Expose sslMode contract and align Azure TLS behavior for mySqlDatabases/postgreSqlDatabases

Data/mySqlDatabases/README.md

@@ -18,6 +18,7 @@ Developer documentation is embedded in the resource type definition YAML file an
 | `version` | string (`5.7`, `8.0`, `8.4`) | Optional | The major MySQL server version. Defaults to `8.4`. |
 | `host` | string | Read only | The host name used to connect to the database. Set from the Recipe module's output. |
 | `port` | integer | Read only | The port number used to connect to the database. Set from the Recipe module's output. |
+| `sslMode` | string (`required`, `disabled`) | Read only | Whether the database requires an encrypted (TLS/SSL) connection. The Kubernetes and AWS Recipes set this to `disabled`. The Azure Recipe Pack disables TLS enforcement by default by setting `require_secure_transport` to `OFF`; override the Recipe Pack's `mySqlServerConfigurations` parameter to set `require_secure_transport` to `ON` if you want Azure to require TLS. |
 
 ## Recipe Packs
 
@@ -29,4 +30,4 @@ Recipes for this resource type are provided through the platform Recipe Packs at
 
 ## Using the resource type
 
-Add a `mySqlDatabases` resource to your application and connect a container to it. Radius injects the database's connection properties into the container as environment variables named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>` (for example `CONNECTION_MYSQLDB_HOST`, `CONNECTION_MYSQLDB_PORT`, and `CONNECTION_MYSQLDB_DATABASE`). See [`test/app.bicep`](test/app.bicep) for a complete example.
+Add a `mySqlDatabases` resource to your application and connect a container to it. Radius injects the database's connection properties into the container as environment variables named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>` (for example `CONNECTION_MYSQLDB_HOST`, `CONNECTION_MYSQLDB_PORT`, `CONNECTION_MYSQLDB_DATABASE`, and `CONNECTION_MYSQLDB_SSLMODE`). See [`test/app.bicep`](test/app.bicep) for a complete example.

Data/mySqlDatabases/mySqlDatabases.yaml

@@ -51,6 +51,9 @@ types:
       - CONNECTION_MYSQLDB_DATABASE
       - CONNECTION_MYSQLDB_HOST
       - CONNECTION_MYSQLDB_PORT
+      - CONNECTION_MYSQLDB_SSLMODE
+
+      The Kubernetes and AWS Recipes for this Resource Type provision the database so `sslMode` is `disabled`. The Azure Recipe Pack keeps the flexible server's `require_secure_transport` setting `ON` by default (matching Azure's own default), so `sslMode` is left unset when deployed through that Recipe; configure your client accordingly, or override the Azure Recipe Pack's `mySqlServerConfigurations` parameter to disable `require_secure_transport` if you want Azure to match the Kubernetes and AWS Recipes.
 
     apiVersions:
       '2025-08-01-preview':
@@ -87,4 +90,9 @@ types:
               type: integer
               description: The port number used to connect to the database. Mapped from the recipe module's output (MySQL flexible server uses 3306).
               readOnly: true
+            sslMode:
+              type: string
+              enum: ['required', 'disabled']
+              description: (Read Only) Whether the database requires an encrypted (TLS/SSL) connection. Mapped from the recipe module's output. `required` means clients must connect over TLS/SSL; `disabled` means the Recipe does not enforce it. Configure your client accordingly rather than assuming a particular transport.
+              readOnly: true
           required: [environment,username,password]

Data/mySqlDatabases/recipes/aws/terraform/main.tf

@@ -134,6 +134,7 @@ output "result" {
       host     = module.db.db_instance_address
       port     = module.db.db_instance_port
       database = local.sanitized_database
+      sslMode  = "disabled"
     }
   }
 }

Data/mySqlDatabases/recipes/kubernetes/bicep/kubernetes-mysql.bicep

@@ -162,6 +162,7 @@ output result object = {
     host: '${svc.metadata.name}.${svc.metadata.namespace}.svc.cluster.local'
     port: port
     database: database
+    sslMode: 'disabled'
   }
   secrets: {
     password: password

Data/postgreSqlDatabases/README.md

@@ -19,6 +19,7 @@ Developer documentation is embedded in the resource type definition YAML file an
 | `initSql` | string | Optional | Optional SQL script executed on first initialization to create tables, indexes, and seed data. |
 | `host` | string | Read only | The host name used to connect to the database. Set from the Recipe module's output. |
 | `port` | integer | Read only | The port number used to connect to the database. Set from the Recipe module's output. |
+| `sslMode` | string (`required`, `disabled`) | Read only | Whether the database requires an encrypted (TLS/SSL) connection. The Kubernetes Recipe sets this to `disabled`. The Azure Recipe Pack disables TLS enforcement by default by setting `require_secure_transport` to `OFF`; override the Recipe Pack's `postgreSqlServerConfigurations` parameter to set `require_secure_transport` to `ON` if you want Azure to require TLS. |
 
