feat: add AWS IAM database authentication for MySQL and PostgreSQL

apis/cluster/mysql/v1alpha1/provider_types.go

@@ -42,6 +42,8 @@ type ProviderConfigSpec struct {
 }
 
 // TLSConfig defines the TLS configuration for the provider when tls=custom.
+// CACert verifies the server. ClientCert and ClientKey are optional and must
+// be supplied together when the server requires mutual TLS.
 type TLSConfig struct {
 	CACert             TLSSecret `json:"caCert,omitempty"`
 	ClientCert         TLSSecret `json:"clientCert,omitempty"`
@@ -59,12 +61,17 @@ const (
 	// should acquire credentials from a connection secret written by a managed
 	// resource that represents a MySQL server.
 	CredentialsSourceMySQLConnectionSecret xpv2.CredentialsSource = "MySQLConnectionSecret"
+
+	// CredentialsSourceAWSIAMAuth indicates that the provider should
+	// authenticate to an AWS RDS/Aurora instance using an IAM authentication
+	// token generated at connection time, instead of a static password.
+	CredentialsSourceAWSIAMAuth xpv2.CredentialsSource = "AWSIAMAuth"
 )
 
 // ProviderCredentials required to authenticate.
 type ProviderCredentials struct {
 	// Source of the provider credentials.
-	// +kubebuilder:validation:Enum=MySQLConnectionSecret
+	// +kubebuilder:validation:Enum=MySQLConnectionSecret;AWSIAMAuth
 	Source xpv2.CredentialsSource `json:"source"`
 
 	// A CredentialsSecretRef is a reference to a MySQL connection secret
@@ -77,6 +84,12 @@ type ProviderCredentials struct {
 	// standard Crossplane keys are used: "endpoint", "port", "username", "password".
 	// +optional
 	SecretKeyMapping *SecretKeyMapping `json:"secretKeyMapping,omitempty"`
+
+	// Region is the AWS region used to generate the IAM authentication token
+	// when source is AWSIAMAuth. When unset it falls back to a "region" key in
+	// the connection secret, then to the controller's AWS environment.
+	// +optional
+	Region *string `json:"region,omitempty"`
 }
 
 // SecretKeyMapping allows overriding the default secret key names used to

apis/cluster/postgresql/v1alpha1/provider_types.go

@@ -23,6 +23,7 @@ import (
 )
 
 // A ProviderConfigSpec defines the desired state of a ProviderConfig.
+// +kubebuilder:validation:XValidation:rule="!has(self.tlsConfig) || (has(self.sslMode) && self.sslMode in ['verify-ca', 'verify-full'])",message="tlsConfig requires sslMode verify-ca or verify-full"
 type ProviderConfigSpec struct {
 	// Credentials required to authenticate to this provider.
 	Credentials ProviderCredentials `json:"credentials"`
@@ -36,19 +37,41 @@ type ProviderConfigSpec struct {
 	// +kubebuilder:default=verify-full
 	// +kubebuilder:validation:Optional
 	SSLMode *string `json:"sslMode,omitempty"`
+
+	// TLSConfig selects the CA bundle used to verify the PostgreSQL server.
+	// When set, sslMode must be verify-ca or verify-full.
+	// +optional
+	TLSConfig *TLSConfig `json:"tlsConfig,omitempty"`
+}
+
+// TLSConfig selects the CA bundle for PostgreSQL server verification.
+type TLSConfig struct {
+	// CACert contains the PEM-encoded certificates trusted for this connection.
+	CACert TLSSecret `json:"caCert"`
+}
+
+// TLSSecret selects a Secret key containing a PEM certificate bundle.
+type TLSSecret struct {
+	// SecretRef selects the CA bundle. Namespace, name and key are required.
+	SecretRef xpv2.SecretKeySelector `json:"secretRef"`
 }
 
 const (
 	// CredentialsSourcePostgreSQLConnectionSecret indicates that a provider
 	// should acquire credentials from a connection secret written by a managed
 	// resource that represents a PostgreSQL server.
 	CredentialsSourcePostgreSQLConnectionSecret xpv2.CredentialsSource = "PostgreSQLConnectionSecret"
+
+	// CredentialsSourceAWSIAMAuth indicates that the provider should
+	// authenticate to an AWS RDS/Aurora instance using an IAM authentication
+	// token generated at connection time, instead of a static password.
+	CredentialsSourceAWSIAMAuth xpv2.CredentialsSource = "AWSIAMAuth"
 )
 
 // ProviderCredentials required to authenticate.
 type ProviderCredentials struct {
 	// Source of the provider credentials.
-	// +kubebuilder:validation:Enum=PostgreSQLConnectionSecret
+	// +kubebuilder:validation:Enum=PostgreSQLConnectionSecret;AWSIAMAuth
 	Source xpv2.CredentialsSource `json:"source"`
 
