aws_advanced_ruby_driver_wrapper 1.0.1 → 1.1.0

data/lib/aws_advanced_ruby_driver_wrapper/mysql.rb

@@ -20,6 +20,7 @@ require_relative '../aws_advanced_ruby_driver_wrapper'
 require_relative 'utils/connection_config_parser'
 require_relative 'utils/sql_encoding'
 require_relative 'services/service_utility'
+require_relative 'utils/telemetry/telemetry_factory'
 require_relative 'ruby_method'
 require_relative 'errors'
 
@@ -34,13 +35,16 @@ module AwsAdvancedRubyDriverWrapper
     def initialize(**)
       ensure_mysql2!
       config = Utils::ConnectionConfigParser.parse(:mysql2, **)
-      @service_container = Services::ServiceUtility.create_standard_container(config)
-      @service_container.host_service.refresh_host_list
-      @async_conn = nil
-      @async_sql = nil
-      @last_sql = nil
-      conn_service = @service_container.connection_service
-      @service_container.plugin_manager.connect(conn_service.initial_host_info, conn_service.driver_props, true)
+      telemetry_factory = Utils::Telemetry::TelemetryFactory.new(config.wrapper_props)
+      telemetry_factory.in_context("#{self.class.name}.new", Utils::Telemetry::TraceLevel::TOP_LEVEL, record_result: true) do
+        @service_container = Services::ServiceUtility.create_standard_container(config, telemetry_factory:)
+        @service_container.host_service.refresh_host_list
+        @async_conn = nil
+        @async_sql = nil
+        @last_sql = nil
+        conn_service = @service_container.connection_service
+        @service_container.plugin_manager.connect(conn_service.initial_host_info, conn_service.driver_props, true)
+      end
     end
 
     # Explicitly define critical methods (bypass method_missing to avoid method_missing overhead)
@@ -53,6 +57,7 @@ module AwsAdvancedRubyDriverWrapper
     # What is remembered is the copy of the SQL that plugins inspect, made once here rather than on
     # every call that is handed it later. The driver is sent the SQL as the application wrote it.
     def query(sql, options = {})
+      ensure_connected!
       inspected = Utils::SqlEncoding.inspectable(sql)
       result = pm.execute(RubyMethod::CONNECTION_QUERY, current_conn, ->(*a) { current_conn.query(*a) }, sql, options,
                           sql: inspected)
@@ -76,10 +81,14 @@ module AwsAdvancedRubyDriverWrapper
     end
 
     def ping
+      return false if current_conn.nil?
+
       pm.execute(RubyMethod::CONNECTION_PING, current_conn, -> { current_conn.ping })
     end
 
     def close
+      return if current_conn.nil?
+
       pm.execute(RubyMethod::CONNECTION_CLOSE, current_conn, -> { current_conn.close })
     end
 
@@ -143,8 +152,7 @@ module AwsAdvancedRubyDriverWrapper
     BOUNDED_TO_ASYNC = Set[:abandon_results!].freeze
 
     def method_missing(method_name, *args, **kwargs, &)
-      conn = current_conn
-      raise NoMethodError, 'Connection not initialized' if conn.nil?
+      conn = ensure_connected!
       raise NoMethodError, "undefined method `#{method_name}' for #{self.class}" unless conn.respond_to?(method_name)
 
       method_key = "connection.#{method_name}"
@@ -197,6 +205,16 @@ module AwsAdvancedRubyDriverWrapper
       @service_container.connection_service.current_connection
     end
 
+    # Guards the entry points that reach for the current connection directly (the query path and
+    # method_missing). Without a live connection AR expects the driver's own "not connected" error,
+    # which it translates to a connection error; a bare NoMethodError on nil would not be recognized.
+    def ensure_connected!
+      conn = current_conn
+      raise Mysql2::Error::ConnectionError, 'MySQL client is not connected' if conn.nil?
+
+      conn
+    end
+
     def pm
       @service_container.plugin_manager
     end

data/lib/aws_advanced_ruby_driver_wrapper/plugins/blue_green/blue_green_plugin.rb

@@ -19,6 +19,7 @@ require_relative '../../logging'
 require_relative '../../ruby_method'
 require_relative '../../property_definition'
 require_relative '../../utils/rds_utils'
+require_relative 'drop_blue_connections_marker'
 require_relative 'phase'
 require_relative 'role'
 require_relative 'status'
@@ -32,6 +33,14 @@ module AwsAdvancedRubyDriverWrapper
 
