| 102 | } |
| 103 | |
| 104 | func newPostgresDatabase(dbType DBType, connProducer *connutil.SQLConnectionProducer) (dbplugin.Database, func() error, func() map[string]string, error) { |
| 105 | // setup the connector's "cloudsql-postgres" driver to "proxy" to cloudsql instance with Google IAM creds |
| 106 | // See: https://github.com/GoogleCloudPlatform/cloud-sql-go-connector |
| 107 | // |
| 108 | // connection string should look like: |
| 109 | // "host=project:region:instance user=${username} password=${password} dbname=mydb sslmode=disable" |
| 110 | // |
| 111 | // attribute 'sslmode=disable' is required. even though the sslmode parameter is set to disable, |
| 112 | // the Cloud SQL Auth proxy does provide an encrypted connection. |
| 113 | // See: https://cloud.google.com/sql/docs/postgres/connect-admin-proxy#connect-to-proxy |
| 114 | cleanup, err := pgxv4.RegisterDriver(dbType.String(), cloudsqlconn.WithIAMAuthN()) |
| 115 | if err != nil { |
| 116 | return nil, nil, nil, errors.Wrap(err, "failed to register 'postgres' driver with 'cloud-sql-go-connector'") |
| 117 | } |
| 118 | |
| 119 | // delegate to vault's original postgres backend |
| 120 | // See: https://github.com/hashicorp/vault/blob/main/plugins/database/postgresql/postgresql.go |
| 121 | postgresBackend := &postgresql.PostgreSQL{ |
| 122 | SQLConnectionProducer: connProducer, |
| 123 | } |
| 124 | |
| 125 | secretValues := func() map[string]string { |
| 126 | return map[string]string{ |
| 127 | postgresBackend.Password: "[password]", |
| 128 | } |
| 129 | } |
| 130 | |
| 131 | return postgresBackend, cleanup, secretValues, nil |
| 132 | } |