Update auto-generated reference documentation (main)

docs/content/reference/cli/rad_application_graph.md

@@ -21,8 +21,8 @@ the command compiles the template and writes the resulting modeled graph to
 ./app-graph.json without contacting the control plane.
 
 If the command runs inside a GitHub Actions runner (GITHUB_ACTIONS=true), the
-modeled graph is committed to <source-branch>/app-graph.json on the radius-graph
-orphan branch instead of the local filesystem. This is auto-detected; no flag
+modeled graph is saved to <source-branch>/app-graph.json in the radius-graph
+archive instead of the local filesystem. This is auto-detected; no flag
 is required.
 
 ```
@@ -46,7 +46,7 @@ rad app graph ./app.bicep
   -a, --application string   The application name
   -g, --group string         The resource group name
   -h, --help                 help for graph
-      --include-icons        When set with --preview, embeds each referenced resource type icon's SVG bytes in the response.
+      --include-icons        When set with --preview (deployed) or with a bicep-file argument (modeled), embeds each referenced resource type icon's SVG bytes in the response's icons map.
   -o, --output string        output format (supported formats are json, table) (default "table")
       --preview              Use the Radius.Core preview implementation (can also be set via RADIUS_PREVIEW=true)
   -w, --workspace string     The workspace name

docs/content/reference/cli/rad_deploy.md

@@ -16,6 +16,10 @@ Deploy a Bicep or ARM template
 
 The deploy command compiles a Bicep or ARM template and deploys it to your default environment (unless otherwise specified).
 
+The template can be a local file path or an http(s) URL. Remote templates are downloaded before
+being compiled and deployed, similar to how tools such as kubectl accept remote URLs. Remote
+templates must be self-contained; relative imports and other local file dependencies are not supported.
+
 You can combine Radius types as as well as other types that are available in Bicep such as Azure resources. See
 the Radius documentation for information about describing your application and resources with Bicep.
 
@@ -47,6 +51,9 @@ rad deploy myapp.bicep
 # deploy an ARM template (json)
 rad deploy myapp.json
 
+# deploy a Bicep template from a remote URL
+rad deploy https://example.com/myapp.bicep
+
 # deploy to a specific workspace
 rad deploy myapp.bicep --workspace production
 
@@ -85,6 +92,7 @@ rad deploy myapp.bicep --parameters @myfile.json --parameters version=latest
   -g, --group string             The resource group name
   -h, --help                     help for deploy
   -p, --parameters stringArray   Specify parameters for the deployment
+      --preview                  Deploy the application using the Radius.Core/applications resource type instead of Applications.Core/applications (can also be set via RADIUS_PREVIEW=true)
   -w, --workspace string         The workspace name
 ```
 

docs/content/reference/cli/rad_environment_create.md

@@ -24,18 +24,24 @@ rad environment create [envName] [flags]
 
 ```
 
-## Create environment with default namespace
+## Create environment
 rad env create myenv
 
-## Create environment with a specific namespace
-rad env create myenv --kubernetes-namespace mynamespace
-
 ## Create environment with Azure cloud provider
 rad env create myenv --azure-subscription-id <subscription-id> --azure-resource-group <resource-group>
 
 ## Create environment with AWS cloud provider
 rad env create myenv --aws-region <region> --aws-account-id <account-id>
 
+## Create environment with a specific Kubernetes namespace
+rad env create myenv --kubernetes-namespace mynamespace
+
+## Create environment with recipe packs (--preview)
+rad env create myenv --preview --recipe-packs pack1,pack2
+
+## Create environment with recipe packs from a different resource group (--preview)
+rad env create myenv --preview --recipe-packs pack1 --recipe-pack-group other-group
+
 ```
 
 ### Options
@@ -49,7 +55,9 @@ rad env create myenv --aws-region <region> --aws-account-id <account-id>
   -g, --group string                   The resource group name
   -h, --help                           help for create
       --kubernetes-namespace string    The namespace where Kubernetes resources will be deployed
-      --preview                        Use the Radius.Core preview implementation (can also be set via RADIUS_PREVIEW=true)
+      --preview                        Use the Radius.Core preview implementation for environment create (can also be set via RADIUS_PREVIEW=true)
+      --recipe-pack-group string       Specify the resource group containing the recipe packs named in --recipe-packs, if different from the environment's resource group (--preview).
+      --recipe-packs strings           Specify recipe packs to assign to the environment (--preview). Accepts comma-separated values.
   -w, --workspace string               The workspace name
 ```
 

docs/content/reference/cli/rad_environment_update.md

@@ -51,6 +51,9 @@ rad env update myenv --clear-kubernetes
 ## Set recipe packs to environment (--preview)
 rad env update myenv --recipe-packs pack1,pack2
 
+## Set recipe packs from a different resource group to environment (--preview)
+rad env update myenv --recipe-packs pack1 --recipe-pack-group other-group
+
 ```
 