 ## Recipe Packs
 
@@ -30,4 +31,4 @@ Recipes for this resource type are provided through the platform Recipe Packs at
 
 ## Using the resource type
 
-Add a `postgreSqlDatabases` resource to your application and connect a container to it. Radius injects the database's connection properties into the container as environment variables named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>` (for example `CONNECTION_POSTGRES_HOST`, `CONNECTION_POSTGRES_PORT`, and `CONNECTION_POSTGRES_DATABASE`). See [`test/app.bicep`](test/app.bicep) for a complete example.
+Add a `postgreSqlDatabases` resource to your application and connect a container to it. Radius injects the database's connection properties into the container as environment variables named `CONNECTION_<CONNECTION-NAME>_<PROPERTY-NAME>` (for example `CONNECTION_POSTGRES_HOST`, `CONNECTION_POSTGRES_PORT`, `CONNECTION_POSTGRES_DATABASE`, and `CONNECTION_POSTGRES_SSLMODE`). See [`test/app.bicep`](test/app.bicep) for a complete example.

Data/postgreSqlDatabases/postgreSqlDatabases.yaml

@@ -51,6 +51,9 @@ types:
       - CONNECTION_POSTGRESQL_DATABASE
       - CONNECTION_POSTGRESQL_HOST
       - CONNECTION_POSTGRESQL_PORT
+      - CONNECTION_POSTGRESQL_SSLMODE
+
+      The Kubernetes Recipe for this Resource Type provisions the database so `sslMode` is `disabled`. The Azure Recipe Pack keeps the flexible server's `require_secure_transport` setting `ON` by default (matching Azure's own default), so `sslMode` is left unset when deployed through that Recipe; configure your client accordingly, or override the Azure Recipe Pack's `postgreSqlServerConfigurations` parameter to disable `require_secure_transport` if you want Azure to match the Kubernetes Recipe.
 
     apiVersions:
       '2025-08-01-preview':
@@ -90,4 +93,9 @@ types:
               type: string
               description: The port number used to connect to the database.
               readOnly: true
+            sslMode:
+              type: string
+              enum: ['required', 'disabled']
+              description: (Read Only) Whether the database requires an encrypted (TLS/SSL) connection. Mapped from the recipe module's output. `required` means clients must connect over TLS/SSL; `disabled` means the Recipe does not enforce it. Configure your client accordingly rather than assuming a particular transport.
+              readOnly: true
           required: [environment,username,password]

Data/postgreSqlDatabases/recipes/kubernetes/bicep/kubernetes-postgresql.bicep

@@ -206,6 +206,7 @@ output result object = {
     host: '${svc.metadata.name}.${svc.metadata.namespace}.svc.cluster.local'
     port: port
     database: database
+    sslMode: 'disabled'
   }
   secrets: {
     password: password

Data/postgreSqlDatabases/recipes/kubernetes/terraform/main.tf

@@ -161,6 +161,7 @@ output "result" {
       host     = "${kubernetes_service.postgres.metadata[0].name}.${kubernetes_service.postgres.metadata[0].namespace}.svc.cluster.local"
       port     = local.port
       database = local.database
+      sslMode  = "disabled"
     }
     secrets = {
       password         = local.password

