Struct ConnectionSpec 

pub struct ConnectionSpec {
    pub secret_ref: Option<SecretReference>,
    pub secret_key: Option<String>,
    pub params: Option<ConnectionParams>,
}

Database connection configuration.

Supports two mutually exclusive modes:

Mode 1 — Single URL (backward-compatible):

connection:
  secretRef: { name: my-secret }
  secretKey: DATABASE_URL        # optional, defaults to DATABASE_URL

Mode 2 — Structured params (for Zalando/CNPG/PGO secrets):

connection:
  params:
    host: my-cluster-postgres
    port: 5432
    dbname: mydb
    usernameSecret: { name: zalando-creds, key: username }
    passwordSecret: { name: zalando-creds, key: password }

Params mode can also use provider-backed authentication instead of a static password, for example GKE Workload Identity to Cloud SQL IAM.

Fields

secret_ref: Option<SecretReference>

Reference to a Kubernetes Secret containing a connection URL. Mutually exclusive with params.

secret_key: Option<String>

Key within the Secret to read. Defaults to DATABASE_URL. Only used with secretRef.

params: Option<ConnectionParams>

Structured connection parameters. Each field is either a plain string or a reference to a Secret key. Mutually exclusive with secretRef.

Implementations

impl ConnectionSpec

pub fn effective_secret_key(&self) -> &str

Effective secret key for URL mode. Defaults to DATABASE_URL.

pub fn collect_secret_names(&self, names: &mut BTreeSet<String>)

Collect all Secret names referenced by this connection spec.

pub fn identity_key(&self) -> String

Deterministic identity key for this connection spec.

• URL mode: {secret_ref.name}/{secret_key}
• Params mode: canonical representation of the params

Uses \0 as field separator since null bytes cannot appear in K8s names or secret values, avoiding ambiguity from colons in literal values. Deterministic identity key for per-database locking and conflict detection.

Identifies the target database (host + port + dbname) but NOT the credentials. Two policies targeting the same database with different users should still be considered as targeting the same database for locking and overlap checks.

pub fn cache_key(&self, namespace: &str) -> String

Cache key for pool lookup. Includes ALL connection params so that any configuration change (credentials, sslMode, host, etc.) invalidates the cached pool. This is strictly more specific than identity_key.

Trait Implementations

impl Clone for ConnectionSpec

fn clone(&self) -> ConnectionSpec

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ConnectionSpec

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for ConnectionSpec

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for ConnectionSpec

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl Serialize for ConnectionSpec

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.