Expose sslMode contract and align Azure TLS behavior for mySqlDatabases/postgreSqlDatabases

Co-authored-by: nellshamrell <813007+nellshamrell@users.noreply.github.com>

Author: Copilot

Data/mySqlDatabases/README.md

@@ -18,6 +18,7 @@ Developer documentation is embedded in the resource type definition YAML file an
 | `version` | string (`5.7`, `8.0`, `8.4`) | Optional | The major MySQL server version. Defaults to `8.4`. |
 | `host` | string | Read only | The host name used to connect to the database. Set from the Recipe module's output. |
 | `port` | integer | Read only | The port number used to connect to the database. Set from the Recipe module's output. |
+| `sslMode` | string (`required`, `disabled`) | Read only | Whether the database requires an encrypted (TLS/SSL) connection. Every Recipe in this repository currently sets this to `disabled`; the Azure Recipe explicitly disables the flexible server's `require_secure_transport` setting to match. |
 
 ## Recipe Packs
 
@@ -29,4 +30,4 @@ Recipes for this resource type are provided through the platform Recipe Packs at
 
 ## Using the resource type
 
-Add a `mySqlDatabases` resource to your application and connect a container to it. Radius injects the database's connection properties into the container as environment variables named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>` (for example `CONNECTION_MYSQLDB_HOST`, `CONNECTION_MYSQLDB_PORT`, and `CONNECTION_MYSQLDB_DATABASE`). See [`test/app.bicep`](test/app.bicep) for a complete example.
+Add a `mySqlDatabases` resource to your application and connect a container to it. Radius injects the database's connection properties into the container as environment variables named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>` (for example `CONNECTION_MYSQLDB_HOST`, `CONNECTION_MYSQLDB_PORT`, `CONNECTION_MYSQLDB_DATABASE`, and `CONNECTION_MYSQLDB_SSLMODE`). See [`test/app.bicep`](test/app.bicep) for a complete example.

Data/mySqlDatabases/mySqlDatabases.yaml

@@ -51,6 +51,9 @@ types:
       - CONNECTION_MYSQLDB_DATABASE
       - CONNECTION_MYSQLDB_HOST
       - CONNECTION_MYSQLDB_PORT
+      - CONNECTION_MYSQLDB_SSLMODE
+
+      Every Recipe for this Resource Type provisions the database so `sslMode` is `disabled` (no Recipe in this repository requires an encrypted connection), so application definitions that rely on the documented outputs can connect the same way on every platform without adding TLS options to their client. The Azure Recipe explicitly disables the `require_secure_transport` server setting so its behavior matches the Kubernetes and AWS Recipes for this Resource Type.
 
     apiVersions:
       '2025-08-01-preview':
@@ -87,4 +90,9 @@ types:
               type: integer
               description: The port number used to connect to the database. Mapped from the recipe module's output (MySQL flexible server uses 3306).
               readOnly: true
+            sslMode:
+              type: string
+              enum: ['required', 'disabled']
+              description: (Read Only) Whether the database requires an encrypted (TLS/SSL) connection. Mapped from the recipe module's output. `required` means clients must connect over TLS/SSL; `disabled` means the Recipe does not enforce it. Configure your client accordingly rather than assuming a particular transport.
+              readOnly: true
           required: [environment,username,password]

Data/mySqlDatabases/recipes/aws/terraform/main.tf

@@ -134,6 +134,7 @@ output "result" {
       host     = module.db.db_instance_address
       port     = module.db.db_instance_port
       database = local.sanitized_database
+      sslMode  = "disabled"
     }
   }
 }

Data/mySqlDatabases/recipes/kubernetes/bicep/kubernetes-mysql.bicep

@@ -162,6 +162,7 @@ output result object = {
     host: '${svc.metadata.name}.${svc.metadata.namespace}.svc.cluster.local'
     port: port
     database: database
+    sslMode: 'disabled'
   }
   secrets: {
     password: password

Data/postgreSqlDatabases/README.md

@@ -19,6 +19,7 @@ Developer documentation is embedded in the resource type definition YAML file an
 | `initSql` | string | Optional | Optional SQL script executed on first initialization to create tables, indexes, and seed data. |
 | `host` | string | Read only | The host name used to connect to the database. Set from the Recipe module's output. |
 | `port` | integer | Read only | The port number used to connect to the database. Set from the Recipe module's output. |
+| `sslMode` | string (`required`, `disabled`) | Read only | Whether the database requires an encrypted (TLS/SSL) connection. Every Recipe in this repository currently sets this to `disabled`; the Azure Recipe explicitly disables the flexible server's `require_secure_transport` setting to match. |
 
