map[string][]string instead of []string) since a list of resources for the resourcetype could return resources belonging to multiple api versions and schemas can differ between them.

pkg/portableresources/backend/controller/createorupdateresource.go

github-actions · 2026-02-17T22:11:23Z

Unit Tests

4 844 tests 4 841 ✅ 7m 47s ⏱️
330 suites 3 💤
1 files 0 ❌

Results for commit 82bd1ad.

♻️ This comment has been updated with latest results.

lakshmimsft · 2026-02-17T22:11:28Z

pkg/dynamicrp/frontend/getresource_test.go

+// testGetUCPClientFactoryWithSensitiveFields returns a UCP client that provides
+// a schema with a sensitive "password" field. Uses the shared helper from
+// encryptionfilter_test.go via the same Go test package.
+func testGetUCPClientFactoryWithSensitiveFields() (*v20231001preview.ClientFactory, error) {


is this wrapper function and the next one on ln205 testGetUCPClientFactoryWithError() necessary? the inner functions can be called directly

codecov · 2026-02-17T22:11:44Z

Codecov Report

❌ Patch coverage is 79.88338% with 69 lines in your changes missing coverage. Please review.
✅ Project coverage is 51.15%. Comparing base (209adb7) to head (82bd1ad).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
...urces/backend/controller/createorupdateresource.go	60.22%	19 Missing and 16 partials ⚠️
pkg/schema/annotations.go	89.89%	6 Missing and 4 partials ⚠️
pkg/dynamicrp/backend/service.go	0.00%	4 Missing ⚠️
pkg/dynamicrp/frontend/getresource.go	90.00%	2 Missing and 2 partials ⚠️
pkg/dynamicrp/frontend/listresources.go	93.65%	2 Missing and 2 partials ⚠️
pkg/crypto/encryption/sensitive.go	84.21%	2 Missing and 1 partial ⚠️
pkg/dynamicrp/frontend/routes.go	0.00%	3 Missing ⚠️
pkg/dynamicrp/api/dynamicresource_conversion.go	50.00%	1 Missing and 1 partial ⚠️
pkg/recipes/terraform/execute.go	0.00%	2 Missing ⚠️
...p/datamodel/converter/dynamicresource_converter.go	0.00%	1 Missing ⚠️
... and 1 more

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #11195      +/-   ##
==========================================
+ Coverage   50.98%   51.15%   +0.16%     
==========================================
  Files         679      682       +3     
  Lines       43174    43433     +259     
==========================================
+ Hits        22012    22217     +205     
- Misses      19040    19069      +29     
- Partials     2122     2147      +25

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Signed-off-by: sk593 <shruthikumar@microsoft.com>

lakshmimsft · 2026-02-20T07:07:28Z

pkg/schema/validator.go

-// normalizeSensitiveFieldTypes normalizes the type constraint on sensitive string fields
-// so that the OpenAPI validator accepts both the original plaintext string and the encrypted object form.
-// Only string types need this adjustment — object types remain objects after encryption and pass validation.
+// normalizeSensitiveFieldTypes normalizes the type constraints on sensitive fields


this is needed only for string types. we do not want to normalize for types unless necessary. pls clarfy why this and related functions was updated ??

synced offline. the addition is for object properties. the encrypted value might not always match the original schema so when the validator runs, it fails without normalization

radius-functional-tests · 2026-02-20T19:01:24Z

Radius functional test overview

🔍 Go to test action run

Click here to see the test run details

Name	Value
Repository	radius-project/radius
Commit ref	`82bd1ad`
Unique ID	funcc785c7e393
Image tag	pr-funcc785c7e393

gotestsum 1.13.0
KinD: v0.29.0
Dapr: 1.14.4
Azure KeyVault CSI driver: 1.4.2
Azure Workload identity webhook: 1.3.0
Bicep recipe location ghcr.io/radius-project/dev/test/testrecipes/test-bicep-recipes/<name>:pr-funcc785c7e393
Terraform recipe location http://tf-module-server.radius-test-tf-module-server.svc.cluster.local/<name>.zip (in cluster)
applications-rp test image location: ghcr.io/radius-project/dev/applications-rp:pr-funcc785c7e393
dynamic-rp test image location: ghcr.io/radius-project/dev/dynamic-rp:pr-funcc785c7e393
controller test image location: ghcr.io/radius-project/dev/controller:pr-funcc785c7e393
ucp test image location: ghcr.io/radius-project/dev/ucpd:pr-funcc785c7e393
deployment-engine test image location: ghcr.io/radius-project/deployment-engine:latest

Test Status

⌛ Building Radius and pushing container images for functional tests...
✅ Container images build succeeded
⌛ Publishing Bicep Recipes for functional tests...
✅ Recipe publishing succeeded
⌛ Starting corerp-cloud functional tests...
⌛ Starting ucp-cloud functional tests...
❌ Test tool installation for corerp-cloud failed. Please check the logs for more details
❌ Failed to install Radius for corerp-cloud functional test. Please check the logs for more details
❌ Test tool installation for ucp-cloud failed. Please check the logs for more details
❌ Failed to install Radius for ucp-cloud functional test. Please check the logs for more details
❌ corerp-cloud functional test failed. Please check the logs for more details
❌ ucp-cloud functional test failed. Please check the logs for more details

sk593 requested a deployment to external-contributor-approval February 6, 2026 17:11 — with GitHub Actions Waiting

sk593 temporarily deployed to publish-bicep February 6, 2026 17:11 — with GitHub Actions Inactive

sk593 force-pushed the add-decryption branch from 5ba223c to 7b238b8 Compare February 6, 2026 17:16

sk593 requested a deployment to external-contributor-approval February 6, 2026 17:16 — with GitHub Actions Waiting

