(7.0) Add Postgres Cloud SQL support

[r0mant]

This PR extends database access to support Postgres flavored GCP Cloud SQL databases with IAM authentication:

https://cloud.google.com/sql/docs/postgres/authentication

It works in a similar fashion to RDS and Aurora:

• Users connect to the database using service account name as a database user.
• Teleport database service generates an IAM auth token for that service account upon each connection.
• Generated auth token is used as a password when authenticating with the database.

Here's an example teleport.yaml configuration for a Cloud SQL instance:

db_service:
  enabled: "yes"
  databases:
  - name: "postgres-gcp"
    description: "PostgreSQL 9.6: Google Cloud SQL"
    protocol: "postgres"
    uri: "35.1.2.3:5432"
    ca_cert_file: /var/lib/teleport-root/gcp-test-root.pem
    gcp:
      project_id: "project-id"
      instance_id: "instance-id"
    static_labels:
      env: gcp

Also, IAM authentication is a relatively new Cloud SQL feature and is currently supported only by Postgres. Once it expands to MySQL, we'll be able to enable it for MySQL as well.

[r0mant]

@awly Could you please be a 2nd reviewer on this when you get time? Thanks.

[awly]

There's a serverCaCert in https://cloud.google.com/sql/docs/postgres/instance-info#rest-v1beta4

[r0mant]

Good find, I've updated the comment to include this link. Looking at this API, it just returns information about the certificate in a parsed form and I couldn't see if there's a "raw" pem, but maybe there's another API to call to retrieve certificate by its ID or something. Will investigate more when we work on this todo item.

[r0mant]

@a-palchikov @awly I've addressed your comments guys, please take another look.

[russjones]

Bot.