Summary
Radius.Core/environments providers.azure.resourceGroupName is optional in the schema, but Azure Bicep and Terraform Recipes require a resource group. Omitting it passes validation yet produces broken Azure deployments with no early error.
Steps to reproduce
-
Create an Environment with an Azure provider that sets subscriptionId but omits resourceGroupName:
resource myEnvironment 'Radius.Core/environments@2025-08-01-preview' = {
name: 'my-environment'
properties: {
providers: {
azure: {
subscriptionId: '00000000-0000-0000-0000-000000000000'
}
}
}
}
-
Deploy an application whose resources use an Azure (Bicep or Terraform) Recipe to this Environment.
Observed behavior
The recipe-config bridge builds the Azure scope without a resource group when resourceGroupName is empty (pkg/recipes/configloader/environment.go, ~L166):
scope := "/subscriptions/" + Azure.SubscriptionId
if Azure.ResourceGroupName != "" {
scope += "/resourceGroups/" + Azure.ResourceGroupName
}The resulting scope is /subscriptions/<id> with no resource group and no default. recipecontext then populates context.azure.resourceGroup.name from that scope (pkg/recipes/recipecontext/context.go, ~L81), leaving it empty. Recipes that read context.azure.resourceGroup.name (effectively all Azure Recipes) fail or deploy incorrectly.
Expected behavior
Either the resource group is required when the Azure provider is configured, or Radius fails fast with a clear error when it is missing. A schema-valid Environment should not silently break every Azure Recipe.
Root cause
resourceGroupName is modeled as optional (resourceGroupName? in TypeSpec, json:"resourceGroupName,omitempty" in the datamodel), but the runtime and recipe context treat a resource group as required for Azure deployments. The schema contract and the runtime contract disagree.
Proposed options
- Make
resourceGroupName required in the schema and datamodel when the azure provider is present.
- Validate at deploy time and return a clear error if the Azure provider has no resource group.
- Intentionally support subscription-scoped deployments and document that Recipes must then supply their own resource group.
Additional context
Surfaced while writing property descriptions for Radius.Core/environments (related: #12429, #12430). As an interim measure, the resourceGroupName description notes that it is effectively required for Azure Recipes.
Summary
Radius.Core/environmentsproviders.azure.resourceGroupNameis optional in the schema, but Azure Bicep and Terraform Recipes require a resource group. Omitting it passes validation yet produces broken Azure deployments with no early error.Steps to reproduce
Create an Environment with an Azure provider that sets
subscriptionIdbut omitsresourceGroupName:Deploy an application whose resources use an Azure (Bicep or Terraform) Recipe to this Environment.
Observed behavior
The recipe-config bridge builds the Azure scope without a resource group when
resourceGroupNameis empty (pkg/recipes/configloader/environment.go, ~L166):The resulting scope is
/subscriptions/<id>with no resource group and no default.recipecontextthen populatescontext.azure.resourceGroup.namefrom that scope (pkg/recipes/recipecontext/context.go, ~L81), leaving it empty. Recipes that readcontext.azure.resourceGroup.name(effectively all Azure Recipes) fail or deploy incorrectly.Expected behavior
Either the resource group is required when the Azure provider is configured, or Radius fails fast with a clear error when it is missing. A schema-valid Environment should not silently break every Azure Recipe.
Root cause
resourceGroupNameis modeled as optional (resourceGroupName?in TypeSpec,json:"resourceGroupName,omitempty"in the datamodel), but the runtime and recipe context treat a resource group as required for Azure deployments. The schema contract and the runtime contract disagree.Proposed options
resourceGroupNamerequired in the schema and datamodel when theazureprovider is present.Additional context
Surfaced while writing property descriptions for
Radius.Core/environments(related: #12429, #12430). As an interim measure, theresourceGroupNamedescription notes that it is effectively required for Azure Recipes.