 ### Options
@@ -67,7 +70,8 @@ rad env update myenv --recipe-packs pack1,pack2
   -g, --group string                   The resource group name
   -h, --help                           help for update
       --kubernetes-namespace string    The namespace where Kubernetes resources will be deployed
-      --preview                        Use the Radius.Core preview implementation for environment update.
+      --preview                        Use the Radius.Core preview implementation for environment update (can also be set via RADIUS_PREVIEW=true)
+      --recipe-pack-group string       Specify the resource group containing the recipe packs named in --recipe-packs, if different from the environment's resource group (--preview).
       --recipe-packs strings           Specify recipe packs to replace the environment's recipe pack list (--preview). Accepts comma-separated values.
   -w, --workspace string               The workspace name
 ```

docs/content/reference/cli/rad_install_kubernetes.md

@@ -17,10 +17,14 @@ By default 'rad install kubernetes' will install Radius with the version matchin
 
 Radius will be installed in the 'radius-system' namespace. For more information visit https://docs.radapp.io/concepts#technical-architecture
 
-This command also ensures that a default resource group named 'default' and a default environment
-named 'default' (using the 'default' Kubernetes namespace) exist so the cluster is immediately
-ready to deploy applications. If either resource already exists, it is left unchanged; user
-customizations are never overwritten, even with '--reinstall'.
+On install or reinstall, this command also ensures that a default resource group named 'default'
+and a default environment named 'default' (using the 'default' Kubernetes namespace) exist so the
+cluster is immediately ready to deploy applications. If either resource already exists, it is left
+unchanged (GET-first); user customizations are never overwritten, even with '--reinstall'.
+
+By default the environment is created using the 'Applications.Core/environments' resource type.
+Pass '--preview' (or set RADIUS_PREVIEW=true) to create it using the new 'Radius.Core/environments'
+resource type with the default recipe pack instead.
 
 Overrides can be set by specifying Helm chart values with the '--set' flag. For more information visit https://docs.radapp.io/guides/operations/kubernetes/install/.
 
@@ -35,6 +39,9 @@ rad install kubernetes [flags]
 # Install Radius with default settings in current Kubernetes context
 rad install kubernetes
 
+# Install Radius and create the default environment using the Radius.Core/environments type
+rad install kubernetes --preview
+
 # Install Radius with default settings in specified Kubernetes context
 rad install kubernetes --kubecontext mycluster
 
@@ -92,6 +99,7 @@ rad install kubernetes --set global.terraform.loglevel=DEBUG
       --contour-set-file stringArray   Set values from files on the command line (can specify multiple or separate files with commas: key1=filename1,key2=filename2)
   -h, --help                           help for kubernetes
       --kubecontext string             The Kubernetes context to use, will use the default if unset
+      --preview                        Create the default environment using the Radius.Core/environments resource type instead of Applications.Core/environments (can also be set via RADIUS_PREVIEW=true)
       --reinstall                      Specify to force reinstallation of Radius
       --set stringArray                Set values on the command line (can specify multiple or separate values with commas: key1=val1,key2=val2)
       --set-file stringArray           Set values from files on the command line (can specify multiple or separate files with commas: key1=filename1,key2=filename2)

docs/content/reference/cli/rad_resource_list.md

@@ -12,7 +12,7 @@ Lists resources
 
 ### Synopsis
 
-List all resources of specified type
+List all resources of a specified type. If no resource type is given, lists all resources of any type in an environment or application.
 
 ```
 rad resource list [resourceType] [flags]
@@ -35,15 +35,33 @@ rad resource list Applications.Core/containers --application icecream-store
 # list all resources of a specified type in an application (shorthand flag)
 rad resource list Applications.Core/containers -a icecream-store
 
+# list all resources of a specified type in a specified environment
+rad resource list Applications.Core/containers -e not-default-env
+
+# list all resources of any type in the default environment
+rad resource list
+
+# list all resources of any type in a specified environment
+rad resource list -e not-default-env
+
+# list all resources of any type in an application
+rad resource list -a icecream-store
+
+# list preview resources in a Radius.Core environment or application
+rad resource list -e not-default-env --preview
+rad resource list -a icecream-store --preview
+
 ```
 
 ### Options
 
