Database (RDS) — konfig-konector Docs

DBSubnetGroup # ✅ Working

Creates an RDS DB subnet group. Requires at least two subnets in different Availability Zones. Used by DBInstance and DBCluster.

Spec

Field	Type	Required	Description
dbSubnetGroupName	string	✅	Name of the DB subnet group. Immutable after creation.
description	string	✅	Description of the subnet group.
subnetRefs	[]SubnetRef	✅	List of subnet CR names or direct IDs. Must include at least 2 subnets in different AZs.
tags	map[string]string		AWS tags applied to the subnet group.

Status

Field	Description
arn	The ARN of the DB subnet group.
status	Current status (e.g. `Complete`).
conditions	Standard Kubernetes conditions.
observedGeneration	Last reconciled generation.
lastSyncTime	RFC3339 timestamp of last sync.

Example

apiVersion: aws.konfig.io/v1alpha1
kind: DBSubnetGroup
metadata:
  name: prod-db-subnet-group
  namespace: database
spec:
  dbSubnetGroupName: prod-db-subnet-group
  description: "Production database subnet group"
  subnetRefs:
    - prod-private-subnet-1a
    - prod-private-subnet-1b
    - prod-private-subnet-1c
  tags:
    env: prod

Deletion

Blocked if in use. Cannot be deleted while referenced by a DBInstance or DBCluster. Delete database resources first.

DBParameterGroup # ✅ Working

Creates an RDS parameter group for DB instances. Each parameter specifies an apply method: immediate or pending-reboot.

Spec

Field	Type	Required	Description
dbParameterGroupName	string	✅	Name of the parameter group. Immutable after creation.
dbParameterGroupFamily	string	✅	DB family (e.g. `mysql8.0`, `postgres15`). Must match the engine version. Immutable.
description	string	✅	Description of the parameter group.
parameters	[]Parameter		List of parameter overrides.
parameters[].parameterName	string		The parameter name (e.g. `max_connections`).
parameters[].parameterValue	string		The parameter value as a string.
parameters[].applyMethod	string		`immediate` or `pending-reboot`. Some parameters require reboot to take effect.
tags	map[string]string		AWS tags applied to the parameter group.

Status

Field	Description
arn	The ARN of the parameter group.
conditions	Standard Kubernetes conditions.
observedGeneration	Last reconciled generation.
lastSyncTime	RFC3339 timestamp of last sync.

Example

apiVersion: aws.konfig.io/v1alpha1
kind: DBParameterGroup
metadata:
  name: prod-postgres15-params
  namespace: database
spec:
  dbParameterGroupName: prod-postgres15-params
  dbParameterGroupFamily: postgres15
  description: "Production PostgreSQL 15 parameter group"
  parameters:
    - parameterName: max_connections
      parameterValue: "500"
      applyMethod: pending-reboot
    - parameterName: shared_preload_libraries
      parameterValue: pg_stat_statements
      applyMethod: pending-reboot
    - parameterName: log_min_duration_statement
      parameterValue: "1000"
      applyMethod: immediate
  tags:
    env: prod

Deletion

Blocked if in use. Cannot be deleted while referenced by a DBInstance. Modify the instance to use the default parameter group first.

DBClusterParameterGroup # ✅ Working

Creates a cluster-level parameter group for Aurora clusters. Same structure as DBParameterGroup but applies at the Aurora cluster level rather than individual instances.

Spec

Field	Type	Required	Description
dbClusterParameterGroupName	string	✅	Name of the cluster parameter group. Immutable after creation.
dbParameterGroupFamily	string	✅	Aurora DB family (e.g. `aurora-mysql8.0`, `aurora-postgresql15`). Immutable.
description	string	✅	Description of the parameter group.
parameters	[]Parameter		Same structure as `DBParameterGroup.parameters`.
tags	map[string]string		AWS tags applied to the parameter group.

Status

Field	Description
arn	The ARN of the cluster parameter group.
conditions	Standard Kubernetes conditions.
observedGeneration	Last reconciled generation.
lastSyncTime	RFC3339 timestamp of last sync.

Example

apiVersion: aws.konfig.io/v1alpha1
kind: DBClusterParameterGroup
metadata:
  name: prod-aurora-pg15-cluster-params
  namespace: database
spec:
  dbClusterParameterGroupName: prod-aurora-pg15-cluster-params
  dbParameterGroupFamily: aurora-postgresql15
  description: "Aurora PostgreSQL 15 cluster parameter group"
  parameters:
    - parameterName: shared_preload_libraries
      parameterValue: pg_stat_statements,auto_explain
      applyMethod: pending-reboot
  tags:
    env: prod

Deletion

Blocked if in use. Cannot be deleted while referenced by a DBCluster.