 ## Recipe Packs
 
@@ -30,4 +31,4 @@ Recipes for this resource type are provided through the platform Recipe Packs at
 
 ## Using the resource type
 
-Add a `postgreSqlDatabases` resource to your application and connect a container to it. Radius injects the database's connection properties into the container as environment variables named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>` (for example `CONNECTION_POSTGRES_HOST`, `CONNECTION_POSTGRES_PORT`, and `CONNECTION_POSTGRES_DATABASE`). See [`test/app.bicep`](test/app.bicep) for a complete example.
+Add a `postgreSqlDatabases` resource to your application and connect a container to it. Radius injects the database's connection properties into the container as environment variables named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>` (for example `CONNECTION_POSTGRES_HOST`, `CONNECTION_POSTGRES_PORT`, `CONNECTION_POSTGRES_DATABASE`, and `CONNECTION_POSTGRES_SSLMODE`). See [`test/app.bicep`](test/app.bicep) for a complete example.

Data/postgreSqlDatabases/postgreSqlDatabases.yaml

@@ -51,6 +51,9 @@ types:
       - CONNECTION_POSTGRESQL_DATABASE
       - CONNECTION_POSTGRESQL_HOST
       - CONNECTION_POSTGRESQL_PORT
+      - CONNECTION_POSTGRESQL_SSLMODE
+
+      Every Recipe for this Resource Type provisions the database so `sslMode` is `disabled` (no Recipe in this repository requires an encrypted connection), so application definitions that rely on the documented outputs can connect the same way on every platform without adding TLS options to their client. The Azure Recipe explicitly disables the `require_secure_transport` server setting so its behavior matches the Kubernetes Recipe for this Resource Type.
 
     apiVersions:
       '2025-08-01-preview':
@@ -90,4 +93,9 @@ types:
               type: string
               description: The port number used to connect to the database.
               readOnly: true
+            sslMode:
+              type: string
+              enum: ['required', 'disabled']
+              description: (Read Only) Whether the database requires an encrypted (TLS/SSL) connection. Mapped from the recipe module's output. `required` means clients must connect over TLS/SSL; `disabled` means the Recipe does not enforce it. Configure your client accordingly rather than assuming a particular transport.
+              readOnly: true
           required: [environment,username,password]

Data/postgreSqlDatabases/recipes/kubernetes/bicep/kubernetes-postgresql.bicep

@@ -206,6 +206,7 @@ output result object = {
     host: '${svc.metadata.name}.${svc.metadata.namespace}.svc.cluster.local'
     port: port
     database: database
+    sslMode: 'disabled'
   }
   secrets: {
     password: password

Data/postgreSqlDatabases/recipes/kubernetes/terraform/main.tf

@@ -161,6 +161,7 @@ output "result" {
       host     = "${kubernetes_service.postgres.metadata[0].name}.${kubernetes_service.postgres.metadata[0].namespace}.svc.cluster.local"
       port     = local.port
       database = local.database
+      sslMode  = "disabled"
     }
     secrets = {
       password         = local.password

