From 484a408d37864459ec21222b9f082fa88a2ecb56 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 19 Aug 2026 21:37:20 +0000 Subject: [PATCH 1/7] Initial plan From 1e26cf198a78ed58f1fd92730262c52285b978bd Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 19 Aug 2026 21:48:58 +0000 Subject: [PATCH 2/7] Expose sslMode contract and align Azure TLS behavior for mySqlDatabases/postgreSqlDatabases Co-authored-by: nellshamrell <813007+nellshamrell@users.noreply.github.com> --- Data/mySqlDatabases/README.md | 3 ++- Data/mySqlDatabases/mySqlDatabases.yaml | 8 ++++++++ .../recipes/aws/terraform/main.tf | 1 + .../kubernetes/bicep/kubernetes-mysql.bicep | 1 + Data/postgreSqlDatabases/README.md | 3 ++- .../postgreSqlDatabases.yaml | 8 ++++++++ .../bicep/kubernetes-postgresql.bicep | 1 + .../recipes/kubernetes/terraform/main.tf | 1 + recipe-packs/azure/README.md | 3 ++- recipe-packs/azure/aks-recipepack.bicep | 18 ++++++++++++++++-- 10 files changed, 42 insertions(+), 5 deletions(-) diff --git a/Data/mySqlDatabases/README.md b/Data/mySqlDatabases/README.md index 1d49f143..a5167157 100644 --- a/Data/mySqlDatabases/README.md +++ b/Data/mySqlDatabases/README.md @@ -18,6 +18,7 @@ Developer documentation is embedded in the resource type definition YAML file an | `version` | string (`5.7`, `8.0`, `8.4`) | Optional | The major MySQL server version. Defaults to `8.4`. | | `host` | string | Read only | The host name used to connect to the database. Set from the Recipe module's output. | | `port` | integer | Read only | The port number used to connect to the database. Set from the Recipe module's output. | +| `sslMode` | string (`required`, `disabled`) | Read only | Whether the database requires an encrypted (TLS/SSL) connection. Every Recipe in this repository currently sets this to `disabled`; the Azure Recipe explicitly disables the flexible server's `require_secure_transport` setting to match. | ## Recipe Packs @@ -29,4 +30,4 @@ Recipes for this resource type are provided through the platform Recipe Packs at ## Using the resource type -Add a `mySqlDatabases` resource to your application and connect a container to it. Radius injects the database's connection properties into the container as environment variables named `CONNECTION__` (for example `CONNECTION_MYSQLDB_HOST`, `CONNECTION_MYSQLDB_PORT`, and `CONNECTION_MYSQLDB_DATABASE`). See [`test/app.bicep`](test/app.bicep) for a complete example. +Add a `mySqlDatabases` resource to your application and connect a container to it. Radius injects the database's connection properties into the container as environment variables named `CONNECTION__` (for example `CONNECTION_MYSQLDB_HOST`, `CONNECTION_MYSQLDB_PORT`, `CONNECTION_MYSQLDB_DATABASE`, and `CONNECTION_MYSQLDB_SSLMODE`). See [`test/app.bicep`](test/app.bicep) for a complete example. diff --git a/Data/mySqlDatabases/mySqlDatabases.yaml b/Data/mySqlDatabases/mySqlDatabases.yaml index e4349c2f..1e1b133f 100644 --- a/Data/mySqlDatabases/mySqlDatabases.yaml +++ b/Data/mySqlDatabases/mySqlDatabases.yaml @@ -51,6 +51,9 @@ types: - CONNECTION_MYSQLDB_DATABASE - CONNECTION_MYSQLDB_HOST - CONNECTION_MYSQLDB_PORT + - CONNECTION_MYSQLDB_SSLMODE + + Every Recipe for this Resource Type provisions the database so `sslMode` is `disabled` (no Recipe in this repository requires an encrypted connection), so application definitions that rely on the documented outputs can connect the same way on every platform without adding TLS options to their client. The Azure Recipe explicitly disables the `require_secure_transport` server setting so its behavior matches the Kubernetes and AWS Recipes for this Resource Type. apiVersions: '2025-08-01-preview': @@ -87,4 +90,9 @@ types: type: integer description: The port number used to connect to the database. Mapped from the recipe module's output (MySQL flexible server uses 3306). readOnly: true + sslMode: + type: string + enum: ['required', 'disabled'] + description: (Read Only) Whether the database requires an encrypted (TLS/SSL) connection. Mapped from the recipe module's output. `required` means clients must connect over TLS/SSL; `disabled` means the Recipe does not enforce it. Configure your client accordingly rather than assuming a particular transport. + readOnly: true required: [environment,username,password] diff --git a/Data/mySqlDatabases/recipes/aws/terraform/main.tf b/Data/mySqlDatabases/recipes/aws/terraform/main.tf index d389dd11..8300f6a2 100644 --- a/Data/mySqlDatabases/recipes/aws/terraform/main.tf +++ b/Data/mySqlDatabases/recipes/aws/terraform/main.tf @@ -134,6 +134,7 @@ output "result" { host = module.db.db_instance_address port = module.db.db_instance_port database = local.sanitized_database + sslMode = "disabled" } } } \ No newline at end of file diff --git a/Data/mySqlDatabases/recipes/kubernetes/bicep/kubernetes-mysql.bicep b/Data/mySqlDatabases/recipes/kubernetes/bicep/kubernetes-mysql.bicep index 12297bb1..179f78ca 100644 --- a/Data/mySqlDatabases/recipes/kubernetes/bicep/kubernetes-mysql.bicep +++ b/Data/mySqlDatabases/recipes/kubernetes/bicep/kubernetes-mysql.bicep @@ -162,6 +162,7 @@ output result object = { host: '${svc.metadata.name}.