nellshamrell · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026
@@ -10,11 +10,13 @@ The Radius Demo application runs on its own, but most applications depend on oth
 
 ## Add a PostgreSQL database and connections
 
+> **Private development only:** This Kubernetes demo sets the database's `tls` policy to `disabled` and the PostgreSQL client's `PGSSLMODE` to `disable`. Password authentication remains enabled, but database traffic is unencrypted and credentials and queries can be exposed in transit. Use only a private, disposable development cluster.
+
 The `app-postgresql.bicep` definition builds on `app.bicep` by adding a `Radius.Data/postgreSqlDatabases` resource, a `Radius.Security/secrets` resource, a `@secure()` password parameter, and two `connections` entries on the container. The highlighted lines are the additions:
 
 <div class="td-max-width-on-larger-screens" style="margin-bottom: -2rem;"><a href="https://github.com/radius-project/samples/blob/{{< param version >}}/samples/demo/app-postgresql.bicep" target="_blank" rel="noopener">samples/demo/app-postgresql.bicep</a></div>
 
-{{< rad file="/static/samples/demo/app-postgresql.bicep" embed=true markdownConfig=` {hl_lines=["6-8","36-43","47-57","59-70"]}` >}}
+{{< rad file="/static/samples/demo/app-postgresql.bicep" embed=true markdownConfig=` {hl_lines=["6-8","29-33","41-48","52-63","65-76"]}` >}}
 
 The `postgresql` resource is provisioned by the PostgreSQL Recipe in the default Recipe Pack. The `password` parameter is declared with `@secure()`, which keeps its value out of deployment logs and history and lets you supply the password at deploy time instead of hardcoding it. The application passes that value directly to the database's `password` property. Because the property is `x-radius-sensitive`, Radius encrypts it and redacts it from reads.
 

@@ -12,6 +12,8 @@ In part one, you will install Radius on an existing Kubernetes cluster.
 
 For this guide you only need a **Kubernetes cluster**. To install Radius, your user must have the cluster-admin role. Radius <a href="{{< ref "installation#supported-kubernetes-clusters" >}}">supports</a> <a href="https://azure.microsoft.com/en-us/products/kubernetes-service">AKS</a>, <a href="https://aws.amazon.com/eks/">EKS</a>, <a href="https://k3d.io/">k3d</a>, and <a href="https://kind.sigs.k8s.io/">kind</a> clusters. Running a local cluster with k3d or kind is recommended.
 
+> **PostgreSQL TLS prerequisite:** The database step explicitly disables TLS. Use a private, disposable Kubernetes cluster; do not expose the demo or database publicly.
+
 ## Install the Radius CLI
 
 {{< read file="/shared-content/installation/rad-cli/install-rad-cli.md" >}}

@@ -62,34 +62,48 @@ git::https://github.com/my-org/modules.git//rds?ref=v6.1.0
 
 {{% codetab %}}
 
-Bicep modules are referenced by their OCI registry path, with the version in the image tag. For example, reference an Azure Verified Module from the Microsoft Container Registry:
+Bicep modules are referenced by their OCI registry path, with the version in the image tag. This example uses the Azure Storage Account AVM to provision a blob container for [`Radius.Storage/objectStorage`]({{< ref "/reference/resources/radius.storage/2025-08-01-preview/objectstorage" >}}):
 
 ```bicep
 extension radius
 
 resource dataRecipes 'Radius.Core/recipePacks@2025-08-01-preview' = {
-  name: 'azure-data-recipes'
+  name: 'azure-storage-recipes'
   properties: {
     recipes: {
-      'Radius.Data/postgreSqlDatabases': {
+      'Radius.Storage/objectStorage': {
         kind: 'bicep'
-        source: 'br:mcr.microsoft.com/bicep/avm/res/db-for-postgre-sql/flexible-server:0.4.0'
+        source: 'br:mcr.microsoft.com/bicep/avm/res/storage/storage-account:0.32.1'
         parameters: {
-          name: 'pg-{{context.resource.name}}'
+          name: '{{context.resource.name}}'
           location: 'eastus2'
-          skuName: 'Standard_B1ms'
+          kind: 'StorageV2'
+          skuName: 'Standard_LRS'
+          allowBlobPublicAccess: false
+          blobServices: {
+            containers: [
+              {
+                name: '{{context.resource.properties.containerName}}'
+              }
+            ]
+          }
         }
         outputs: {
-          host: 'fqdn'
-          port: 'port'
-          database: 'name'
+          endpoint: 'primaryBlobEndpoint'
+          accountName: 'name'
+          secrets: {
+            accountKey: 'primaryAccessKey'
+            connectionString: 'primaryConnectionString'
+          }
         }
       }
     }
   }
 }
 ```
 
