feat(postgres,mysql): IAM auth implementation

apis/cluster/mysql/v1alpha1/provider_types.go

@@ -26,13 +26,14 @@ import (
 type ProviderConfigSpec struct {
 	// Credentials required to authenticate to this provider.
 	Credentials ProviderCredentials `json:"credentials"`
-	// tls=true enables TLS / SSL encrypted connection to the server.
-	// Use skip-verify if you want to use a self-signed or invalid certificate (server side)
-	// or use preferred to use TLS only when advertised by the server. This is similar
-	// to skip-verify, but additionally allows a fallback to a connection which is
-	// not encrypted. Neither skip-verify nor preferred add any reliable security.
-	// Alternatively, set tls=custom and provide a custom TLS configuration via the tlsConfig field.
-	// +kubebuilder:validation:Enum="true";skip-verify;preferred;custom
+	// tls=false disables encryption. Quote it in YAML as tls: "false"; an unquoted
+	// false is a boolean and this string field rejects it. tls=true enables an
+	// encrypted connection verified with the pod trust store. Use skip-verify for
+	// a self-signed or invalid server certificate, or preferred to use TLS only
+	// when the server advertises it. preferred also allows a plaintext fallback.
+	// Neither skip-verify nor preferred verifies the server. Alternatively, set
+	// tls=custom and provide a CA via tlsConfig. An omitted value means preferred.
+	// +kubebuilder:validation:Enum="false";"true";skip-verify;preferred;custom
 	// +optional
 	TLS *string `json:"tls"`
 
@@ -59,12 +60,17 @@ const (
 	// should acquire credentials from a connection secret written by a managed
 	// resource that represents a MySQL server.
 	CredentialsSourceMySQLConnectionSecret xpv2.CredentialsSource = "MySQLConnectionSecret"
+
+	// CredentialsSourceAWSIAMAuth indicates that the provider should
+	// authenticate to an AWS RDS/Aurora instance using an IAM authentication
+	// token generated at connection time, instead of a static password.
+	CredentialsSourceAWSIAMAuth xpv2.CredentialsSource = "AWSIAMAuth"
 )
 
 // ProviderCredentials required to authenticate.
 type ProviderCredentials struct {
 	// Source of the provider credentials.
-	// +kubebuilder:validation:Enum=MySQLConnectionSecret
+	// +kubebuilder:validation:Enum=MySQLConnectionSecret;AWSIAMAuth
 	Source xpv2.CredentialsSource `json:"source"`
 
 	// A CredentialsSecretRef is a reference to a MySQL connection secret
@@ -77,6 +83,12 @@ type ProviderCredentials struct {
 	// standard Crossplane keys are used: "endpoint", "port", "username", "password".
 	// +optional
 	SecretKeyMapping *SecretKeyMapping `json:"secretKeyMapping,omitempty"`
+
+	// Region is the AWS region used to generate the IAM authentication token
+	// when source is AWSIAMAuth. When unset it falls back to a "region" key in
+	// the connection secret, then to the controller's AWS environment.
+	// +optional
+	Region *string `json:"region,omitempty"`
 }
 
 // SecretKeyMapping allows overriding the default secret key names used to

apis/cluster/postgresql/v1alpha1/provider_types.go

@@ -36,19 +36,57 @@ type ProviderConfigSpec struct {
 	// +kubebuilder:default=verify-full
 	// +kubebuilder:validation:Optional
 	SSLMode *string `json:"sslMode,omitempty"`
+
+	// TLSConfig provides the CA bundle used when sslMode is verify-ca or
+	// verify-full. The secret key is one PEM and may contain multiple
+	// certificates, such as the Amazon RDS global bundle.
+	// +optional
+	TLSConfig *TLSConfig `json:"tlsConfig,omitempty"`
+}
+
+// TLSConfig provides a CA bundle for sslMode verify-ca and verify-full.
+type TLSConfig struct {
+	// CACert is a PEM bundle of root and intermediate certificates.
+	// +optional
+	CACert TLSSecret `json:"caCert,omitempty"`
+}
+
+// TLSSecret is a reference to a key that contains TLS material in PEM format.
+type TLSSecret struct {
+	// SecretRef selects the secret key.
+	// +optional
+	SecretRef TLSSecretRef `json:"secretRef,omitempty"`
+}
+
+// TLSSecretRef selects a secret key. Name and key are required. Namespace is
+// required on a cluster-scoped ProviderConfig.
+type TLSSecretRef struct {
+	// Name of the secret.
+	Name string `json:"name"`
+
+	// Namespace of the secret.
+	Namespace string `json:"namespace"`
+
+	// Key to select.
+	Key string `json:"key"`
 }
 
 const (
 	// CredentialsSourcePostgreSQLConnectionSecret indicates that a provider
 	// should acquire credentials from a connection secret written by a managed
 	// resource that represents a PostgreSQL server.
 	CredentialsSourcePostgreSQLConnectionSecret xpv2.CredentialsSource = "PostgreSQLConnectionSecret"
+
+	// CredentialsSourceAWSIAMAuth indicates that the provider should
+	// authenticate to an AWS RDS/Aurora instance using an IAM authentication
+	// token generated at connection time, instead of a static password.
+	CredentialsSourceAWSIAMAuth xpv2.CredentialsSource = "AWSIAMAuth"
 )
 
