mySqlDatabases.yaml

namespace: Radius.Data
types:
  mySqlDatabases:
    description: |
      The Radius.Data/mySqlDatabases Resource Type deploys a MySQL database. Provide the administrator `username` and `password` directly on the resource. The `password` property is marked `x-radius-sensitive`, so Radius encrypts it at rest, redacts it on reads, and exposes it (decrypted) only to the platform-engineer recipe that provisions the database.
      ```bicep
      resource mysql 'Radius.Data/mySqlDatabases@2025-08-01-preview' = {
        name: 'mysql'
        properties: {
          environment: environment
          application: myApplication.id
          version: '8.0'
          database: 'appdb'
          username: 'myadmin'
          // From a @secure() password parameter passed in via the CLI
          password: password
        }
      }
      ```

      When deploying the application definition, provide the database password value as a parameter. It is recommended to use a password generator such as `openssl` or equivalent. For example, `rad deploy app.bicep -p ****** rand -hex 16)`.

      To connect your container to the database, create a connection from the Container resource to the database as shown below.
      ```bicep
      resource myApplication 'Radius.Core/Applications@2025-08-01-preview' = { ... }

      resource frontend 'Radius.Compute/containers@2025-08-01-preview' = {
        name: 'frontend'
        properties: {
          application: myApplication.id
          environment: environment
          container: {
            image: 'frontend:1.25'
            ports: {
              web: {
                containerPort: 8080
              }
            }
          }
          connections: {
            mysqldb: {
              source: database.id
            }
          }
        }
      }
      ```

      The connection automatically injects environment variables into the container for all properties from the database. The environment variables are named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>`. In this example, the connection name is `mysqldb` so the environment variables will be:

      - CONNECTION_MYSQLDB_DATABASE
      - CONNECTION_MYSQLDB_HOST
      - CONNECTION_MYSQLDB_PORT
      - CONNECTION_MYSQLDB_SSLMODE

      The Kubernetes and AWS Recipes for this Resource Type provision the database so `sslMode` is `disabled`. The Azure Recipe Pack keeps the flexible server's `require_secure_transport` setting `ON` by default (matching Azure's own default), so `sslMode` is left unset when deployed through that Recipe; configure your client accordingly, or override the Azure Recipe Pack's `mySqlServerConfigurations` parameter to disable `require_secure_transport` if you want Azure to match the Kubernetes and AWS Recipes.

    apiVersions:
      '2025-08-01-preview':
        schema:
          type: object
          properties:
            environment:
              type: string
              description: "(Required) The Radius Environment ID. Typically set by the rad CLI. Typically value should be `environment`."
            application:
              type: string
              description: "(Optional) The Radius Application ID. `myApplication.id` for example."
            username:
              type: string
              description: "(Required) The administrator username for the MySQL database. Provided directly on the resource and passed to the recipe as `{{context.resource.properties.username}}`."
            password:
              type: string
              x-radius-sensitive: true
              description: "(Required) The administrator password for the MySQL database. Marked `x-radius-sensitive`: Radius encrypts it at rest, redacts it on reads, and exposes it decrypted only to the recipe as `{{context.resource.properties.password}}`."
            database:
              type: string
              default: mysql_db
              description: "(Optional) The name of the database. Defaults to `mysql_db` if not provided."
            version:
              type: string
              enum: ['5.7', '8.0', '8.4']
              default: '8.4'
              description: "(Optional) The major MySQL server version in the X.Y format. Defaults to `8.4` if not provided."
            host:
              type: string
              description: The host name used to connect to the database. Mapped from the recipe module's output.
              readOnly: true
            port:
              type: integer
              description: The port number used to connect to the database. Mapped from the recipe module's output (MySQL flexible server uses 3306).
              readOnly: true
            sslMode:
              type: string
              enum: ['required', 'disabled']
              description: (Read Only) Whether the database requires an encrypted (TLS/SSL) connection. Mapped from the recipe module's output. `required` means clients must connect over TLS/SSL; `disabled` means the Recipe does not enforce it. Configure your client accordingly rather than assuming a particular transport.
              readOnly: true
          required: [environment,username,password]