feat(mysql): auto-regenerate user password on restore and support rotation trigger

apis/cluster/mysql/v1alpha1/user_types.go

@@ -68,6 +68,11 @@ type UserParameters struct {
 	// BinLog defines whether the create, delete, update operations of this user are propagated to replicas. Defaults to true
 	// +optional
 	BinLog *bool `json:"binlog,omitempty"`
+
+	// PasswordRotationTrigger triggers rotation of the auto-generated password when set to
+	// a time after the current LastPasswordChange. Has no effect when passwordSecretRef is set.
+	// +optional
+	PasswordRotationTrigger *metav1.Time `json:"passwordRotationTrigger,omitempty"`
 }
 
 // AuthenticationPlugin selects the auth plugin used when creating the user.
@@ -115,6 +120,9 @@ type UserObservation struct {
 	// spec.forProvider.authenticationPlugin and what's actually configured
 	// on the DB so plugin changes are not silently ignored.
 	AuthenticationPlugin *AuthenticationPlugin `json:"authenticationPlugin,omitempty"`
+
+	// LastPasswordChange records when the provider last set the user's password.
+	LastPasswordChange *metav1.Time `json:"lastPasswordChange,omitempty"`
 }
 
 // +kubebuilder:object:root=true

apis/namespaced/mysql/v1alpha1/user_types.go

@@ -69,6 +69,11 @@ type UserParameters struct {
 	// BinLog defines whether the create, delete, update operations of this user are propagated to replicas. Defaults to true
 	// +optional
 	BinLog *bool `json:"binlog,omitempty"`
+
+	// PasswordRotationTrigger triggers rotation of the auto-generated password when set to
+	// a time after the current LastPasswordChange. Has no effect when passwordSecretRef is set.
+	// +optional
+	PasswordRotationTrigger *metav1.Time `json:"passwordRotationTrigger,omitempty"`
 }
 
 // AuthenticationPlugin selects the auth plugin used when creating the user.
@@ -116,6 +121,9 @@ type UserObservation struct {
 	// spec.forProvider.authenticationPlugin and what's actually configured
 	// on the DB so plugin changes are not silently ignored.
 	AuthenticationPlugin *AuthenticationPlugin `json:"authenticationPlugin,omitempty"`
+
+	// LastPasswordChange records when the provider last set the user's password.
+	LastPasswordChange *metav1.Time `json:"lastPasswordChange,omitempty"`
 }
 
 // +kubebuilder:object:root=true

package/crds/mysql.sql.crossplane.io_users.yaml

@@ -108,6 +108,12 @@ spec:
                       operations of this user are propagated to replicas. Defaults
                       to true
                     type: boolean
+                  passwordRotationTrigger:
+                    description: |-
+                      PasswordRotationTrigger triggers rotation of the auto-generated password when set to
+                      a time after the current LastPasswordChange. Has no effect when passwordSecretRef is set.
+                    format: date-time
+                    type: string
                   passwordSecretRef:
                     description: |-
                       PasswordSecretRef references the secret that contains the password used
@@ -272,6 +278,11 @@ spec:
                     required:
                     - name
                     type: object
+                  lastPasswordChange:
+                    description: LastPasswordChange records when the provider last
+                      set the user's password.
+                    format: date-time
+                    type: string
                   resourceOptionsAsClauses:
                     description: ResourceOptionsAsClauses represents the applied resource
                       options

package/crds/mysql.sql.m.crossplane.io_users.yaml

@@ -94,6 +94,12 @@ spec:
                       operations of this user are propagated to replicas. Defaults
                       to true
                     type: boolean
+                  passwordRotationTrigger:
+                    description: |-
+                      PasswordRotationTrigger triggers rotation of the auto-generated password when set to
+                      a time after the current LastPasswordChange. Has no effect when passwordSecretRef is set.
+                    format: date-time
+                    type: string
                   passwordSecretRef:
                     description: |-
                       PasswordSecretRef references the secret that contains the password used
@@ -225,6 +231,11 @@ spec:
                     required:
                     - name
                     type: object
+                  lastPasswordChange:
+                    description: LastPasswordChange records when the provider last
+                      set the user's password.
+                    format: date-time
+                    type: string
                   resourceOptionsAsClauses:
                     description: ResourceOptionsAsClauses represents the applied resource
                       options

pkg/controller/cluster/mysql/user/reconciler.go

@@ -24,6 +24,7 @@ import (
 	"github.com/crossplane/crossplane-runtime/v2/pkg/statemetrics"
 	"github.com/pkg/errors"
 	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/types"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -51,12 +52,13 @@ const (
 	errGetSecret    = "cannot get credentials Secret"
 	errTLSConfig    = "cannot load TLS config"
 
-	errSelectUser              = "cannot select user"
-	errCreateUser              = "cannot create user"
-	errDropUser                = "cannot drop user"
-	errUpdateUser              = "cannot update user"
-	errGetPasswordSecretFailed = "cannot get password secret"
-	errCompareResourceOptions  = "cannot compare desired and observed resource options"
+	errSelectUser                = "cannot select user"
+	errCreateUser                = "cannot create user"
+	errDropUser                  = "cannot drop user"
+	errUpdateUser                = "cannot update user"
+	errGetPasswordSecretFailed   = "cannot get password secret"
+	errGetConnectionSecretFailed = "cannot get connection secret"
+	errCompareResourceOptions    = "cannot compare desired and observed resource options"
 
 	maxConcurrency = 5
 )
@@ -525,10 +527,18 @@ func (c *external) UpdatePassword(ctx context.Context, cr *v1alpha1.User, userna
 	}
 
 	if pwchanged {
+		if pw == "" {
+			pw, err = password.Generate()
+			if err != nil {
+				return managed.ConnectionDetails{}, err
+			}
+		}
 		query := fmt.Sprintf("ALTER USER %s@%s IDENTIFIED BY %s", mysql.QuoteValue(username), mysql.QuoteValue(host), mysql.QuoteValue(pw))
 		if err := mysql.ExecWrapper(ctx, c.db, mysql.ExecQuery{Query: query, ErrorValue: errUpdateUser}); err != nil {
 			return managed.ConnectionDetails{}, err
 		}
+		now := metav1.Now()
+		cr.Status.AtProvider.LastPasswordChange = &now
 
 		return c.db.GetConnectionDetails(username, pw), nil
 	}