feat(mysql): in-provider RDS IAM token minting (prototype, Route B) - #3
Draft
matt-royal wants to merge 1 commit into
Draft
feat(mysql): in-provider RDS IAM token minting (prototype, Route B)#3matt-royal wants to merge 1 commit into
matt-royal wants to merge 1 commit into
Conversation
Teaches provider-sql to authenticate to RDS/Aurora MySQL with an IAM auth
token it mints itself, per physical connection, from the pod's ambient AWS
identity (IRSA / Pod Identity) — no external refresher, no token in any
Kubernetes Secret.
Core: a TokenMinter interface + a driver.Connector that mints the password
per connection; the pool is opened via sql.OpenDB keyed by a password-less
DSN, so token rotation reuses the pool instead of churning it. A concrete
rdsauth.Minter wraps feature/rds/auth.BuildAuthToken with the default cred
chain plus an optional assume-role chain.
Opt-in (cluster ProviderConfig path): a new RDSIAMAuth credentials source
and an RDSAuth {region, assumeRoleARNs} block, with the user reconciler's
Connect() building the minter (via an injected factory) and calling
NewWithMinter. Unit-tested end to end against fakes; real-Aurora
verification is a deferred staging step. See WB-247-ROUTE-B-EVALUATION.md.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prototype: authenticate provider-sql's admin MySQL connection to RDS/Aurora with an IAM database auth token, minted in-process per connection.
Draft, not for merge. This is a prototype from an investigation that has been shelved — the IAM-database-auth direction was set aside as too complex, and the RDS Data API alternative was declined for network-posture reasons. It's pushed as a durable record in case the approach is revisited.
Approach:
TokenMinterinterface + adatabase/sqldriver.Connectorthat mints a fresh RDS IAM auth token per physical connection; the pool is keyed by a password-less DSN so token rotation reuses the pool instead of churning it.rdsauth.Minterwrappingfeature/rds/auth.BuildAuthTokenwith an optional assume-role chain.RDSIAMAuthProviderConfig credential source + user-reconciler wiring (cluster path).Unit-tested against fakes (fake minter + a driver-boundary seam); not verified against real Aurora.
Generated with Claude Code 🤖