 	// A CredentialsSecretRef is a reference to a PostgreSQL connection secret
@@ -61,6 +84,12 @@ type ProviderCredentials struct {
 	// standard Crossplane keys are used: "endpoint", "port", "username", "password".
 	// +optional
 	SecretKeyMapping *SecretKeyMapping `json:"secretKeyMapping,omitempty"`
+
+	// Region is the AWS region used to generate the IAM authentication token
+	// when source is AWSIAMAuth. When unset it falls back to a "region" key in
+	// the connection secret, then to the controller's AWS environment.
+	// +optional
+	Region *string `json:"region,omitempty"`
 }
 
 // SecretKeyMapping allows overriding the default secret key names used to

apis/namespaced/mysql/v1alpha1/cluster_provider_types.go

@@ -45,7 +45,7 @@ type ClusterProviderConfigSpec struct {
 // ClusterProviderCredentials required to authenticate.
 type ClusterProviderCredentials struct {
 	// Source of the provider credentials.
-	// +kubebuilder:validation:Enum=MySQLConnectionSecret
+	// +kubebuilder:validation:Enum=MySQLConnectionSecret;AWSIAMAuth
 	Source MySQLConnectionSecretSource `json:"source"`
 
 	// A CredentialsSecretRef is a reference to a MySQL connection secret
@@ -58,6 +58,12 @@ type ClusterProviderCredentials struct {
 	// standard Crossplane keys are used: "endpoint", "port", "username", "password".
 	// +optional
 	SecretKeyMapping *SecretKeyMapping `json:"secretKeyMapping,omitempty"`
+
+	// Region is the AWS region used to generate the IAM authentication token
+	// when source is AWSIAMAuth. When unset it falls back to a "region" key in
+	// the connection secret, then to the controller's AWS environment.
+	// +optional
+	Region *string `json:"region,omitempty"`
 }
 
 // A ClusterProviderConfigStatus reflects the observed state of a ClusterProviderConfig.

apis/namespaced/mysql/v1alpha1/provider_types.go

@@ -42,6 +42,8 @@ type ProviderConfigSpec struct {
 }
 
 // TLSConfig defines the TLS configuration for the provider when tls=custom.
+// CACert verifies the server. ClientCert and ClientKey are optional and must
+// be supplied together when the server requires mutual TLS.
 type TLSConfig struct {
 	CACert             TLSSecret `json:"caCert,omitempty"`
 	ClientCert         TLSSecret `json:"clientCert,omitempty"`
@@ -61,12 +63,17 @@ const (
 	// should acquire credentials from a connection secret written by a managed
 	// resource that represents a MySQL server.
 	CredentialsSourceMySQLConnectionSecret MySQLConnectionSecretSource = "MySQLConnectionSecret"
+
+	// CredentialsSourceAWSIAMAuth indicates that the provider should
+	// authenticate to an AWS RDS/Aurora instance using an IAM authentication
+	// token generated at connection time, instead of a static password.
+	CredentialsSourceAWSIAMAuth MySQLConnectionSecretSource = "AWSIAMAuth"
 )
 
 // ProviderCredentials required to authenticate.
 type ProviderCredentials struct {
 	// Source of the provider credentials.
-	// +kubebuilder:validation:Enum=MySQLConnectionSecret
+	// +kubebuilder:validation:Enum=MySQLConnectionSecret;AWSIAMAuth
 	Source MySQLConnectionSecretSource `json:"source"`
 
 	// A CredentialsSecretRef is a reference to a MySQL connection secret
@@ -79,6 +86,12 @@ type ProviderCredentials struct {
 	// standard Crossplane keys are used: "endpoint", "port", "username", "password".
 	// +optional
 	SecretKeyMapping *SecretKeyMapping `json:"secretKeyMapping,omitempty"`
+
+	// Region is the AWS region used to generate the IAM authentication token
+	// when source is AWSIAMAuth. When unset it falls back to a "region" key in
+	// the connection secret, then to the controller's AWS environment.
+	// +optional
+	Region *string `json:"region,omitempty"`
 }
 
 // SecretKeyMapping allows overriding the default secret key names used to

apis/namespaced/postgresql/v1alpha1/cluster_provider_types.go

@@ -23,6 +23,7 @@ import (
 )
 
 // A ClusterProviderConfigSpec defines the desired state of a ClusterProviderConfig.
+// +kubebuilder:validation:XValidation:rule="!has(self.tlsConfig) || (has(self.sslMode) && self.sslMode in ['verify-ca', 'verify-full'])",message="tlsConfig requires sslMode verify-ca or verify-full"
 type ClusterProviderConfigSpec struct {
 	// Credentials required to authenticate to this provider.
 	Credentials ClusterProviderCredentials `json:"credentials"`
@@ -36,12 +37,29 @@ type ClusterProviderConfigSpec struct {
 	// +kubebuilder:default=verify-full
 	// +kubebuilder:validation:Optional
 	SSLMode *string `json:"sslMode,omitempty"`
+
+	// TLSConfig selects the CA bundle used to verify the PostgreSQL server.
+	// When set, sslMode must be verify-ca or verify-full.
+	// +optional
+	TLSConfig *ClusterTLSConfig `json:"tlsConfig,omitempty"`
+}
+
+// ClusterTLSConfig selects the CA bundle for a ClusterProviderConfig.
+type ClusterTLSConfig struct {
+	// CACert contains the PEM-encoded certificates trusted for this connection.
+	CACert ClusterTLSSecret `json:"caCert"`
+}
+
+// ClusterTLSSecret selects a Secret key for a cluster-scoped configuration.
+type ClusterTLSSecret struct {
+	// SecretRef selects the CA bundle. Namespace, name and key are required.
+	SecretRef xpv2.SecretKeySelector `json:"secretRef"`
 }
 