recipe-packs/azure/README.md

@@ -48,7 +48,8 @@ The Azure pack accepts the provider configuration it needs to provision into you
 | `routesGatewayNamespace` | Namespace of the Gateway resource for `Radius.Compute/routes`. Defaults to `default`. |
 | `containerImagesRegistry` | Registry path (e.g. `ghcr.io/my-org`) that `Radius.Compute/containerImages` pushes built images to. |
 | `containerImagesRegistrySecretName` | Name of the Kubernetes Secret holding registry credentials for `Radius.Compute/containerImages`. Optional; leave empty for an unauthenticated registry. |
-| `postgreSqlServerConfigurations` | Server parameters forwarded verbatim to the AVM PostgreSQL flexible server `configurations` array for `Radius.Data/postgreSqlDatabases`, using the AVM item shape `{ name, source, value }`. Most commonly used to allow-list extensions via `azure.extensions` — for example `[{ name: 'azure.extensions', source: 'user-override', value: 'vector' }]` to enable pgvector. See [Extensions and modules by name in Azure Database for PostgreSQL flexible server](https://learn.microsoft.com/en-us/azure/postgresql/extensions/concepts-extensions-versions) for the supported extension names. Optional; defaults to an empty array (no extra server configuration). |
+| `postgreSqlServerConfigurations` | Server parameters forwarded verbatim to the AVM PostgreSQL flexible server `configurations` array for `Radius.Data/postgreSqlDatabases`, using the AVM item shape `{ name, value }` with an optional `source` field. Defaults to `[{ name: 'require_secure_transport', value: 'ON' }]`, preserving the flexible server's default so existing deployments keep requiring TLS. Also commonly used to allow-list extensions via `azure.extensions` — for example `[{ name: 'require_secure_transport', value: 'ON' }, { name: 'azure.extensions', source: 'user-override', value: 'vector' }]` to enable pgvector while keeping the default TLS behavior — or to disable `require_secure_transport` so `Radius.Data/postgreSqlDatabases` matches the Kubernetes Recipe for this Resource Type, whose `sslMode` output is always `disabled` (see [issue #301](https://github.com/radius-project/resource-types-contrib/issues/301)). See [Extensions and modules by name in Azure Database for PostgreSQL flexible server](https://learn.microsoft.com/en-us/azure/postgresql/extensions/concepts-extensions-versions) for the supported extension names. Optional. |
+| `mySqlServerConfigurations` | Server parameters forwarded verbatim to the AVM MySQL flexible server `configurations` array for `Radius.Data/mySqlDatabases`, using the AVM item shape `{ name, value }` with an optional `source` field. Defaults to `[{ name: 'require_secure_transport', value: 'ON' }]`, preserving the flexible server's default so existing deployments keep requiring TLS. Override to disable `require_secure_transport` so `Radius.Data/mySqlDatabases` matches the Kubernetes and AWS Recipes for this Resource Type, whose `sslMode` output is always `disabled` (see [issue #301](https://github.com/radius-project/resource-types-contrib/issues/301)). Optional. |
 
 ## Deploying
 

recipe-packs/azure/aks-recipepack.bicep

@@ -24,8 +24,21 @@ param containerImagesRegistry string
 @description('Name of the Kubernetes Secret holding registry credentials for Radius.Compute/containerImages. Leave empty for an unauthenticated registry.')
 param containerImagesRegistrySecretName string = ''
 
-@description('Server parameters forwarded verbatim to the AVM PostgreSQL flexible server configurations array for Radius.Data/postgreSqlDatabases, using the AVM item shape with name, source, and value fields. Commonly used to allow-list extensions via the azure.extensions parameter (for example to enable pgvector). See recipe-packs/azure/README.md for an example and a link to the supported extensions. Defaults to an empty array (no extra server configuration).')
-param postgreSqlServerConfigurations array = []
+@description('Server parameters forwarded verbatim to the AVM PostgreSQL flexible server configurations array for Radius.Data/postgreSqlDatabases, using the AVM item shape with name and value fields plus an optional source field. Defaults to `[{ name: "require_secure_transport", value: "ON" }]`, preserving the flexible server default so existing deployments keep requiring TLS. Commonly overridden to allow-list extensions via the azure.extensions parameter (for example to enable pgvector) or to disable `require_secure_transport` so this Recipe matches the Kubernetes Recipe for this Resource Type, whose `sslMode` output is always `disabled`. See recipe-packs/azure/README.md for an example and a link to the supported extensions.')
+param postgreSqlServerConfigurations array = [
+  {
+    name: 'require_secure_transport'
+    value: 'ON'
+  }
+]
+
+@description('Server parameters forwarded verbatim to the AVM MySQL flexible server configurations array for Radius.Data/mySqlDatabases, using the AVM item shape with name and value fields plus an optional source field. Defaults to `[{ name: "require_secure_transport", value: "ON" }]`, preserving the flexible server default so existing deployments keep requiring TLS. Override to disable `require_secure_transport` if you want this Recipe to match the Kubernetes and AWS Recipes for this Resource Type, whose `sslMode` output is always `disabled`.')
+param mySqlServerConfigurations array = [
+  {
+    name: 'require_secure_transport'
+    value: 'ON'
+  }
+]
 
 resource recipes 'Radius.Core/recipePacks@2025-08-01-preview' = {
   name: 'azure-avm'
@@ -174,6 +187,7 @@ resource recipes 'Radius.Core/recipePacks@2025-08-01-preview' = {
           lock: {
             kind: 'None'
           }
+          configurations: mySqlServerConfigurations
         }
         outputs: {
           host: 'fqdn'