Module postgres 

Postgres binding providers.

Postgres is connection-only: the provider resolves connection details and the application connects with its own driver. There is no gRPC service (by design).

Local and External carry the password inline. The three cloud variants carry only a pointer to the password in that cloud’s secret store (Secrets Manager ARN / Secret Manager name / Key Vault secret URI) — the password never flows through the control plane and never sits in a plaintext environment variable. Each cloud provider reads that pointer with the workload’s own identity, which is exactly what the postgres/data-access permission set grants.

Resolution happens up front, when the binding is loaded, so crate::traits::Postgres stays synchronous and one handle can be read repeatedly without another secret read. A cloud handle therefore holds the password that was current when it was created; BindingsProvider::load_postgres deliberately does not cache it, so loading the binding again re-reads the secret and picks up a rotation. (The secret-store client is cached, so re-reading does not rebuild a connection pool; [runtime::PostgresRuntime] owns both policies.)

Modules

local

Structs

ResolvedPostgres

A Postgres handle whose cloud-specific work has already been completed.