 // ProviderCredentials required to authenticate.
 type ProviderCredentials struct {
 	// Source of the provider credentials.
-	// +kubebuilder:validation:Enum=PostgreSQLConnectionSecret
+	// +kubebuilder:validation:Enum=PostgreSQLConnectionSecret;AWSIAMAuth
 	Source xpv2.CredentialsSource `json:"source"`
 
 	// A CredentialsSecretRef is a reference to a PostgreSQL connection secret
@@ -61,6 +99,12 @@ type ProviderCredentials struct {
 	// standard Crossplane keys are used: "endpoint", "port", "username", "password".
 	// +optional
 	SecretKeyMapping *SecretKeyMapping `json:"secretKeyMapping,omitempty"`
+
+	// Region is the AWS region used to generate the IAM authentication token
+	// when source is AWSIAMAuth. When unset it falls back to a "region" key in
+	// the connection secret, then to the controller's AWS environment.
+	// +optional
+	Region *string `json:"region,omitempty"`
 }
 
 // SecretKeyMapping allows overriding the default secret key names used to

apis/namespaced/mysql/v1alpha1/cluster_provider_types.go

@@ -27,13 +27,14 @@ type ClusterProviderConfigSpec struct {
 	// Credentials required to authenticate to this provider.
 	Credentials ClusterProviderCredentials `json:"credentials"`
 
-	// tls=true enables TLS / SSL encrypted connection to the server.
-	// Use skip-verify if you want to use a self-signed or invalid certificate (server side)
-	// or use preferred to use TLS only when advertised by the server. This is similar
-	// to skip-verify, but additionally allows a fallback to a connection which is
-	// not encrypted. Neither skip-verify nor preferred add any reliable security.
-	// Alternatively, set tls=custom and provide a custom TLS configuration via the tlsConfig field.
-	// +kubebuilder:validation:Enum="true";skip-verify;preferred;custom
+	// tls=false disables encryption. Quote it in YAML as tls: "false"; an unquoted
+	// false is a boolean and this string field rejects it. tls=true enables an
+	// encrypted connection verified with the pod trust store. Use skip-verify for
+	// a self-signed or invalid server certificate, or preferred to use TLS only
+	// when the server advertises it. preferred also allows a plaintext fallback.
+	// Neither skip-verify nor preferred verifies the server. Alternatively, set
+	// tls=custom and provide a CA via tlsConfig. An omitted value means preferred.
+	// +kubebuilder:validation:Enum="false";"true";skip-verify;preferred;custom
 	// +optional
 	TLS *string `json:"tls"`
 
@@ -45,7 +46,7 @@ type ClusterProviderConfigSpec struct {
 // ClusterProviderCredentials required to authenticate.
 type ClusterProviderCredentials struct {
 	// Source of the provider credentials.
-	// +kubebuilder:validation:Enum=MySQLConnectionSecret
+	// +kubebuilder:validation:Enum=MySQLConnectionSecret;AWSIAMAuth
 	Source MySQLConnectionSecretSource `json:"source"`
 
 	// A CredentialsSecretRef is a reference to a MySQL connection secret
@@ -58,6 +59,12 @@ type ClusterProviderCredentials struct {
 	// standard Crossplane keys are used: "endpoint", "port", "username", "password".
 	// +optional
 	SecretKeyMapping *SecretKeyMapping `json:"secretKeyMapping,omitempty"`
+
+	// Region is the AWS region used to generate the IAM authentication token
+	// when source is AWSIAMAuth. When unset it falls back to a "region" key in
+	// the connection secret, then to the controller's AWS environment.
+	// +optional
+	Region *string `json:"region,omitempty"`
 }
 
 // A ClusterProviderConfigStatus reflects the observed state of a ClusterProviderConfig.

