upstream

Sep 16, 2026

Changes in this version

+ var ErrPostgresNoCancelKey = errors.New("no upstream cancellation key")

+ func CancelPostgres(ctx context.Context, dial DialFunc, sslMode, host string, ...) error

Aug 14, 2026

Changes in this version

+ var ErrKubernetesCANotPinnable = errors.New("kubernetes: the API server presented no certificate to pin")

+ var ErrKubernetesCAPinMismatch = errors.New(...)

+ var ErrKubernetesForbidden = errors.New("kubernetes: the service account is not authorized for this action")

+ var ErrKubernetesNoCACert = errors.New(...)

+ var ErrKubernetesNoHost = errors.New("kubernetes: the cluster row has no API server host")

+ var ErrKubernetesNoToken = errors.New("kubernetes: the cluster row has no service account token")

+ var ErrKubernetesProtocolMismatch = errors.New("kubernetes: the API server negotiated an unexpected subprotocol")

+ var ErrKubernetesTargetNotFound = errors.New("kubernetes: target pod or service not found in the namespace")

+ var ErrKubernetesTargetNotReady = errors.New("kubernetes: no ready pod backs the target")

+ var ErrKubernetesUnauthorized = errors.New("kubernetes: the API server rejected the service account token")

+ var ErrPortForwardRefused = errors.New("kubernetes: the kubelet refused to forward")

+ func IsPermanentError(err error) bool

+ func LearnKubernetesCACert(ctx context.Context, cfg KubernetesConfig) (string, error)

+ type KubernetesConfig struct

+ CACert string

+ DialContext func(ctx context.Context, network, addr string) (net.Conn, error)

+ Host string

+ InsecureSkipTLSVerify bool

+ LearnedCACert string

+ Namespace string

+ Port int

+ Token string

+ UserAgent string

+ type KubernetesTunnel struct

+ func NewKubernetesTunnel(cfg KubernetesConfig) (*KubernetesTunnel, error)

+ func (t *KubernetesTunnel) CheckPodReady(ctx context.Context, podName string) error

+ func (t *KubernetesTunnel) Dial(ctx context.Context, host string, port int) (net.Conn, error)

+ func (t *KubernetesTunnel) DialPod(ctx context.Context, podName string, containerPort int) (net.Conn, error)

+ func (t *KubernetesTunnel) Namespace() string

+ func (t *KubernetesTunnel) PortForwardAllowed(ctx context.Context) (PortForwardAccess, error)

+ func (t *KubernetesTunnel) ResolvePod(ctx context.Context, host string) (string, error)

+ type PortForwardAccess struct

+ Create bool

+ CreateReason string

+ Get bool

+ GetReason string

+ func (a PortForwardAccess) Allowed() bool

Aug 7, 2026

Changes in this version

+ const MSSQLEncryptNotSup

+ const MSSQLEncryptOff

+ const MSSQLEncryptOn

+ const MSSQLEncryptReq

+ var ErrMSSQLEncryptionMismatch = errors.New("mssql: upstream refused the offered transport encryption")

+ var ErrMSSQLLoginRejected = errors.New("mssql: upstream rejected the login")

+ var ErrMSSQLNoAttempt = errors.New("mssql: ssl_mode produced no connection attempt")

+ var ErrMSSQLTLSHandshake = errors.New("mssql: upstream TLS handshake failed")

+ func MSSQLAnswerAcceptable(a Attempt, serverValue byte) bool

+ func MSSQLEncryptionOption(a Attempt) byte

+ func MSSQLRetryable(err error) bool

+ type MSSQLConfig struct

+ AppName string

+ Database string

+ Host string

+ Password string

+ Port int

+ SSLMode string

+ Username string

type Plan

+ func MSSQLPlan(cfg MSSQLConfig) Plan

Aug 5, 2026

Changes in this version

+ const SSLModeAllow

+ const SSLModeDisable

+ const SSLModePrefer

+ const SSLModeRequire

+ const SSLModeVerifyCA

+ const SSLModeVerifyFull

+ var ErrMySQLNoAttempt = errors.New("mysql: ssl_mode produced no connection attempt")

+ var ErrOracleConnectorShape = errors.New("go-ora connector does not expose a dialer hook")

+ var ErrPostgresAuthFailed = errors.New("upstream authentication failed")

+ var ErrPostgresSSLResponse = errors.New("unexpected upstream SSL response byte")

+ var ErrPostgresTLSRequired = errors.New("upstream rejected TLS but ssl_mode requires it")

+ var ErrSCRAMMalformedMessage = errors.New("malformed SCRAM message from upstream")

+ var ErrSCRAMNoSupportedMechanism = errors.New("upstream offered no SCRAM mechanism we support")

+ var ErrSCRAMServerNonceMismatch = errors.New("SCRAM server nonce did not extend client nonce")

+ var ErrSCRAMServerSignature = errors.New("SCRAM server signature mismatch")

+ var ErrSCRAMUnexpectedMessage = errors.New("unexpected SASL message from upstream")

+ func ConnectOracle(ctx context.Context, dial DialFunc, cfg OracleConfig) (driver.Conn, error)

+ type Attempt struct

+ TLS *tls.Config

+ func (a Attempt) Encrypted() bool

+ type DialFunc func(ctx context.Context) (net.Conn, error)

+ type MySQLConfig struct

+ Database string

+ Host string

+ Password string

+ Port int

+ ProgramName string

+ SSLMode string

+ Username string

+ type MySQLUpstream struct

+ Conn *gomysqlclient.Conn

+ TLS bool

+ func ConnectMySQL(ctx context.Context, dial DialFunc, cfg MySQLConfig) (*MySQLUpstream, error)

+ func (u *MySQLUpstream) Close() error

+ type OracleConfig struct

+ Host string

+ Password string

+ Port int

+ ProgramName string

+ SSLMode string

+ ServiceName string

+ Username string

+ type Plan struct

+ Attempts []Attempt

+ Mode string

+ func PlanFor(mode, host string) Plan

+ func (p Plan) AllowsPlaintext() bool

+ func (p Plan) OffersTLS() bool

+ func (p Plan) PrefersTLS() bool

+ func (p Plan) RequiresTLS() bool

+ func (p Plan) TLSConfig() *tls.Config

+ type PostgresAuthError struct

+ Response *pgproto3.ErrorResponse

+ func (e *PostgresAuthError) Error() string

+ func (e *PostgresAuthError) Unwrap() error

+ type PostgresConfig struct

+ ApplicationName string

+ Database string

+ Host string

+ Password string

+ SSLMode string

+ Username string

+ type PostgresUpstream struct

+ BackendKeyData *pgproto3.BackendKeyData

+ Conn net.Conn

+ Frontend *pgproto3.Frontend

+ ParameterStatuses []*pgproto3.ParameterStatus

+ ReadyForQuery *pgproto3.ReadyForQuery

+ TLS bool

+ func ConnectPostgres(ctx context.Context, dial DialFunc, cfg PostgresConfig, logger *slog.Logger) (*PostgresUpstream, error)

+ func (u *PostgresUpstream) Close() error