+The resource's name becomes the Azure storage account name, so choose a globally unique name with 3 to 24 lowercase letters or digits. The `containerName` property selects the blob container. The nested `secrets` mapping sends the account key and connection string to Radius-managed secret storage rather than ordinary resource properties. The module retains its default network access restrictions; configure access for your application separately.
+
 {{% /codetab %}}
 
 {{< /tabs >}}

@@ -73,7 +73,7 @@ The connection automatically injects environment variables into the container fo
 | `password` | string | (Required) The administrator password for the PostgreSQL database. Marked `x-radius-sensitive`: Radius encrypts it at rest, redacts it on reads, and exposes it decrypted only to the recipe as `{{context.resource.properties.password}}`. |
 | `port` | integer | (Optional) The TCP port used to connect to the database. Defaults to `5432`, the standard PostgreSQL port that every Recipe in this repository provisions and the port PostgreSQL flexible server is fixed to. A Recipe that provisions the database on a different port reports the real port as an output, which overwrites this value once the deployment finishes. Setting it in an application definition changes only the value reported to connected containers, never the port the server listens on, so leave it unset. |
 | `size` | string | (Optional) The size of the PostgreSQL database. Defaults to `S` if not provided.<br />Allowed values: `L`, `M`, `S`. |
-| `tls` | string | (Optional) The requested transport policy for database connections. Configure your client using `CONNECTION_POSTGRESQL_TLS`. Defaults to `required`. Use `optional` only when the server is not publicly reachable; it permits connections without TLS.<br />Allowed values: `optional`, `required`. |
+| `tls` | string | (Optional) Transport policy, projected as CONNECTION_POSTGRESQL_TLS. Defaults to required (TLS only). On Kubernetes, optional supports TLS and plaintext; both modes require an operator-owned TLS Secret. Explicit disabled is Kubernetes-only: plaintext only, with no certificate requirement. Use optional/disabled only on isolated private networks. Configure trusted CA certificates and hostname verification separately. The guarded Azure PostgreSQL recipe rejects disabled; direct AVM calls bypass this validation. Azure operator overrides retain precedence for required/optional, so the projected value reports the requested policy, not the effective server setting.<br />Allowed values: `disabled`, `optional`, `required`. |
 | `username` | string | (Required) The administrator username for the PostgreSQL database. Provided directly on the resource and passed to the recipe as `{{context.resource.properties.username}}`. |
 
 ## Object Properties

@@ -26,6 +26,11 @@ resource demoContainer 'Radius.Compute/containers@2025-08-01-preview' = {
     containers: {
       web: {
         image: 'ghcr.io/radius-project/samples/demo:latest'
+        env: {
+          PGSSLMODE: {
+            value: 'disable'
+          }
+        }
         ports: {
           web: {
             containerPort: 3000
@@ -50,6 +55,7 @@ resource postgresql 'Radius.Data/postgreSqlDatabases@2025-08-01-preview' = {
     environment: environment
     application: demoApp.id
     size: 'S'
+    tls: 'disabled'
     database: 'appdb'
     username: 'myadmin'
     password: password