apis/namespaced/mysql/v1alpha1/provider_types.go

@@ -26,13 +26,14 @@ import (
 type ProviderConfigSpec struct {
 	// Credentials required to authenticate to this provider.
 	Credentials ProviderCredentials `json:"credentials"`
-	// tls=true enables TLS / SSL encrypted connection to the server.
-	// Use skip-verify if you want to use a self-signed or invalid certificate (server side)
-	// or use preferred to use TLS only when advertised by the server. This is similar
-	// to skip-verify, but additionally allows a fallback to a connection which is
-	// not encrypted. Neither skip-verify nor preferred add any reliable security.
-	// Alternatively, set tls=custom and provide a custom TLS configuration via the tlsConfig field.
-	// +kubebuilder:validation:Enum="true";skip-verify;preferred;custom
+	// tls=false disables encryption. Quote it in YAML as tls: "false"; an unquoted
+	// false is a boolean and this string field rejects it. tls=true enables an
+	// encrypted connection verified with the pod trust store. Use skip-verify for
+	// a self-signed or invalid server certificate, or preferred to use TLS only
+	// when the server advertises it. preferred also allows a plaintext fallback.
+	// Neither skip-verify nor preferred verifies the server. Alternatively, set
+	// tls=custom and provide a CA via tlsConfig. An omitted value means preferred.
+	// +kubebuilder:validation:Enum="false";"true";skip-verify;preferred;custom
 	// +optional
 	TLS *string `json:"tls"`
 
@@ -61,12 +62,17 @@ const (
 	// should acquire credentials from a connection secret written by a managed
 	// resource that represents a MySQL server.
 	CredentialsSourceMySQLConnectionSecret MySQLConnectionSecretSource = "MySQLConnectionSecret"
+
+	// CredentialsSourceAWSIAMAuth indicates that the provider should
+	// authenticate to an AWS RDS/Aurora instance using an IAM authentication
+	// token generated at connection time, instead of a static password.
+	CredentialsSourceAWSIAMAuth MySQLConnectionSecretSource = "AWSIAMAuth"
 )
 
 // ProviderCredentials required to authenticate.
 type ProviderCredentials struct {
 	// Source of the provider credentials.
-	// +kubebuilder:validation:Enum=MySQLConnectionSecret
+	// +kubebuilder:validation:Enum=MySQLConnectionSecret;AWSIAMAuth
 	Source MySQLConnectionSecretSource `json:"source"`
 
 	// A CredentialsSecretRef is a reference to a MySQL connection secret
@@ -79,6 +85,12 @@ type ProviderCredentials struct {
 	// standard Crossplane keys are used: "endpoint", "port", "username", "password".
 	// +optional
 	SecretKeyMapping *SecretKeyMapping `json:"secretKeyMapping,omitempty"`
+
+	// Region is the AWS region used to generate the IAM authentication token
+	// when source is AWSIAMAuth. When unset it falls back to a "region" key in
+	// the connection secret, then to the controller's AWS environment.
+	// +optional
+	Region *string `json:"region,omitempty"`
 }
 
 // SecretKeyMapping allows overriding the default secret key names used to

apis/namespaced/postgresql/v1alpha1/cluster_provider_types.go

@@ -36,12 +36,18 @@ type ClusterProviderConfigSpec struct {
 	// +kubebuilder:default=verify-full
 	// +kubebuilder:validation:Optional
 	SSLMode *string `json:"sslMode,omitempty"`
+
+	// TLSConfig provides the CA bundle used when sslMode is verify-ca or
+	// verify-full. The secret key is one PEM and may contain multiple
+	// certificates, such as the Amazon RDS global bundle.
+	// +optional
+	TLSConfig *TLSConfig `json:"tlsConfig,omitempty"`
 }
 
 // ClusterProviderCredentials required to authenticate.
 type ClusterProviderCredentials struct {
 	// Source of the provider credentials.
-	// +kubebuilder:validation:Enum=PostgreSQLConnectionSecret
+	// +kubebuilder:validation:Enum=PostgreSQLConnectionSecret;AWSIAMAuth
 	Source PostgreSQLConnectionSource `json:"source"`
 
 	// A CredentialsSecretRef is a reference to a PostgreSQL connection secret
@@ -54,6 +60,12 @@ type ClusterProviderCredentials struct {
 	// standard Crossplane keys are used: "endpoint", "port", "username", "password".
 	// +optional
 	SecretKeyMapping *SecretKeyMapping `json:"secretKeyMapping,omitempty"`
+
+	// Region is the AWS region used to generate the IAM authentication token
+	// when source is AWSIAMAuth. When unset it falls back to a "region" key in
+	// the connection secret, then to the controller's AWS environment.
+	// +optional
+	Region *string `json:"region,omitempty"`
 }
 
 // A ClusterProviderConfigStatus reflects the observed state of a ClusterProviderConfig.