${svc.metadata.namespace}.svc.cluster.local' port: port database: database + sslMode: 'disabled' } secrets: { password: password diff --git a/Data/postgreSqlDatabases/README.md b/Data/postgreSqlDatabases/README.md index 12bb488c..509efb33 100644 --- a/Data/postgreSqlDatabases/README.md +++ b/Data/postgreSqlDatabases/README.md @@ -19,6 +19,7 @@ Developer documentation is embedded in the resource type definition YAML file an | `initSql` | string | Optional | Optional SQL script executed on first initialization to create tables, indexes, and seed data. | | `host` | string | Read only | The host name used to connect to the database. Set from the Recipe module's output. | | `port` | integer | Read only | The port number used to connect to the database. Set from the Recipe module's output. | +| `sslMode` | string (`required`, `disabled`) | Read only | Whether the database requires an encrypted (TLS/SSL) connection. Every Recipe in this repository currently sets this to `disabled`; the Azure Recipe explicitly disables the flexible server's `require_secure_transport` setting to match. | ## Recipe Packs @@ -30,4 +31,4 @@ Recipes for this resource type are provided through the platform Recipe Packs at ## Using the resource type -Add a `postgreSqlDatabases` resource to your application and connect a container to it. Radius injects the database's connection properties into the container as environment variables named `CONNECTION__` (for example `CONNECTION_POSTGRES_HOST`, `CONNECTION_POSTGRES_PORT`, and `CONNECTION_POSTGRES_DATABASE`). See [`test/app.bicep`](test/app.bicep) for a complete example. +Add a `postgreSqlDatabases` resource to your application and connect a container to it. Radius injects the database's connection properties into the container as environment variables named `CONNECTION__` (for example `CONNECTION_POSTGRES_HOST`, `CONNECTION_POSTGRES_PORT`, `CONNECTION_POSTGRES_DATABASE`, and `CONNECTION_POSTGRES_SSLMODE`). See [`test/app.bicep`](test/app.bicep) for a complete example. diff --git a/Data/postgreSqlDatabases/postgreSqlDatabases.yaml b/Data/postgreSqlDatabases/postgreSqlDatabases.yaml index b3e2b7a6..6788f75f 100644 --- a/Data/postgreSqlDatabases/postgreSqlDatabases.yaml +++ b/Data/postgreSqlDatabases/postgreSqlDatabases.yaml @@ -51,6 +51,9 @@ types: - CONNECTION_POSTGRESQL_DATABASE - CONNECTION_POSTGRESQL_HOST - CONNECTION_POSTGRESQL_PORT + - CONNECTION_POSTGRESQL_SSLMODE + + Every Recipe for this Resource Type provisions the database so `sslMode` is `disabled` (no Recipe in this repository requires an encrypted connection), so application definitions that rely on the documented outputs can connect the same way on every platform without adding TLS options to their client. The Azure Recipe explicitly disables the `require_secure_transport` server setting so its behavior matches the Kubernetes Recipe for this Resource Type. apiVersions: '2025-08-01-preview': @@ -90,4 +93,9 @@ types: type: string description: The port number used to connect to the database. readOnly: true + sslMode: + type: string + enum: ['required', 'disabled'] + description: (Read Only) Whether the database requires an encrypted (TLS/SSL) connection. Mapped from the recipe module's output. `required` means clients must connect over TLS/SSL; `disabled` means the Recipe does not enforce it. Configure your client accordingly rather than assuming a particular transport. + readOnly: true required: [environment,username,password] \ No newline at end of file diff --git a/Data/postgreSqlDatabases/recipes/kubernetes/bicep/kubernetes-postgresql.bicep b/Data/postgreSqlDatabases/recipes/kubernetes/bicep/kubernetes-postgresql.bicep index 3cfb533d..b9a0b625 100644 --- a/Data/postgreSqlDatabases/recipes/kubernetes/bicep/kubernetes-postgresql.bicep +++ b/Data/postgreSqlDatabases/recipes/kubernetes/bicep/kubernetes-postgresql.bicep @@ -206,6 +206,7 @@ output result object = { host: '${svc.metadata.name}.${svc.metadata.namespace}.svc.cluster.local' port: port database: database + sslMode: 'disabled' } secrets: { password: password diff --git a/Data/postgreSqlDatabases/recipes/kubernetes/terraform/main.tf b/Data/postgreSqlDatabases/recipes/kubernetes/terraform/main.tf index bffd681e..5984d418 100644 --- a/Data/postgreSqlDatabases/recipes/kubernetes/terraform/main.tf +++ b/Data/postgreSqlDatabases/recipes/kubernetes/terraform/main.tf @@ -161,6 +161,7 @@ output "result" { host = "${kubernetes_service.postgres.metadata[0].name}.