DBInstance # ✅ Working ⏱ async

Creates and manages an RDS DB instance. Supports MySQL, PostgreSQL, MariaDB, Oracle, and SQL Server engines with full configuration including storage autoscaling, Performance Insights, Enhanced Monitoring, and CloudWatch log exports.

⏱ Async — initial provisioning takes several minutes depending on instance class and storage size. The controller polls every 30 seconds until the instance reaches the available state.

Spec

Field	Type	Required	Description
dbInstanceIdentifier	string	✅	Unique identifier for the DB instance. Immutable.
dbInstanceClass	string	✅	Instance class (e.g. `db.t3.micro`, `db.r6g.xlarge`).
engine	string	✅	Database engine: `mysql`, `postgres`, `mariadb`, `oracle-ee`, `sqlserver-ee`, etc.
engineVersion	string	✅	Engine version (e.g. `15.3`, `8.0.35`).
masterUsername	string	✅	Master username. Immutable after creation.
masterUserPasswordRef.name	string	✅	Name of the Kubernetes Secret containing the master password.
masterUserPasswordRef.key	string	✅	Key within the Secret.
dbName	string		Name of the initial database to create.
allocatedStorage	int32	✅	Allocated storage in GiB.
storageType	string		`gp2`, `gp3`, `io1`, or `io2`. Default: `gp2`.
storageEncrypted	bool		Enable storage encryption at rest.
kmsKeyId	string		KMS key ARN or ID for storage encryption.
multiAZ	bool		Enable Multi-AZ deployment for high availability.
publiclyAccessible	bool		Make the DB instance accessible from the internet. Default: false.
dbSubnetGroupRef	string	✅	Name of the `DBSubnetGroup` CR or direct group name.
dbParameterGroupRef	string		Name of the `DBParameterGroup` CR.
vpcSecurityGroupRefs	[]string		Names of `SecurityGroup` CRs.
port	int32		Database port. Defaults vary by engine (MySQL: 3306, PostgreSQL: 5432).
backupRetentionPeriod	int32		Number of days to retain automated backups. Range: 0–35. 0 disables backups.
preferredBackupWindow	string		Daily time range for backups (e.g. `03:00-04:00` UTC).
preferredMaintenanceWindow	string		Weekly time range for maintenance (e.g. `sun:05:00-sun:06:00`).
iops	int32		Provisioned IOPS for `io1` or `io2` storage.
storageThroughput	int32		Throughput in MB/s for `gp3` storage.
maxAllocatedStorage	int32		Maximum storage limit in GiB for autoscaling. Set to enable storage autoscaling.
autoMinorVersionUpgrade	bool		Automatically apply minor engine upgrades during maintenance windows.
copyTagsToSnapshot	bool		Copy instance tags to automated snapshots.
enableIAMDatabaseAuthentication	bool		Enable IAM database authentication.
enablePerformanceInsights	bool		Enable Performance Insights for query-level monitoring.
performanceInsightsKmsKeyId	string		KMS key for Performance Insights data encryption.
performanceInsightsRetentionPeriod	int32		Retention period in days for Performance Insights data. Default: 7.
monitoringInterval	int32		Interval for Enhanced Monitoring metrics (seconds): 0, 1, 5, 10, 15, 30, or 60. 0 disables.
monitoringRoleArn	string		IAM role ARN for Enhanced Monitoring. Required when `monitoringInterval > 0`.
enabledCloudwatchLogsExports	[]string		CloudWatch log types to export. MySQL: `error`, `slowquery`, `audit`. PostgreSQL: `postgresql`, `upgrade`.
deletionProtection	bool		Enable deletion protection to prevent accidental deletion.
skipFinalSnapshot	bool		Skip creating a final snapshot when the instance is deleted. Default: false (final snapshot is created).
tags	map[string]string		AWS tags applied to the instance.

Status

Field	Description
dbInstanceArn	The ARN of the DB instance.
endpoint	The connection endpoint hostname.
port	The database port number.
dbInstanceStatus	Current status: `creating`, `available`, `modifying`, `deleting`, etc.
conditions	Standard Kubernetes conditions.
observedGeneration	Last reconciled generation.
lastSyncTime	RFC3339 timestamp of last sync.

