Support Azure Database for PostgreSQL AAD token refresh in SPIRE SQL datastore

Summary

SPIRE currently requires a workaround to run against Azure Database for PostgreSQL (AAD-only auth) in Azure environments.
In our deployment, we use init+sidecar containers to continuously mint Entra access tokens and write a PGPASSFILE for SPIRE.

This works, but it adds operational complexity and an extra failure surface.
We’d like to propose native support in SPIRE’s PostgreSQL datastore path for Azure Entra token-based auth with automatic refresh.

Problem statement

When PostgreSQL is configured for AAD-only auth, access tokens are short-lived.
Today, SPIRE deployments must externally handle token acquisition/rotation (e.g., sidecar writing pgpass), because SPIRE does not expose first-class token-provider semantics for Azure Entra access tokens in datastore config.

Operational drawbacks of the sidecar pattern:

• extra container(s), startup ordering, shared volume handling
• token-refresh loop management outside SPIRE
• more moving parts to monitor/debug
• less portable “single-binary” operational model

Proposed change

Add a native datastore auth mode for PostgreSQL that supports Azure Entra token acquisition and refresh, ideally via a pluggable credential-provider abstraction.

At minimum, an Azure provider should support:

• Managed Identity / workload identity token acquisition
• Token scope/resource for Azure Database for PostgreSQL
• Automatic refresh before/at connection (without storing long-lived secrets)
• Compatibility with pooled DB connections and token expiry behavior

Possible configuration direction (illustrative)

A config model similar to:

• database_type = "postgres"
• auth_mode = "token" (or equivalent)
• provider block for Azure credential settings (or default credential chain)
• optional knobs for refresh behavior / connection max lifetime

(Exact schema/API up to maintainers; this is just intent.)

Acceptance criteria

• SPIRE can connect to Azure Database for PostgreSQL in AAD-only mode without sidecars/init scripts.
• Token refresh is handled by SPIRE for new/recycled connections.
• Existing username/password PostgreSQL configs remain fully backward compatible.
• No sensitive token material is logged.
• Works in common Azure runtimes (e.g., AKS, Container Apps, VM) using managed identity.

Non-goals

• Reworking unrelated datastore backends.
• Introducing Azure-specific requirements for non-Azure users.
• Breaking existing SQL datastore configuration.

Why this matters

This would significantly simplify production deployments of SPIRE on Azure, reduce operational risk, and align SPIRE with modern short-lived credential patterns.

Additional context

There are app-level examples of Entra token refresh patterns for PostgreSQL clients, but those are language/client specific.
A representative reference is this Microsoft sample repo:
https://github.com/Azure-Samples/Access-token-refresh-samples/tree/main

What’s needed here is SPIRE-native datastore behavior so operators don’t need sidecar token management.

Maintainer guidance / contributor intent

If maintainers are generally open to a PR that adds this behavior (behind clear configuration and without breaking existing datastore usage), I’d be willing to help support the development and contribute implementation work.