${kubernetes_service.postgres.metadata[0].namespace}.svc.cluster.local" port = local.port database = local.database + sslMode = "disabled" } secrets = { password = local.password diff --git a/recipe-packs/azure/README.md b/recipe-packs/azure/README.md index cfb4fa3c..1f06df0d 100644 --- a/recipe-packs/azure/README.md +++ b/recipe-packs/azure/README.md @@ -48,7 +48,8 @@ The Azure pack accepts the provider configuration it needs to provision into you | `routesGatewayNamespace` | Namespace of the Gateway resource for `Radius.Compute/routes`. Defaults to `default`. | | `containerImagesRegistry` | Registry path (e.g. `ghcr.io/my-org`) that `Radius.Compute/containerImages` pushes built images to. | | `containerImagesRegistrySecretName` | Name of the Kubernetes Secret holding registry credentials for `Radius.Compute/containerImages`. Optional; leave empty for an unauthenticated registry. | -| `postgreSqlServerConfigurations` | Server parameters forwarded verbatim to the AVM PostgreSQL flexible server `configurations` array for `Radius.Data/postgreSqlDatabases`, using the AVM item shape `{ name, source, value }`. Most commonly used to allow-list extensions via `azure.extensions` — for example `[{ name: 'azure.extensions', source: 'user-override', value: 'vector' }]` to enable pgvector. See [Extensions and modules by name in Azure Database for PostgreSQL flexible server](https://learn.microsoft.com/en-us/azure/postgresql/extensions/concepts-extensions-versions) for the supported extension names. Optional; defaults to an empty array (no extra server configuration). | +| `postgreSqlServerConfigurations` | Server parameters forwarded verbatim to the AVM PostgreSQL flexible server `configurations` array for `Radius.Data/postgreSqlDatabases`, using the AVM item shape `{ name, source, value }`. Defaults to `[{ name: 'require_secure_transport', value: 'OFF' }]` so `Radius.Data/postgreSqlDatabases` behaves the same on Azure as it does with the Kubernetes Recipe for this Resource Type (see [issue #301](https://github.com/radius-project/resource-types-contrib/issues/301)). Also commonly used to allow-list extensions via `azure.extensions` — for example `[{ name: 'require_secure_transport', value: 'OFF' }, { name: 'azure.extensions', source: 'user-override', value: 'vector' }]` to enable pgvector while keeping the default TLS behavior. See [Extensions and modules by name in Azure Database for PostgreSQL flexible server](https://learn.microsoft.com/en-us/azure/postgresql/extensions/concepts-extensions-versions) for the supported extension names. Optional. | +| `mySqlServerConfigurations` | Server parameters forwarded verbatim to the AVM MySQL flexible server `configurations` array for `Radius.Data/mySqlDatabases`, using the AVM item shape `{ name, source, value }`. Defaults to `[{ name: 'require_secure_transport', value: 'OFF' }]` so `Radius.Data/mySqlDatabases` behaves the same on Azure as it does with the Kubernetes and AWS Recipes for this Resource Type (see [issue #301](https://github.com/radius-project/resource-types-contrib/issues/301)). Optional. | ## Deploying diff --git a/recipe-packs/azure/aks-recipepack.bicep b/recipe-packs/azure/aks-recipepack.bicep index 8c97622b..a90bcf5d 100644 --- a/recipe-packs/azure/aks-recipepack.bicep +++ b/recipe-packs/azure/aks-recipepack.bicep @@ -24,8 +24,21 @@ param containerImagesRegistry string @description('Name of the Kubernetes Secret holding registry credentials for Radius.Compute/containerImages. Leave empty for an unauthenticated registry.') param containerImagesRegistrySecretName string = '' -@description('Server parameters forwarded verbatim to the AVM PostgreSQL flexible server configurations array for Radius.Data/postgreSqlDatabases, using the AVM item shape with name, source, and value fields. Commonly used to allow-list extensions via the azure.extensions parameter (for example to enable pgvector). See recipe-packs/azure/README.md for an example and a link to the supported extensions. Defaults to an empty array (no extra server configuration).') -param postgreSqlServerConfigurations array = [] +@description('Server parameters forwarded verbatim to the AVM PostgreSQL flexible server configurations array for Radius.Data/postgreSqlDatabases, using the AVM item shape with name, source, and value fields. Defaults to disabling the `require_secure_transport` server parameter so the Recipe matches the Kubernetes Recipe for this Resource Type, whose `sslMode` output is always `disabled`. Commonly overridden to allow-list extensions via the azure.extensions parameter (for example to enable pgvector) or to re-enable `require_secure_transport`. See recipe-packs/azure/README.md for an example and a link to the supported extensions.') +param postgreSqlServerConfigurations array = [ + { + name: 'require_secure_transport' + value: 'OFF' + } +] + +@description('Server parameters forwarded verbatim to the AVM MySQL flexible server configurations array for Radius.Data/mySqlDatabases, using the AVM item shape with name, source, and value fields. Defaults to disabling the `require_secure_transport` server parameter so the Recipe matches the Kubernetes and AWS Recipes for this Resource Type, whose `sslMode` output is always `disabled`. Override to re-enable `require_secure_transport` if your application connects over TLS/SSL.') +param mySqlServerConfigurations array = [ + { + name: 'require_secure_transport' + value: 'OFF' + } +] resource recipes 