sk593 temporarily deployed to publish-bicep February 6, 2026 17:16 — with GitHub Actions Inactive

lakshmimsft reviewed Feb 6, 2026

View reviewed changes

pkg/dynamicrp/frontend/getresource.go Outdated Show resolved Hide resolved

lakshmimsft reviewed Feb 6, 2026

View reviewed changes

pkg/dynamicrp/frontend/updatefilter.go Outdated Show resolved Hide resolved

sk593 requested a deployment to external-contributor-approval February 9, 2026 17:03 — with GitHub Actions Waiting

sk593 requested a deployment to external-contributor-approval February 9, 2026 17:13 — with GitHub Actions Waiting

sk593 force-pushed the add-decryption branch from ca09204 to 4f48436 Compare February 9, 2026 17:13

sk593 requested a deployment to external-contributor-approval February 9, 2026 17:13 — with GitHub Actions Waiting

sk593 temporarily deployed to publish-bicep February 9, 2026 17:13 — with GitHub Actions Inactive

sk593 requested a deployment to external-contributor-approval February 11, 2026 05:43 — with GitHub Actions Waiting

sk593 marked this pull request as ready for review February 11, 2026 05:44

sk593 requested review from a team as code owners February 11, 2026 05:44

sk593 force-pushed the add-decryption branch from 8e5a762 to 73b55d3 Compare February 11, 2026 05:51

sk593 requested a deployment to external-contributor-approval February 11, 2026 05:52 — with GitHub Actions Waiting

sk593 temporarily deployed to publish-bicep February 11, 2026 05:52 — with GitHub Actions Inactive

sk593 force-pushed the add-decryption branch from 73b55d3 to d1848c8 Compare February 11, 2026 06:06

sk593 requested a deployment to external-contributor-approval February 11, 2026 06:06 — with GitHub Actions Waiting

sk593 temporarily deployed to publish-bicep February 11, 2026 06:07 — with GitHub Actions Inactive

lakshmimsft reviewed Feb 12, 2026

View reviewed changes

pkg/dynamicrp/frontend/getresource_test.go Outdated Show resolved Hide resolved

lakshmimsft reviewed Feb 12, 2026

View reviewed changes

pkg/dynamicrp/frontend/listresources.go Outdated Show resolved Hide resolved

lakshmimsft reviewed Feb 12, 2026

View reviewed changes

pkg/portableresources/backend/controller/createorupdateresource.go Outdated Show resolved Hide resolved

Copilot AI review requested due to automatic review settings February 13, 2026 22:12

lakshmimsft reviewed Feb 17, 2026

View reviewed changes

sk593 force-pushed the add-decryption branch from 4023f7e to 1682d41 Compare February 17, 2026 22:33

sk593 requested a deployment to external-contributor-approval February 17, 2026 22:33 — with GitHub Actions Waiting

sk593 temporarily deployed to publish-bicep February 17, 2026 22:33 — with GitHub Actions Inactive

cleanup tests

2ca13a8

Signed-off-by: sk593 <shruthikumar@microsoft.com>

sk593 force-pushed the add-decryption branch from 1682d41 to 2ca13a8 Compare February 17, 2026 23:14

sk593 requested a deployment to external-contributor-approval February 17, 2026 23:15 — with GitHub Actions Waiting

sk593 had a problem deploying to publish-bicep February 17, 2026 23:15 — with GitHub Actions Error

Merge branch 'main' into add-decryption

9b7bb9c

sk593 temporarily deployed to external-contributor-approval February 17, 2026 23:15 — with GitHub Actions Inactive

sk593 temporarily deployed to publish-bicep February 17, 2026 23:16 — with GitHub Actions Inactive

lakshmimsft previously approved these changes Feb 17, 2026

View reviewed changes

Merge branch 'main' into add-decryption

dd08e84

sk593 temporarily deployed to external-contributor-approval February 18, 2026 23:28 — with GitHub Actions Inactive

sk593 dismissed lakshmimsft’s stale review via 25ddaeb February 18, 2026 23:38

sk593 requested a deployment to external-contributor-approval February 18, 2026 23:38 — with GitHub Actions Waiting

sk593 force-pushed the add-decryption branch from 25ddaeb to 843c263 Compare February 19, 2026 15:59

update terraform state

843c263

Signed-off-by: sk593 <shruthikumar@microsoft.com>

sk593 requested a deployment to external-contributor-approval February 19, 2026 16:00 — with GitHub Actions Waiting

Merge branch 'main' into add-decryption

954ae7f

sk593 temporarily deployed to external-contributor-approval February 19, 2026 17:39 — with GitHub Actions Inactive

lakshmimsft reviewed Feb 20, 2026

View reviewed changes

lakshmimsft approved these changes Feb 20, 2026

View reviewed changes

Merge branch 'main' into add-decryption

f7aa54b

sk593 temporarily deployed to external-contributor-approval February 20, 2026 18:40 — with GitHub Actions Inactive

Merge branch 'main' into add-decryption

82bd1ad

sk593 temporarily deployed to external-contributor-approval February 20, 2026 19:00 — with GitHub Actions Inactive

Comments

Conversation

sk593 commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of change

Contributor checklist

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lakshmimsft Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lakshmimsft Feb 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Unit Tests

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

radius-functional-tests bot commented Feb 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Radius functional test overview

Test Status

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

sk593 commented Feb 6, 2026 •

edited

Loading

lakshmimsft Feb 12, 2026 •

edited

Loading

lakshmimsft Feb 12, 2026 •

edited

Loading

github-actions bot commented Feb 17, 2026 •

edited

Loading

codecov bot commented Feb 17, 2026 •

edited

Loading

radius-functional-tests bot commented Feb 20, 2026 •

edited

Loading