feat(v2/postgres): support CLOUDSQL_IAM passwordless DSN

Sahand Abbasirequested to merge
feat/postgres-cloudsql-iam into master

Summary

Aligns v2/postgres with the fairway proto change that moved PostgreSQLFormat from PostgreSQLSecret onto PostgreSQL itself, and adds support for the new CLOUDSQL_IAM format used by the Cloud SQL Auth Proxy with --auto-iam-authn.

Details

Proto consumption

  • projection() now reads format from PostgreSQL.format instead of secret_ref.format (the field's new home).

CLOUDSQL_IAM path

When format == CLOUDSQL_IAM:

  • newFromProto no longer requires a Secrets provider (no Kubernetes Secret is mounted in this mode).
  • dsn() short-circuits to a new cloudsqlIAMDSN helper that builds a passwordless postgres:// URL from PostgreSQL.host/port/database_name/username.
  • Pool address (pool_host/pool_port) is honored when connection pooling is enabled, falling back to direct host/port — future-proofing for CloudSQL deployments that expose a separate pool endpoint.
  • Defense-in-depth: each required field is checked for empty/zero and reports a new ErrMissingConfigField on violation, even though fairway's CEL rules already enforce presence at proto-validate time.

Tests

  • TestClientOptions_DSN extended with 9 new cases:
    • happy path (with and without a Secrets provider, including IAM-flavoured username escaping)
    • pool_host/pool_port override when pooling enabled
    • pool_host/pool_port ignored when pooling disabled
    • each of host / port / database_name / username missing → ErrMissingConfigField
  • Existing test fixtures rewritten to set Format on PostgreSQL directly (moved from PostgreSQLSecret).

Why

Required for the Runway V2 CloudSQL story: the GKE chart injects a cloud-sql-proxy sidecar with --auto-iam-authn, the workload's GCP SA authenticates to the proxy, and labkit needs to dial the proxy on 127.0.0.1 without a password. Without CLOUDSQL_IAM, labkit's projection() falls through to ErrUnknownSecretFormat and dsn() blocks waiting for a non-existent password secret.

Dependency

Bumps fairway to an unreleased commit on feat/cloudsql-iam-format that introduces PostgreSQLFormat.CLOUDSQL_IAM (gitlab-com/gl-infra/platform/runway/fairway!103 (merged)). Will be re-pinned to a tagged release before merge.

Relates to: gitlab-com/gl-infra/platform/runway/team#921 (closed) Relates to: gitlab-com/gl-infra/platform/runway/team#930 (closed)

Merge request reports