'Radius.Core/recipePacks@2025-08-01-preview' = { name: 'azure-avm' @@ -174,6 +187,7 @@ resource recipes 'Radius.Core/recipePacks@2025-08-01-preview' = { lock: { kind: 'None' } + configurations: mySqlServerConfigurations } outputs: { host: 'fqdn' From cd1fe998fd0247192890bfa7536f44f1685d8233 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Wed, 19 Aug 2026 22:20:18 +0000 Subject: [PATCH 3/7] Default Azure require_secure_transport to ON to preserve existing behavior Co-authored-by: nellshamrell <813007+nellshamrell@users.noreply.github.com> --- Data/mySqlDatabases/README.md | 2 +- Data/mySqlDatabases/mySqlDatabases.yaml | 2 +- Data/postgreSqlDatabases/README.md | 2 +- Data/postgreSqlDatabases/postgreSqlDatabases.yaml | 2 +- recipe-packs/azure/README.md | 4 ++-- recipe-packs/azure/aks-recipepack.bicep | 8 ++++---- 6 files changed, 10 insertions(+), 10 deletions(-) diff --git a/Data/mySqlDatabases/README.md b/Data/mySqlDatabases/README.md index a5167157..0a549cad 100644 --- a/Data/mySqlDatabases/README.md +++ b/Data/mySqlDatabases/README.md @@ -18,7 +18,7 @@ Developer documentation is embedded in the resource type definition YAML file an | `version` | string (`5.7`, `8.0`, `8.4`) | Optional | The major MySQL server version. Defaults to `8.4`. | | `host` | string | Read only | The host name used to connect to the database. Set from the Recipe module's output. | | `port` | integer | Read only | The port number used to connect to the database. Set from the Recipe module's output. | -| `sslMode` | string (`required`, `disabled`) | Read only | Whether the database requires an encrypted (TLS/SSL) connection. Every Recipe in this repository currently sets this to `disabled`; the Azure Recipe explicitly disables the flexible server's `require_secure_transport` setting to match. | +| `sslMode` | string (`required`, `disabled`) | Read only | Whether the database requires an encrypted (TLS/SSL) connection. The Kubernetes and AWS Recipes set this to `disabled`. The Azure Recipe Pack keeps `require_secure_transport` `ON` by default and does not set this property; override the Recipe Pack's `mySqlServerConfigurations` parameter to disable it if you want Azure to match. | ## Recipe Packs diff --git a/Data/mySqlDatabases/mySqlDatabases.yaml b/Data/mySqlDatabases/mySqlDatabases.yaml index 1e1b133f..cab1d21c 100644 --- a/Data/mySqlDatabases/mySqlDatabases.yaml +++ b/Data/mySqlDatabases/mySqlDatabases.yaml @@ -53,7 +53,7 @@ types: - CONNECTION_MYSQLDB_PORT - CONNECTION_MYSQLDB_SSLMODE - Every Recipe for this Resource Type provisions the database so `sslMode` is `disabled` (no Recipe in this repository requires an encrypted connection), so application definitions that rely on the documented outputs can connect the same way on every platform without adding TLS options to their client. The Azure Recipe explicitly disables the `require_secure_transport` server setting so its behavior matches the Kubernetes and AWS Recipes for this Resource Type. + The Kubernetes and AWS Recipes for this Resource Type provision the database so `sslMode` is `disabled`. The Azure Recipe Pack keeps the flexible server's `require_secure_transport` setting `ON` by default (matching Azure's own default), so `sslMode` is left unset when deployed through that Recipe; configure your client accordingly, or override the Azure Recipe Pack's `mySqlServerConfigurations` parameter to disable `require_secure_transport` if you want Azure to match the Kubernetes and AWS Recipes. apiVersions: '2025-08-01-preview': diff --git a/Data/postgreSqlDatabases/README.md b/Data/postgreSqlDatabases/README.md index 509efb33..ef4eaeac 100644 --- a/Data/postgreSqlDatabases/README.md +++ b/Data/postgreSqlDatabases/README.md @@ -19,7 +19,7 @@ Developer documentation is embedded in the resource type definition YAML file an | `initSql` | string | Optional | Optional SQL script executed on first initialization to create tables, indexes, and seed data. | | `host` | string | Read only | The host name used to connect to the database. Set from the Recipe module's output. | | `port` | integer | Read only | The port number used to connect to the database. Set from the Recipe module's output. | -| `sslMode` | string (`required`, `disabled`) | Read only | Whether the database requires an encrypted (TLS/SSL) connection. Every Recipe in this repository currently sets this to `disabled`; the Azure Recipe explicitly disables the flexible server's `require_secure_transport` setting to match. | +| `sslMode` | string (`required`, `disabled`) | Read only | Whether the database requires an encrypted (TLS/SSL) connection. The Kubernetes Recipe sets this to `disabled`. The Azure Recipe Pack keeps `require_secure_transport` `ON` by default and does not set this property; override the Recipe Pack's `postgreSqlServerConfigurations` parameter to disable it if you want Azure to match. | ## Recipe Packs diff --git a/Data/postgreSqlDatabases/postgreSqlDatabases.yaml b/Data/postgreSqlDatabases/postgreSqlDatabases.yaml index 6788f75f..8fa5a7c6 100644 --- a/Data/postgreSqlDatabases/postgreSqlDatabases.yaml +++ b/Data/postgreSqlDatabases/postgreSqlDatabases.yaml @@ -53,7 +53,7 @@ types: - CONNECTION_POSTGRESQL_PORT - CONNECTION_POSTGRESQL_SSLMODE - Every Recipe for this Resource Type provisions the database so `sslMode` is `disabled` (no Recipe in this repository requires an encrypted connection), so application definitions that rely on the documented outputs can connect the same way on every platform without adding TLS options to their client. The Azure Recipe explicitly disables the `require_secure_transport` server setting so its behavior matches the Kubernetes Recipe for this Resource Type. + The Kubernetes Recipe for this Resource Type provisions the database so `sslMode` is `disabled`. The Azure Recipe Pack keeps the flexible server's `require_secure_transport` setting `ON` by default (matching Azure's own default), so `sslMode` is left unset when deployed through that Recipe; configure your client accordingly, or override the Azure Recipe Pack's `postgreSqlServerConfigurations` parameter to disable `require_secure_transport` if you want Azure to match the Kubernetes Recipe. apiVersions: '2025-08-01-preview': diff --git a/recipe-packs/azure/README.md b/recipe-packs/azure/README.md index 1f06df0d..0b98d5ef 100644 --- a/recipe-packs/azure/README.md +++ b/recipe-packs/azure/README.md @@ -48,8 +48,8 @@ The Azure pack accepts the provider configuration it needs to provision into you | `routesGatewayNamespace` | Namespace of the Gateway resource for `Radius.Compute/routes`. Defaults to `default`. | | `containerImagesRegistry` | Registry path (e.g. `ghcr.io/my-org`) that `Radius.Compute/containerImages` pushes built images to. | | `containerImagesRegistrySecretName` | Name of the Kubernetes Secret holding registry credentials for `Radius.Compute/containerImages`. Optional; leave empty for an unauthenticated registry. | -| `postgreSqlServerConfigurations` | Server parameters forwarded verbatim to the AVM PostgreSQL flexible server `configurations` array for `Radius.Data/postgreSqlDatabases`, using the AVM item shape `{ name, source, value }`. Defaults to `[{ name: 'require_secure_transport', value: 'OFF' }]` so `Radius.Data/postgreSqlDatabases` behaves the same on Azure as it does with the Kubernetes Recipe for this Resource Type (see [issue #301](https://github.com/radius-project/resource-types-contrib/issues/301)). Also commonly used to allow-list extensions via `azure.extensions` — for example `[{ name: 'require_secure_transport', value: 'OFF' }, { name: 'azure.extensions', source: 'user-override', value: 'vector' }]` to enable pgvector while keeping the default TLS behavior. See [Extensions and modules by name in Azure Database for PostgreSQL flexible server](https://learn.microsoft.com/en-us/azure/postgresql/extensions/concepts-extensions-versions) for the supported extension names. Optional. | -| `mySqlServerConfigurations` | Server parameters forwarded verbatim to the AVM MySQL flexible server `configurations` array for `Radius.Data/mySqlDatabases`, using the AVM item shape `{ name, source, value }`. Defaults to `[{ name: 'require_secure_transport', value: 'OFF' }]` so `Radius.Data/mySqlDatabases` behaves the same on Azure as it does with the Kubernetes and AWS Recipes for this Resource Type (see [issue #301](https://github.com/radius-project/resource-types-contrib/issues/301)). Optional. | +| `postgreSqlServerConfigurations` | Server parameters forwarded verbatim to the AVM PostgreSQL flexible server `configurations` array for `Radius.Data/postgreSqlDatabases`, using the AVM item shape `{ name, source, value }`. Defaults to `[{ name: 'require_secure_transport', value: 'ON' }]`, preserving the flexible server's default so existing deployments keep requiring TLS. Also commonly used to allow-list extensions via `azure.extensions` — for example `[{ name: 'require_secure_transport', value: 'ON' }, { name: 'azure.extensions', source: 'user-override', value: 'vector' }]` to enable pgvector while keeping the default TLS behavior — or to disable `require_secure_transport` so `Radius.Data/postgreSqlDatabases` matches the Kubernetes Recipe for this Resource Type, whose `sslMode` output is always `disabled` (see [issue #301](https://github.com/radius-project/resource-types-contrib/issues/301)). See [Extensions and modules by name in Azure Database for PostgreSQL flexible server](https://learn.microsoft.com/en-us/azure/postgresql/extensions/concepts-extensions-versions) for the supported extension names. Optional. | +| `mySqlServerConfigurations` | Server parameters forwarded verbatim to the AVM MySQL flexible server `configurations` array for `Radius.Data/mySqlDatabases`, using the AVM item shape `{ name, source, value }`. Defaults to `[{ name: 'require_secure_transport', value: 'ON' }]`, preserving the flexible server's default so existing deployments keep requiring TLS. Override to disable `require_secure_transport` so `Radius.Data/mySqlDatabases` matches the Kubernetes and AWS Recipes for