 ```
   -a, --application string   The application name
+  -e, --environment string   The environment name
   -g, --group string         The resource group name
   -h, --help                 help for list
   -o, --output string        output format (supported formats are json, table) (default "table")
+      --preview              Use the Radius.Core preview implementation (can also be set via RADIUS_PREVIEW=true)
   -w, --workspace string     The workspace name
 ```
 

docs/content/reference/cli/rad_shutdown.md

@@ -15,8 +15,8 @@ Back up Radius state and prepare for shutdown
 Back up all durable Radius state for the current workspace.
 
 Dumps the control-plane PostgreSQL databases and exports the Terraform recipe state Secrets,
-commits them to the radius-state git orphan branch, and pushes to the remote when one is
-configured. The state can be restored into a fresh control plane with 'rad startup'.
+commits them to the radius-state archive. The state can be restored into a fresh control plane
+with 'rad startup'.
 
 This command does not delete the cluster or uninstall Radius.
 

docs/content/reference/cli/rad_startup.md

@@ -14,7 +14,7 @@ Restore Radius state after startup
 
 Restore durable Radius state for the current workspace.
 
-Opens the radius-state git orphan branch, waits for the control-plane PostgreSQL instance to be
+Opens the radius-state archive, waits for the control-plane PostgreSQL instance to be
 ready, restores the control-plane databases, and re-creates the Terraform recipe state Secrets.
 Run this after Radius is installed on a fresh cluster to resume from the state saved by
 'rad shutdown'.

docs/content/reference/resources/radius.compute/2025-08-01-preview/containers/index.md

@@ -54,7 +54,7 @@ resource myContainer 'Radius.Compute/containers@2025-08-01-preview' = {
 }
 ```
 
-When a port is included, a Kubernetes Service named demo with the type ClusterIP is created.
+When a port is included, a Kubernetes Service of type ClusterIP is created for the container. Its name is `<container-resource-name>-<container-name>`, lowercased to satisfy Kubernetes naming rules — for the example above, `mycontainer-demo`. The recipe publishes each port-exposing container's in-cluster Service DNS name in the read-only `hosts` map, keyed by container name. Peer containers can address a specific container by referencing `<peer>.properties.hosts.<containerName>` instead of hardcoding a Service name.
 
 To create an ephemeral emptyDir shared between two containers add a Containers.properties.volumes.
 
@@ -106,6 +106,7 @@ To mount a persistent volume or secret see the PersistentVolumes and Secrets Res
 | `containers` | [object](#containers) |  |
 | `environment` | string | (Required) The Radius Environment ID. Typically set by the rad CLI. Typically value should be `environment`. |
 | `extensions` | [object](#extensions) | (Optional) Properties for additional functionality. daprSidecar is the only available option. |
+| `hosts` | object | (Read Only) Map of container name to the in-cluster DNS host of that container's Kubernetes Service. Populated for every container that exposes a port, so a multi-container resource publishes all of its Service hosts. Peer containers address a specific container by referencing `<peer>.properties.hosts.<containerName>`. |
 | `platformOptions` | object | (Optional) If enabled by the platform engineer, properties to be passed to the Recipe for the specified platform. |
 | `replicas` | integer | (Optional) The minimum number of replicas for the set of containers. |
 | `restartPolicy` | string | (Optional) Defines how a containers behave when they terminate. `Always` will restart containers regardless of their exit status. `OnFailure` will restart containers if they return a non-zero exit code.<br />Allowed values: `Always`, `Never`, `OnFailure`. |

docs/content/reference/resources/radius.messaging/2025-08-01-preview/rabbitmq/index.md

@@ -8,18 +8,40 @@ linkTitle: "RabbitMQ"
 