Example — MySQL Basic

apiVersion: aws.konfig.io/v1alpha1
kind: DBInstance
metadata:
  name: prod-mysql
  namespace: database
spec:
  dbInstanceIdentifier: prod-mysql
  dbInstanceClass: db.t3.medium
  engine: mysql
  engineVersion: "8.0.35"
  masterUsername: admin
  masterUserPasswordRef:
    name: prod-mysql-secret
    key: password
  dbName: appdb
  allocatedStorage: 100
  storageType: gp3
  storageEncrypted: true
  multiAZ: true
  dbSubnetGroupRef: prod-db-subnet-group
  vpcSecurityGroupRefs:
    - db-sg
  backupRetentionPeriod: 7
  preferredBackupWindow: "03:00-04:00"
  autoMinorVersionUpgrade: true
  copyTagsToSnapshot: true
  tags:
    env: prod
    engine: mysql

Example — Full-Featured PostgreSQL

apiVersion: aws.konfig.io/v1alpha1
kind: DBInstance
metadata:
  name: prod-postgres
  namespace: database
spec:
  dbInstanceIdentifier: prod-postgres
  dbInstanceClass: db.r6g.xlarge
  engine: postgres
  engineVersion: "15.4"
  masterUsername: postgres
  masterUserPasswordRef:
    name: prod-postgres-secret
    key: password
  dbName: appdb
  allocatedStorage: 500
  storageType: gp3
  storageThroughput: 250
  maxAllocatedStorage: 2000
  storageEncrypted: true
  kmsKeyId: arn:aws:kms:us-east-1:123456789012:key/mrk-abc123
  multiAZ: true
  publiclyAccessible: false
  dbSubnetGroupRef: prod-db-subnet-group
  dbParameterGroupRef: prod-postgres15-params
  vpcSecurityGroupRefs:
    - db-sg
  port: 5432
  backupRetentionPeriod: 14
  preferredBackupWindow: "03:00-04:00"
  preferredMaintenanceWindow: "sun:05:00-sun:06:00"
  autoMinorVersionUpgrade: false
  copyTagsToSnapshot: true
  enableIAMDatabaseAuthentication: true
  enablePerformanceInsights: true
  performanceInsightsRetentionPeriod: 31
  monitoringInterval: 60
  monitoringRoleArn: arn:aws:iam::123456789012:role/rds-enhanced-monitoring
  enabledCloudwatchLogsExports:
    - postgresql
    - upgrade
  deletionProtection: true
  skipFinalSnapshot: false
  tags:
    env: prod
    engine: postgres
    criticality: high

Notes

The master password is read from the referenced Kubernetes Secret at reconcile time. It is never written to status, events, or logs.
Updates to most spec fields are gated on observedGeneration to avoid costly describe + modify API calls on every reconcile.
skipFinalSnapshot: false (the default) means a final snapshot named <identifier>-final will be created when the CR is deleted. Set to true to skip this for dev/test environments.
Storage autoscaling is enabled by setting maxAllocatedStorage to a value greater than allocatedStorage.

Deletion

May take several minutes. If skipFinalSnapshot: false, a final snapshot is created first which can take several minutes. If deletionProtection: true, the deletion will fail — disable protection first.

DBCluster # ✅ Working ⏱ async

Creates and manages an Aurora DB cluster. Manages the cluster-level resources only — you must create individual DBInstance CRs to add reader/writer instances to the cluster.

⏱ Async — Aurora cluster provisioning takes several minutes. Controller polls every 30 seconds until the cluster is available.