this Resource Type, whose `sslMode` output is always `disabled` (see [issue #301](https://github.com/radius-project/resource-types-contrib/issues/301)). Optional. | ## Deploying diff --git a/recipe-packs/azure/aks-recipepack.bicep b/recipe-packs/azure/aks-recipepack.bicep index a90bcf5d..acc2cc22 100644 --- a/recipe-packs/azure/aks-recipepack.bicep +++ b/recipe-packs/azure/aks-recipepack.bicep @@ -24,19 +24,19 @@ param containerImagesRegistry string @description('Name of the Kubernetes Secret holding registry credentials for Radius.Compute/containerImages. Leave empty for an unauthenticated registry.') param containerImagesRegistrySecretName string = '' -@description('Server parameters forwarded verbatim to the AVM PostgreSQL flexible server configurations array for Radius.Data/postgreSqlDatabases, using the AVM item shape with name, source, and value fields. Defaults to disabling the `require_secure_transport` server parameter so the Recipe matches the Kubernetes Recipe for this Resource Type, whose `sslMode` output is always `disabled`. Commonly overridden to allow-list extensions via the azure.extensions parameter (for example to enable pgvector) or to re-enable `require_secure_transport`. See recipe-packs/azure/README.md for an example and a link to the supported extensions.') +@description('Server parameters forwarded verbatim to the AVM PostgreSQL flexible server configurations array for Radius.Data/postgreSqlDatabases, using the AVM item shape with name, source, and value fields. Defaults to `[{ name: "require_secure_transport", value: "ON" }]`, preserving the flexible server default so existing deployments keep requiring TLS. Commonly overridden to allow-list extensions via the azure.extensions parameter (for example to enable pgvector) or to disable `require_secure_transport` so this Recipe matches the Kubernetes Recipe for this Resource Type, whose `sslMode` output is always `disabled`. See recipe-packs/azure/README.md for an example and a link to the supported extensions.') param postgreSqlServerConfigurations array = [ { name: 'require_secure_transport' - value: 'OFF' + value: 'ON' } ] -@description('Server parameters forwarded verbatim to the AVM MySQL flexible server configurations array for Radius.Data/mySqlDatabases, using the AVM item shape with name, source, and value fields. Defaults to disabling the `require_secure_transport` server parameter so the Recipe matches the Kubernetes and AWS Recipes for this Resource Type, whose `sslMode` output is always `disabled`. Override to re-enable `require_secure_transport` if your application connects over TLS/SSL.') +@description('Server parameters forwarded verbatim to the AVM MySQL flexible server configurations array for Radius.Data/mySqlDatabases, using the AVM item shape with name, source, and value fields. Defaults to `[{ name: "require_secure_transport", value: "ON" }]`, preserving the flexible server default so existing deployments keep requiring TLS. Override to disable `require_secure_transport` if you want this Recipe to match the Kubernetes and AWS Recipes for this Resource Type, whose `sslMode` output is always `disabled`.') param mySqlServerConfigurations array = [ { name: 'require_secure_transport' - value: 'OFF' + value: 'ON' } ] From 2cba931cab3f636e79db36b1872e4c1a776e7efa Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 20 Aug 2026 16:21:27 +0000 Subject: [PATCH 4/7] Trigger CI re-run Co-authored-by: nellshamrell <813007+nellshamrell@users.noreply.github.com> From fc27a115bf385de907578814929d74a3e905d262 Mon Sep 17 00:00:00 2001 From: Nell Shamrell-Harrington Date: Thu, 20 Aug 2026 12:22:01 -0700 Subject: [PATCH 5/7] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Nell Shamrell-Harrington --- Data/postgreSqlDatabases/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Data/postgreSqlDatabases/README.md b/Data/postgreSqlDatabases/README.md index ef4eaeac..f81931ec 100644 --- a/Data/postgreSqlDatabases/README.md +++ b/Data/postgreSqlDatabases/README.md @@ -19,7 +19,7 @@ Developer documentation is embedded in the resource type definition YAML file an | `initSql` | string | Optional | Optional SQL script executed on first initialization to create tables, indexes, and seed data. | | `host` | string | Read only | The host name used to connect to the database. Set from the Recipe module's output. | | `port` | integer | Read only | The port number used to connect to the database. Set from the Recipe module's output. | -| `sslMode` | string (`required`, `disabled`) | Read only | Whether the database requires an encrypted (TLS/SSL) connection. The Kubernetes Recipe sets this to `disabled`. The Azure Recipe Pack keeps `require_secure_transport` `ON` by default and does not set this property; override the Recipe Pack's `postgreSqlServerConfigurations` parameter to disable it if you want Azure to match. | +| `sslMode` | string (`required`, `disabled`) | Read only | Whether the database requires an encrypted (TLS/SSL) connection. The Kubernetes Recipe sets this to `disabled`. The Azure Recipe Pack disables TLS enforcement by default by setting `require_secure_transport` to `OFF`; override the Recipe Pack's `postgreSqlServerConfigurations` parameter to set `require_secure_transport` to `ON` if you want Azure to require TLS. | ## Recipe Packs From 4a70739f58d641db048e2dd01745b3c87a40b755 Mon Sep 17 00:00:00 2001 From: Nell Shamrell-Harrington Date: Thu, 20 Aug 2026 12:22:16 -0700 Subject: [PATCH 6/7] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Signed-off-by: Nell Shamrell-Harrington --- Data/mySqlDatabases/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Data/mySqlDatabases/README.md b/Data/mySqlDatabases/README.md index 0a549cad..c41ba03f 100644 --- a/Data/mySqlDatabases/README.md +++ b/Data/mySqlDatabases/README.md @@ -18,7 +18,7 @@ Developer documentation is embedded in the resource type definition YAML file an | `version` | string (`5.7`, `8.0`, `8.4`) | Optional | The major MySQL server version. Defaults to `8.4`. | | `host` | string | Read only | The host name used to connect to the database. Set from the Recipe module's output. | | `port` | integer | Read only | The port number used to connect to the database. Set from the Recipe module's output. | -| `sslMode` | string (`required`, `disabled`) | Read only | Whether the database requires an encrypted (TLS/SSL) connection. The Kubernetes and AWS Recipes set this to `disabled`. The Azure Recipe Pack keeps `require_secure_transport` `ON` by default and does not set this property; override the Recipe Pack's `mySqlServerConfigurations` parameter to disable it if you want Azure to match. | +| `sslMode` | string (`required`, `disabled`) | Read only | Whether the database requires an encrypted (TLS/SSL) connection. The Kubernetes and AWS Recipes set this to `disabled`. The Azure Recipe Pack disables TLS enforcement by default by setting `require_secure_transport` to `OFF`; override the Recipe Pack's `mySqlServerConfigurations` parameter to set `require_secure_transport` to `ON` if you want Azure to require TLS. | ## Recipe Packs From 7520caf227c1565937e53da6fe1e7f23e4a06c3c Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 20 Aug 2026 19:24:35 +0000 Subject: [PATCH 7/7] Clarify that AVM configurations source field is optional Co-authored-by: nellshamrell <813007+nellshamrell@users.noreply.github.com> --- recipe-packs/azure/README.md | 4 ++-- recipe-packs/azure/aks-recipepack.bicep | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/recipe-packs/azure/README.md b/recipe-packs/azure/README.md index 0b98d5ef..c5eed451 100644 --- a/recipe-packs/azure/README.md +++ b/recipe-packs/azure/README.md @@ -48,8 +48,8 @@ The Azure pack accepts the provider configuration it needs to provision into you | `routesGatewayNamespace` | Namespace of the Gateway resource for `Radius.Compute/routes`. Defaults to `default`. | | `containerImagesRegistry` | Registry path (e.g. `ghcr.io/my-org`) that `Radius.Compute/containerImages` pushes built images to. | | `containerImagesRegistrySecretName` | Name of the Kubernetes Secret holding registry credentials for `Radius.Compute/containerImages`. Optional; leave empty for an unauthenticated registry. | -| `postgreSqlServerConfigurations` | Server parameters forwarded verbatim to the AVM PostgreSQL flexible server `configurations` array for `Radius.Data/postgreSqlDatabases`, using the AVM item shape `{ name, source, value }`. Defaults to `[{ name: 'require_secure_transport', value: 'ON' }]`, preserving the flexible server's default so existing deployments keep requiring TLS. Also commonly used to allow-list extensions via `azure.extensions` — for example `[{ name: 'require_secure_transport', value: 'ON' }, { name: 'azure.extensions', source: 'user-override', value: 'vector' }]` to enable pgvector while keeping the default TLS behavior — or to disable `require_secure_transport` so `Radius.Data/postgreSqlDatabases` matches the Kubernetes Recipe for this Resource Type, whose `sslMode` output is always `disabled` (see [issue #301](https://github.com/radius-project/resource-types-contrib/issues/301)). See [Extensions and modules by name in Azure Database for PostgreSQL flexible server](https://learn.microsoft.com/en-us/azure/postgresql/extensions/concepts-extensions-versions) for the supported extension names. Optional. | -| `mySqlServerConfigurations` | Server parameters forwarded verbatim to the AVM MySQL flexible server `configurations` array for `Radius.Data/mySqlDatabases`, using the AVM item shape `{ name, source, value }`. Defaults to `[{ name: 'require_secure_transport', value: 'ON' }]`, preserving the flexible server's default so existing deployments keep requiring TLS. Override to disable `require_secure_transport` so `Radius.Data/mySqlDatabases` matches the Kubernetes and AWS Recipes for this Resource Type, whose `sslMode` output is always `disabled` (see [issue #301](https://github.com/radius-project/resource-types-contrib/issues/301)). Optional. | +| `postgreSqlServerConfigurations` | Server parameters forwarded