 ## Description
 
-The Radius.Messaging/rabbitMQ Resource Type deploys a queue-compatible
-messaging resource. In the Azure verification recipe, the platform engineer
-maps this type to Azure Service Bus using the Service Bus AMQP endpoint. This
-provisions the resource and maps its connection outputs; it does not prove
-RabbitMQ broker API compatibility.
+The Radius.Messaging/rabbitMQ Resource Type deploys a RabbitMQ message broker
+that speaks AMQP 0-9-1. It allows developers to create and connect to a queue
+as part of their Radius applications.
+
+You can provision the broker password by creating a `Radius.Security/secrets`
+resource and passing its resource ID on the optional `password` property. If
+omitted, the Kubernetes Recipe generates a random password and returns it
+through the resource's managed secrets. In both cases, the password is mounted
+into the broker via `secretKeyRef`.
 ```bicep
+@secure()
+param password string
+
+resource rabbitmqSecret 'Radius.Security/secrets@2025-08-01-preview' = {
+  name: 'rabbitmq-credentials'
+  properties: {
+    environment: environment
+    application: myApplication.id
+    data: {
+      password: {
+        value: password
+      }
+    }
+  }
+}
+
 resource queue 'Radius.Messaging/rabbitMQ@2025-08-01-preview' = {
   name: 'rabbitmq'
   properties: {
     environment: environment
     application: myApplication.id
     queue: 'jobs'
+    username: 'radius'
+    password: rabbitmqSecret.id
   }
 }
 ```
@@ -30,11 +52,13 @@ environment variables named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>`.
 For a connection named `rabbitmq`, the variables are:
 
 - CONNECTION_RABBITMQ_HOST
+- CONNECTION_RABBITMQ_PORT
+- CONNECTION_RABBITMQ_USERNAME
 
-The `connectionString` secret is NOT injected via the connection — it is
-materialized into a managed `Radius.Security/secrets` resource. Bind it into
-a container env var with a `secretKeyRef`, using `rabbitmq.properties.secrets.name`
-as the `secretName` and key `connectionString` (see the `secrets` property).
+When `password` is supplied, bind the same `Radius.Security/secrets` resource
+into the workload. When it is omitted, bind the Recipe-generated managed
+secret using `queue.properties.secrets.name` as the `secretName`. In both cases,
+use key `password`.
 
 ## Top-Level Properties
 
@@ -44,9 +68,12 @@ as the `secretName` and key `connectionString` (see the `secrets` property).
 | `codeReference` | string | Optional URI to the source code of this resource type. ex: https://github.com/radius-project/radius/blob/4fab87e8127adf1db6f43b7029d5235fbe82c5c9/cmd/controller/main.go#L27 |
 | `connections` | [object](#connections) | Map of connection name to connection data. |
 | `environment` | string | (Required) The Radius Environment ID. Typically set by the rad CLI. Typically value should be `environment`. |
-| `host` | string | The host or namespace name used to connect to the queue. Mapped from the recipe module's output. |
-| `queue` | string | (Optional) The queue name to create. Defaults to `jobs` if not provided. |
-| `secrets` | [object](#secrets) | (Read-only) Recipe secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the recipe's `outputs.secrets`; the other sub-properties declare secret keys whose values are written only into that managed secret (never onto this resource). Consumers bind a key into a container env var via `secretKeyRef`, using `<resource>.properties.secrets.name` as `secretName`. |
+| `host` | string | (Read Only) The host name used to connect to the broker. Mapped from the recipe's Service DNS name. |
+| `password` | string | (Optional) The resource ID of the `Radius.Security/secrets` resource that holds the broker password under the data key `password`. Set to `<secretResource>.id`. If omitted, the Kubernetes Recipe generates a random password and returns it through the managed `secrets.password` output. |
+| `port` | integer | (Read Only) The port used to connect to the broker over AMQP 0-9-1 (5672). Mapped from the recipe's output. |
+| `queue` | string | (Optional) The name of the queue to pre-provision on the broker. The Recipe creates this durable queue on the default virtual host when the broker starts, so it exists before your workload connects. Defaults to `jobs` if not provided. |
+| `secrets` | [object](#secrets) | (Read Only) Recipe-generated secrets. The reserved `name` sub-property references the managed Radius.Security/secrets resource Radius materializes from the Recipe's `outputs.secrets`. Consumers bind a key into a container env var via `secretKeyRef`. |
+| `username` | string | (Optional) The username the broker is provisioned with and that clients authenticate as. Defaults to `radius` if not provided. Avoid `guest`, which RabbitMQ restricts to loopback connections. The username is not sensitive and is exposed as a read-only connection value. |
 
 ## Object Properties
 
@@ -61,5 +88,5 @@ as the `secretName` and key `connectionString` (see the `secrets` property).
 
 | Property | Type | Description |
 |----------|------|-------------|
-| `connectionString` | string | The primary connection string used to connect to the queue. Mapped from the recipe module's output; delivered via the managed secret. |
-| `name` | string | (Reserved) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`. |
+| `name` | string | (Read Only) Name of the managed Radius.Security/secrets resource. Use as `secretName` in a container `secretKeyRef`. |
+| `password` | string | (Read Only) The Recipe-generated fallback password, delivered through the managed secret when the `password` input is omitted. |