recipe-packs/azure/README.md

@@ -48,7 +48,8 @@ The Azure pack accepts the provider configuration it needs to provision into you
 | `routesGatewayNamespace` | Namespace of the Gateway resource for `Radius.Compute/routes`. Defaults to `default`. |
 | `containerImagesRegistry` | Registry path (e.g. `ghcr.io/my-org`) that `Radius.Compute/containerImages` pushes built images to. |
 | `containerImagesRegistrySecretName` | Name of the Kubernetes Secret holding registry credentials for `Radius.Compute/containerImages`. Optional; leave empty for an unauthenticated registry. |
-| `postgreSqlServerConfigurations` | Server parameters forwarded verbatim to the AVM PostgreSQL flexible server `configurations` array for `Radius.Data/postgreSqlDatabases`, using the AVM item shape `{ name, source, value }`. Most commonly used to allow-list extensions via `azure.extensions` — for example `[{ name: 'azure.extensions', source: 'user-override', value: 'vector' }]` to enable pgvector. See [Extensions and modules by name in Azure Database for PostgreSQL flexible server](https://learn.microsoft.com/en-us/azure/postgresql/extensions/concepts-extensions-versions) for the supported extension names. Optional; defaults to an empty array (no extra server configuration). |
+| `postgreSqlServerConfigurations` | Server parameters forwarded verbatim to the AVM PostgreSQL flexible server `configurations` array for `Radius.Data/postgreSqlDatabases`, using the AVM item shape `{ name, source, value }`. Defaults to `[{ name: 'require_secure_transport', value: 'OFF' }]` so `Radius.Data/postgreSqlDatabases` behaves the same on Azure as it does with the Kubernetes Recipe for this Resource Type (see [issue #301](https://github.com/radius-project/resource-types-contrib/issues/301)). Also commonly used to allow-list extensions via `azure.extensions` — for example `[{ name: 'require_secure_transport', value: 'OFF' }, { name: 'azure.extensions', source: 'user-override', value: 'vector' }]` to enable pgvector while keeping the default TLS behavior. See [Extensions and modules by name in Azure Database for PostgreSQL flexible server](https://learn.microsoft.com/en-us/azure/postgresql/extensions/concepts-extensions-versions) for the supported extension names. Optional. |
+| `mySqlServerConfigurations` | Server parameters forwarded verbatim to the AVM MySQL flexible server `configurations` array for `Radius.Data/mySqlDatabases`, using the AVM item shape `{ name, source, value }`. Defaults to `[{ name: 'require_secure_transport', value: 'OFF' }]` so `Radius.Data/mySqlDatabases` behaves the same on Azure as it does with the Kubernetes and AWS Recipes for this Resource Type (see [issue #301](https://github.com/radius-project/resource-types-contrib/issues/301)). Optional. |
 
 ## Deploying
 

recipe-packs/azure/aks-recipepack.bicep

@@ -24,8 +24,21 @@ param containerImagesRegistry string
 @description('Name of the Kubernetes Secret holding registry credentials for Radius.Compute/containerImages. Leave empty for an unauthenticated registry.')
 param containerImagesRegistrySecretName string = ''
 
-@description('Server parameters forwarded verbatim to the AVM PostgreSQL flexible server configurations array for Radius.Data/postgreSqlDatabases, using the AVM item shape with name, source, and value fields. Commonly used to allow-list extensions via the azure.extensions parameter (for example to enable pgvector). See recipe-packs/azure/README.md for an example and a link to the supported extensions. Defaults to an empty array (no extra server configuration).')
-param postgreSqlServerConfigurations array = []
+@description('Server parameters forwarded verbatim to the AVM PostgreSQL flexible server configurations array for Radius.Data/postgreSqlDatabases, using the AVM item shape with name, source, and value fields. Defaults to disabling the `require_secure_transport` server parameter so the Recipe matches the Kubernetes Recipe for this Resource Type, whose `sslMode` output is always `disabled`. Commonly overridden to allow-list extensions via the azure.extensions parameter (for example to enable pgvector) or to re-enable `require_secure_transport`. See recipe-packs/azure/README.md for an example and a link to the supported extensions.')
+param postgreSqlServerConfigurations array = [
+  {
+    name: 'require_secure_transport'
+    value: 'OFF'
+  }
+]
+
+@description('Server parameters forwarded verbatim to the AVM MySQL flexible server configurations array for Radius.Data/mySqlDatabases, using the AVM item shape with name, source, and value fields. Defaults to disabling the `require_secure_transport` server parameter so the Recipe matches the Kubernetes and AWS Recipes for this Resource Type, whose `sslMode` output is always `disabled`. Override to re-enable `require_secure_transport` if your application connects over TLS/SSL.')
+param mySqlServerConfigurations array = [
+  {
+    name: 'require_secure_transport'
+    value: 'OFF'
+  }
+]
 
 resource recipes 'Radius.Core/recipePacks@2025-08-01-preview' = {
   name: 'azure-avm'
@@ -174,6 +187,7 @@ resource recipes 'Radius.Core/recipePacks@2025-08-01-preview' = {
           lock: {
             kind: 'None'
           }
+          configurations: mySqlServerConfigurations
         }
         outputs: {
           host: 'fqdn'