[krogon-bt]

Refs #347

Postgress

Summary

• Authenticate to Aurora PostgreSQL with an RDS IAM token from the AWS default credential chain, including EKS Pod Identity. The token is minted on every connect and is not cached, so reconciliation keeps working after the 15-minute token lifetime.
• Add the AWSIAMAuth credential source and an optional region to the cluster ProviderConfig and to the namespaced ProviderConfig and ClusterProviderConfig. The connection secret still supplies endpoint, port, and username.
• Pass sslMode through unchanged. When tlsConfig.caCert is set for verify-ca or verify-full, register that PEM with lib/pq. verify-full checks the chain and the hostname. This change does not create database users or grant rds_iam.

Test plan

• go test for pkg/clients/awsiam, pkg/clients/postgresql, pkg/controller/postgresql/connect, the cluster PostgreSQL controllers, and pkg/controller/namespaced/postgresql/provider
• Confirm a password ProviderConfig still connects
• On Aurora PostgreSQL 16 with Pod Identity: sslMode: verify-full, tlsConfig.caCert pointing at the RDS global bundle, then a Database or Role reconcile that still succeeds after the provider has been up longer than 15 minutes

MySQL

Summary

• Add AWSIAMAuth and optional region to the cluster ProviderConfig, the namespaced ProviderConfig, and the ClusterProviderConfig. Each connect mints a new RDS IAM token from the AWS default chain (EKS Pod Identity) and uses it as the password.
• Set allowCleartextPasswords only for IAM, so the AWS plugin can send the token. Leave tls as configured, including an explicit "false". A nil mode still becomes preferred.
• Allow tls: custom with only tlsConfig.caCert. clientCert and clientKey stay optional and must be set together. The RDS CA secret is registered with go-sql-driver, which sets the hostname check. Register keys include the config namespace.

Test plan

• go test the MySQL client, cluster database/user/grant, and namespaced provider/tls packages
• Confirm a password ProviderConfig still connects without allowCleartextPasswords and still accepts tls: "true", skip-verify, preferred, custom, and "false"
• On Aurora MySQL, connect with source: AWSIAMAuth, tls: custom, and the RDS global bundle in tlsConfig.caCert (no client cert)
• Confirm tls: "false" with IAM is rejected by Aurora
• Create the IAM database user through a password ProviderConfig (authenticationPlugin.name: AWSAuthenticationPlugin, authString: RDS), then reconcile through the IAM ProviderConfig

[fernandezcuesta]

duplicate of #396?