pgAgroal Enterprise 1.2.0: Verified TLS for Amazon RDS and Aurora

Frank Heikens·
pgagroalpostgresqlreleasesecurity

When you put a connection pooler in front of Amazon RDS or Aurora, it becomes the one process that holds every backend credential and terminates every backend connection. That makes the pooler's own TLS posture a security control in its own right — not a detail. pgAgroal Enterprise 1.2.0 tightens that posture end to end, and it's available now on AWS Marketplace and GHCR.

Verified backend TLS

Until now, the managed backend connection could be encrypted (backendTLS: require) but not verified: the pooler encrypted traffic to the database without confirming it was actually talking to your database. On a network an attacker can influence, that leaves the door open to a man-in-the-middle that terminates TLS and relays your credentials.

1.2.0 closes that. The operator now supports verify-ca and verify-full, so the pooler validates the backend PostgreSQL certificate against a CA bundle you supply — recommended for RDS and Aurora. You provide the CA as a ConfigMap and point the Pgagroal resource at it:

apiVersion: pgagroal.elevarq.com/v1alpha1
kind: Pgagroal
metadata:
  name: pg1
spec:
  backendHost: your-db.abc123.us-east-1.rds.amazonaws.com
  backendTLS: verify-full
  backendTLSCAConfigMapRef: rds-ca   # ConfigMap holding the RDS CA bundle under key ca.crt
  # ... backend credential by reference, as always

The operator mounts the bundle read-only and wires pgAgroal to it; a CEL validation rule keeps you from selecting a verify mode without providing a CA. We validated the full path against a live RDS instance before shipping: with verify-full, an authenticated query through the pooler succeeds only because the backend certificate checked out.

A security-first release across the stack

Verified backend TLS is the headline, but 1.2.0 is a broad hardening release:

  • Go toolchain 1.26.6 — clears seven reachable standard-library advisories flagged by govulncheck.
  • Control-plane API now serves TLS — the operator token and fleet data are no longer sent in cleartext.
  • Config-apply input validation — remediation parameter keys are validated before they reach the management CLI, closing an argument-injection vector.
  • Authenticated read endpoints — the control-plane fleet and drift views now require operator authentication, and error responses no longer leak backend detail.
  • Digest-pinned base images — every container base is pinned by digest for byte-reproducible builds.

Every one of these ships with tests, and the release goes through our standard gates — reproducible CI/CD builds, SBOM generation, image signing, and vulnerability scanning — as part of an engineering practice designed for auditability and aligned with SOC 2 and ISO 27001.

Getting it

pgAgroal Enterprise 1.2.0 is live on AWS Marketplace (metered per pod-hour) as the sole launchable version; existing 1.1.x deployments keep running, and new installs get 1.2.0. It's also on GHCR for direct consumers.

Upgrades are drop-in: backendTLS: require continues to work unchanged, and verify-full is opt-in when you add a CA ConfigMap. Full configuration — cloud secrets managers, the fleet control plane, coordinated connection limits, audit export, and Prometheus/Grafana observability — is in the documentation.

If you're fronting RDS or Aurora at scale and want backend connections you can actually verify, this is the release to move to.

Reactions

← All postsExplore Elevarq products →