 // ClusterProviderCredentials required to authenticate.
 type ClusterProviderCredentials struct {
 	// Source of the provider credentials.
-	// +kubebuilder:validation:Enum=PostgreSQLConnectionSecret
+	// +kubebuilder:validation:Enum=PostgreSQLConnectionSecret;AWSIAMAuth
 	Source PostgreSQLConnectionSource `json:"source"`
 
 	// A CredentialsSecretRef is a reference to a PostgreSQL connection secret
@@ -54,6 +72,12 @@ type ClusterProviderCredentials struct {
 	// standard Crossplane keys are used: "endpoint", "port", "username", "password".
 	// +optional
 	SecretKeyMapping *SecretKeyMapping `json:"secretKeyMapping,omitempty"`
+
+	// Region is the AWS region used to generate the IAM authentication token
+	// when source is AWSIAMAuth. When unset it falls back to a "region" key in
+	// the connection secret, then to the controller's AWS environment.
+	// +optional
+	Region *string `json:"region,omitempty"`
 }
 
 // A ClusterProviderConfigStatus reflects the observed state of a ClusterProviderConfig.

apis/namespaced/postgresql/v1alpha1/provider_types.go

@@ -23,6 +23,7 @@ import (
 )
 
 // A ProviderConfigSpec defines the desired state of a ProviderConfig.
+// +kubebuilder:validation:XValidation:rule="!has(self.tlsConfig) || (has(self.sslMode) && self.sslMode in ['verify-ca', 'verify-full'])",message="tlsConfig requires sslMode verify-ca or verify-full"
 type ProviderConfigSpec struct {
 	// Credentials required to authenticate to this provider.
 	Credentials ProviderCredentials `json:"credentials"`
@@ -36,6 +37,23 @@ type ProviderConfigSpec struct {
 	// +kubebuilder:default=verify-full
 	// +kubebuilder:validation:Optional
 	SSLMode *string `json:"sslMode,omitempty"`
+
+	// TLSConfig selects the CA bundle used to verify the PostgreSQL server.
+	// When set, sslMode must be verify-ca or verify-full.
+	// +optional
+	TLSConfig *TLSConfig `json:"tlsConfig,omitempty"`
+}
+
+// TLSConfig selects the CA bundle for PostgreSQL server verification.
+type TLSConfig struct {
+	// CACert contains the PEM-encoded certificates trusted for this connection.
+	CACert TLSSecret `json:"caCert"`
+}
+
+// TLSSecret selects a Secret key containing a PEM certificate bundle.
+type TLSSecret struct {
+	// SecretRef selects the CA bundle. The Secret must be in the ProviderConfig namespace.
+	SecretRef xpv2.LocalSecretKeySelector `json:"secretRef"`
 }
 
 type PostgreSQLConnectionSource string
@@ -45,12 +63,17 @@ const (
 	// should acquire credentials from a connection secret written by a managed
 	// resource that represents a PostgreSQL server.
 	CredentialsSourcePostgreSQLConnectionSecret PostgreSQLConnectionSource = "PostgreSQLConnectionSecret"
+
+	// CredentialsSourceAWSIAMAuth indicates that the provider should
+	// authenticate to an AWS RDS/Aurora instance using an IAM authentication
+	// token generated at connection time, instead of a static password.
+	CredentialsSourceAWSIAMAuth PostgreSQLConnectionSource = "AWSIAMAuth"
 )
 
 // ProviderCredentials required to authenticate.
 type ProviderCredentials struct {
 	// Source of the provider credentials.
-	// +kubebuilder:validation:Enum=PostgreSQLConnectionSecret
+	// +kubebuilder:validation:Enum=PostgreSQLConnectionSecret;AWSIAMAuth
 	Source PostgreSQLConnectionSource `json:"source"`
 
 	// A CredentialsSecretRef is a reference to a PostgreSQL connection secret
@@ -63,6 +86,12 @@ type ProviderCredentials struct {
 	// standard Crossplane keys are used: "endpoint", "port", "username", "password".
 	// +optional
 	SecretKeyMapping *SecretKeyMapping `json:"secretKeyMapping,omitempty"`
+
+	// Region is the AWS region used to generate the IAM authentication token
+	// when source is AWSIAMAuth. When unset it falls back to a "region" key in
+	// the connection secret, then to the controller's AWS environment.
+	// +optional
+	Region *string `json:"region,omitempty"`
 }
 
 // SecretKeyMapping allows overriding the default secret key names used to