Spec

Field	Type	Required	Description
dbClusterIdentifier	string	✅	Unique identifier for the DB cluster. Immutable.
engine	string	✅	`aurora-mysql` or `aurora-postgresql`.
engineVersion	string	✅	Engine version (e.g. `8.0.mysql_aurora.3.04.0`, `15.4`).
masterUsername	string	✅	Master username. Immutable after creation.
masterUserPasswordRef.name	string	✅	Kubernetes Secret name containing the master password.
masterUserPasswordRef.key	string	✅	Key within the Secret.
dbSubnetGroupRef	string	✅	Name of the `DBSubnetGroup` CR.
dbClusterParameterGroupRef	string		Name of the `DBClusterParameterGroup` CR.
vpcSecurityGroupRefs	[]string		Names of `SecurityGroup` CRs.
backupRetentionPeriod	int32		Days to retain automated backups (1–35).
preferredBackupWindow	string		Daily backup window in UTC (e.g. `03:00-04:00`).
preferredMaintenanceWindow	string		Weekly maintenance window (e.g. `sun:05:00-sun:06:00`).
storageEncrypted	bool		Encrypt storage at rest. Immutable after creation.
kmsKeyId	string		KMS key ARN for storage encryption. Immutable.
storageType	string		Aurora storage type: `aurora` or `aurora-iopt1` (I/O-optimized).
allocatedStorage	int32		Storage in GiB (Aurora Serverless v2 and I/O-optimized only).
port	int32		Port for cluster connections. Defaults: MySQL 3306, PostgreSQL 5432.
engineMode	string		`provisioned` or `serverless`. Immutable after creation.
serverlessV2ScalingConfig.minCapacity	float64		Minimum ACU capacity for Serverless v2 (e.g. 0.5).
serverlessV2ScalingConfig.maxCapacity	float64		Maximum ACU capacity for Serverless v2 (e.g. 16.0).
backtrackWindow	int64		Backtrack window in seconds (Aurora MySQL only, max 259200 = 72 hours).
networkType	string		`IPV4` or `DUAL` for dual-stack IPv4+IPv6.
enableHttpEndpoint	bool		Enable the RDS Data API HTTP endpoint (Serverless v1 only).
enableIAMDatabaseAuthentication	bool		Enable IAM database authentication.
copyTagsToSnapshot	bool		Copy cluster tags to automated snapshots.
autoMinorVersionUpgrade	bool		Automatically apply minor version upgrades.
enabledCloudwatchLogsExports	[]string		Log types to export. Delta sync. Aurora MySQL: `audit`, `error`, `general`, `slowquery`. Aurora PostgreSQL: `postgresql`.
performanceInsightsEnabled	bool		Enable Performance Insights.
performanceInsightsKmsKeyId	string		KMS key for Performance Insights.
performanceInsightsRetentionPeriod	int32		Retention in days (default: 7).
deletionProtection	bool		Enable deletion protection.
skipFinalSnapshot	bool		Skip final snapshot on deletion. Default: false.
tags	map[string]string		AWS tags.

Status

Field	Description
dbClusterArn	The ARN of the Aurora cluster.
endpoint	Writer endpoint hostname for write connections.
readerEndpoint	Reader endpoint hostname for load-balanced read connections.
status	Current status: `creating`, `available`, `modifying`, etc.
conditions	Standard Kubernetes conditions.
observedGeneration	Last reconciled generation.
lastSyncTime	RFC3339 timestamp of last sync.

Example — Aurora MySQL Provisioned

apiVersion: aws.konfig.io/v1alpha1
kind: DBCluster
metadata:
  name: prod-aurora-mysql
  namespace: database
spec:
  dbClusterIdentifier: prod-aurora-mysql
  engine: aurora-mysql
  engineVersion: 8.0.mysql_aurora.3.04.0
  masterUsername: admin
  masterUserPasswordRef:
    name: prod-aurora-secret
    key: password
  dbSubnetGroupRef: prod-db-subnet-group
  vpcSecurityGroupRefs:
    - db-sg
  storageEncrypted: true
  backupRetentionPeriod: 7
  preferredBackupWindow: "02:00-03:00"
  enableIAMDatabaseAuthentication: true
  deletionProtection: true
  tags:
    env: prod
    engine: aurora-mysql

Example — Aurora Serverless v2 PostgreSQL

apiVersion: aws.konfig.io/v1alpha1
kind: DBCluster
metadata:
  name: staging-serverless-pg
  namespace: database
spec:
  dbClusterIdentifier: staging-serverless-pg
  engine: aurora-postgresql
  engineVersion: "15.4"
  engineMode: provisioned   # Serverless v2 uses provisioned engineMode
  masterUsername: postgres
  masterUserPasswordRef:
    name: staging-pg-secret
    key: password
  dbSubnetGroupRef: staging-db-subnet-group
  vpcSecurityGroupRefs:
    - db-sg
  serverlessV2ScalingConfig:
    minCapacity: 0.5
    maxCapacity: 8.0
  storageEncrypted: true
  backupRetentionPeriod: 3
  skipFinalSnapshot: true
  tags:
    env: staging
    engine: aurora-postgresql

Notes

The DBCluster CR manages only the cluster-level resource. Create separate DBInstance CRs with the dbClusterIdentifier field pointing to this cluster to add writer and reader instances.
The readerEndpoint load-balances reads across all read replicas; use the endpoint (writer) for writes.
engineMode is immutable after creation.
Aurora Serverless v2 uses engineMode: provisioned with serverlessV2ScalingConfig and requires at least one instance of type db.serverless.
CloudWatch log exports use delta sync — adding/removing entries in enabledCloudwatchLogsExports is applied incrementally.

Deletion

Blocked if cluster has instances. Delete all DB instances in the cluster first. If deletionProtection: true, disable it before deletion. A final snapshot is created by default unless skipFinalSnapshot: true.