ContainerEnvVarConstruct
Classsealednet10.0
Represents a single environment-variable entry in a container's
env block. namespace Aspire.Hosting.Radius.Publishing.Constructs;
public sealed class ContainerEnvVarConstruct : Azure.Provisioning.Primitives.ProvisionableConstruct{ // ...}ProvisionableConstruct
Remarks
Section titled Remarks The Radius container schema models
env as a map keyed by the variable name, where each entry is an object carrying either a value or a valueFrom source. The two forms are mutually exclusive: assign ContainerEnvVarConstruct.Value or the ContainerEnvVarConstruct.SecretName / ContainerEnvVarConstruct.SecretKey pair, never both. The value form is emitted for values that carry nothing sensitive. It ends up verbatim in the Kubernetes Deployment spec, so a credential emitted this way is readable by anyone who can read the Deployment or its rollout history — even when the Bicep composed it from an @secure parameter, which only keeps it out of the published artifact.
The value form points at a key of a Radius. resource; secret is that resource's name, which the secrets recipe also uses as the Kubernetes Secret name. The container recipe emits these entries ahead of the plain value ones so kubelet's $ expansion can reference them.
Constructors1
Section titled ConstructorsProperties3
Section titled PropertiesSecretKey get; setBicepValue<string> The key within the secret resource's
data map. Emitted only when assigned, and mutually exclusive with ContainerEnvVarConstruct.Value . SecretName get; setBicepValue<string> The name of the
Radius.Security/secrets resource supplying this value. Emitted only when assigned, and mutually exclusive with ContainerEnvVarConstruct.Value . Valueget; setBicepValue<string> The environment variable value (a literal, or a reference to a Bicep parameter).
Aspire