verbatim to the AVM PostgreSQL flexible server `configurations` array for `Radius.Data/postgreSqlDatabases`, using the AVM item shape `{ name, value }` with an optional `source` field. Defaults to `[{ name: 'require_secure_transport', value: 'ON' }]`, preserving the flexible server's default so existing deployments keep requiring TLS. Also commonly used to allow-list extensions via `azure.extensions` — for example `[{ name: 'require_secure_transport', value: 'ON' }, { name: 'azure.extensions', source: 'user-override', value: 'vector' }]` to enable pgvector while keeping the default TLS behavior — or to disable `require_secure_transport` so `Radius.Data/postgreSqlDatabases` matches the Kubernetes Recipe for this Resource Type, whose `sslMode` output is always `disabled` (see [issue #301](https://github.com/radius-project/resource-types-contrib/issues/301)). See [Extensions and modules by name in Azure Database for PostgreSQL flexible server](https://learn.microsoft.com/en-us/azure/postgresql/extensions/concepts-extensions-versions) for the supported extension names. Optional. | +| `mySqlServerConfigurations` | Server parameters forwarded verbatim to the AVM MySQL flexible server `configurations` array for `Radius.Data/mySqlDatabases`, using the AVM item shape `{ name, value }` with an optional `source` field. Defaults to `[{ name: 'require_secure_transport', value: 'ON' }]`, preserving the flexible server's default so existing deployments keep requiring TLS. Override to disable `require_secure_transport` so `Radius.Data/mySqlDatabases` matches the Kubernetes and AWS Recipes for this Resource Type, whose `sslMode` output is always `disabled` (see [issue #301](https://github.com/radius-project/resource-types-contrib/issues/301)). Optional. | ## Deploying diff --git a/recipe-packs/azure/aks-recipepack.bicep b/recipe-packs/azure/aks-recipepack.bicep index acc2cc22..2e1b312c 100644 --- a/recipe-packs/azure/aks-recipepack.bicep +++ b/recipe-packs/azure/aks-recipepack.bicep @@ -24,7 +24,7 @@ param containerImagesRegistry string @description('Name of the Kubernetes Secret holding registry credentials for Radius.Compute/containerImages. Leave empty for an unauthenticated registry.') param containerImagesRegistrySecretName string = '' -@description('Server parameters forwarded verbatim to the AVM PostgreSQL flexible server configurations array for Radius.Data/postgreSqlDatabases, using the AVM item shape with name, source, and value fields. Defaults to `[{ name: "require_secure_transport", value: "ON" }]`, preserving the flexible server default so existing deployments keep requiring TLS. Commonly overridden to allow-list extensions via the azure.extensions parameter (for example to enable pgvector) or to disable `require_secure_transport` so this Recipe matches the Kubernetes Recipe for this Resource Type, whose `sslMode` output is always `disabled`. See recipe-packs/azure/README.md for an example and a link to the supported extensions.') +@description('Server parameters forwarded verbatim to the AVM PostgreSQL flexible server configurations array for Radius.Data/postgreSqlDatabases, using the AVM item shape with name and value fields plus an optional source field. Defaults to `[{ name: "require_secure_transport", value: "ON" }]`, preserving the flexible server default so existing deployments keep requiring TLS. Commonly overridden to allow-list extensions via the azure.extensions parameter (for example to enable pgvector) or to disable `require_secure_transport` so this Recipe matches the Kubernetes Recipe for this Resource Type, whose `sslMode` output is always `disabled`. See recipe-packs/azure/README.md for an example and a link to the supported extensions.') param postgreSqlServerConfigurations array = [ { name: 'require_secure_transport' @@ -32,7 +32,7 @@ param postgreSqlServerConfigurations array = [ } ] -@description('Server parameters forwarded verbatim to the AVM MySQL flexible server configurations array for Radius.Data/mySqlDatabases, using the AVM item shape with name, source, and value fields. Defaults to `[{ name: "require_secure_transport", value: "ON" }]`, preserving the flexible server default so existing deployments keep requiring TLS. Override to disable `require_secure_transport` if you want this Recipe to match the Kubernetes and AWS Recipes for this Resource Type, whose `sslMode` output is always `disabled`.') +@description('Server parameters forwarded verbatim to the AVM MySQL flexible server configurations array for Radius.Data/mySqlDatabases, using the AVM item shape with name and value fields plus an optional source field. Defaults to `[{ name: "require_secure_transport", value: "ON" }]`, preserving the flexible server default so existing deployments keep requiring TLS. Override to disable `require_secure_transport` if you want this Recipe to match the Kubernetes and AWS Recipes for this Resource Type, whose `sslMode` output is always `disabled`.') param mySqlServerConfigurations array = [ { name: 'require_secure_transport'