configure pooler auth type based on parameters (#3193)

* configure pooler auth type based on parameters
* need to sync CONNECTION_POOLER_AUTH_TYPE
* add case when auth type is not yet set
* Update docs/migrate.md

Co-authored-by: Ida Novindasari <idanovinda@gmail.com>

* add type cast to only allow scram or md5

---------

Co-authored-by: Ida Novindasari <idanovinda@gmail.com>

pkg/cluster/connection_pooler.go

@@ -253,6 +253,8 @@ func (c *Cluster) getConnectionPoolerEnvVars() []v1.EnvVar {
 	minSize := defaultSize / 2
 	reserveSize := minSize
 
+	passwordEncryption := passwordEncryptionFromSpec(spec)
+
 	return []v1.EnvVar{
 		{
 			Name:  "CONNECTION_POOLER_PORT",
@@ -262,6 +264,10 @@ func (c *Cluster) getConnectionPoolerEnvVars() []v1.EnvVar {
 			Name:  "CONNECTION_POOLER_MODE",
 			Value: effectiveMode,
 		},
+		{
+			Name:  "CONNECTION_POOLER_AUTH_TYPE",
+			Value: string(passwordEncryption),
+		},
 		{
 			Name:  "CONNECTION_POOLER_DEFAULT_SIZE",
 			Value: fmt.Sprint(defaultSize),
@@ -912,6 +918,8 @@ func (c *Cluster) needSyncConnectionPoolerDefaults(Config *Config, spec *acidv1.
 		return false, reasons
 	}
 
+	authTypeFound := false
+	passwordEncryption := passwordEncryptionFromSpec(&c.Spec)
 	for _, env := range poolerContainer.Env {
 		if spec.User == "" && env.Name == "PGUSER" {
 			ref := env.ValueFrom.SecretKeyRef.LocalObjectReference
@@ -935,6 +943,22 @@ func (c *Cluster) needSyncConnectionPoolerDefaults(Config *Config, spec *acidv1.
 				env.Value, config.Schema)
 			reasons = append(reasons, msg)
 		}
+
+		if env.Name == "CONNECTION_POOLER_AUTH_TYPE" {
+			authTypeFound = true
+			if string(passwordEncryption) != env.Value {
+				sync = true
+				msg := fmt.Sprintf("pooler auth type is different (having %s, required %s)",
+					env.Value, passwordEncryption)
+				reasons = append(reasons, msg)
+			}
+		}
+	}
+
+	// env var is missing on deployments created before it was introduced
+	if !authTypeFound {
+		sync = true
+		reasons = append(reasons, "pooler auth type env variable is missing")
 	}
 
 	return sync, reasons