         BLUE_GREEN_NAME = :blue_green
 
+        # Storage partition for the drop-blue-connections marker, kept separate from BLUE_GREEN_NAME so
+        # it can outlive the status cache's TTL. The marker is stored once per switchover and never
+        # re-stamped, so a connection that sits idle longer than the status cache's TTL must still find
+        # the marker on its next use. A long TTL is safe: a marker only matches connections opened before
+        # its own switchover, and a later switchover overwrites it.
+        DROP_MARKER_NAME = :blue_green_drop_marker
+        DROP_MARKER_TTL_SEC = 86_400
+
         # When present in wrapper_props, internal_connect calls bypass BG routing.
         # Used by BG monitoring connections to avoid being intercepted by their own plugin.
         BG_SKIP_ROUTING_KEY = :'bg.skip_routing'
@@ -43,6 +52,13 @@ module AwsAdvancedRubyDriverWrapper
 
         PROVIDERS = Concurrent::Map.new
 
+        # Storage key, within the DROP_MARKER_NAME cache, under which the drop-blue-connections marker
+        # for a deployment is kept. DROP_MARKER_NAME is a separate partition from the status cache, so
+        # the marker survives both the status cache's TTL and the provider's reset_context_when_completed.
+        def self.drop_marker_key(bgd_id)
+          "#{bgd_id}::drop_blue_connections_marker"
+        end
+
         def initialize(service_container, props = ::Concurrent::Map.new)
           @service_container = service_container
           @wrapper_props = props
@@ -52,7 +68,17 @@ module AwsAdvancedRubyDriverWrapper
           @start_time_ns = Concurrent::AtomicReference.new(0)
           @end_time_ns = Concurrent::AtomicReference.new(0)
 
+          # Per-connection drop-blue-connections state. Each wrapper client has its own plugin instance,
+          # so these describe this connection: when it was opened, the host it was opened to, and the
+          # identity of the last marker it was checked against.
+          @drop_blue_connections = PropertyDefinition::BG_DROP_BLUE_CONNECTIONS.get_bool(props)
+          @connection_open_time_ns = nil
+          @connect_time_host = nil
+          @checked_drop_marker_id = nil
+          @pending_stale_marker_id = nil
+
           service_container.storage_service.register(BLUE_GREEN_NAME, ttl: 3600)
+          service_container.storage_service.register(DROP_MARKER_NAME, ttl: DROP_MARKER_TTL_SEC)
 
           network_methods = service_container.dialect_service.driver_dialect.network_bound_methods
           @subscribed_methods = (Set['connect', 'internal_connect'] | network_methods).freeze
@@ -61,7 +87,12 @@ module AwsAdvancedRubyDriverWrapper
         attr_reader :subscribed_methods
 
         def connect(host_info, driver_props, is_initial_connection, pipeline_callable)
-          route_connect(host_info, driver_props, is_initial_connection, pipeline_callable, is_internal: false)
+          conn = route_connect(host_info, driver_props, is_initial_connection, pipeline_callable, is_internal: false)
+          # Only this client's own connect describes its connection. Internal connects (topology
+          # monitoring, KMS metadata reads) run through this same plugin instance but open separate
+          # connections, so they must not overwrite this connection's open time, host, or marker latches.
+          record_connection_open(host_info)
+          conn
         end
 
         def internal_connect(host_info, driver_props, wrapper_props, is_initial_connection, pipeline_callable)
@@ -79,7 +110,21 @@ module AwsAdvancedRubyDriverWrapper
 
             return pipeline_callable.call if CLOSING_METHODS.include?(method_name)
 
+            # Read the status before the stale check. The provider stores the active drop marker before
+            # it writes the POST/COMPLETED status, so reading status first closes the race where a stale
+            # check sees a still-pending marker and the COMPLETED early return below then skips re-checking
+            # the now-active marker: if the switchover has completed, the check below sees the active marker.
             @bg_status = storage_service.get(BLUE_GREEN_NAME, @bgd_id)
+
+            # Invalidate a connection opened to the old blue environment before a confirmed switchover,
+            # so the failover plugin reconnects through BG routing instead of serving a stale read. This
+            # runs before the NOT_CREATED/COMPLETED early return below, because after the switchover the
+            # status is COMPLETED (then NOT_CREATED) and would otherwise skip the check entirely.
+            if stale_blue_connection?
+              invalidate_stale_blue_connection
+              return pipeline_callable.call
+            end
+
             if @bg_status.nil? || @bg_status.current_phase == Phase::NOT_CREATED || @bg_status.current_phase == Phase::COMPLETED
               return pipeline_callable.call
             end
@@ -95,20 +140,24 @@ module AwsAdvancedRubyDriverWrapper
             result = nil
 
             while routing && result.nil?
-              result = routing.apply(method_name, @wrapper_props, storage_service)
+              result = routing.apply(method_name, @wrapper_props, storage_service, telemetry_factory: @service_container.telemetry_factory)
 
               next unless result.nil?
 
               @bg_status = storage_service.get(BLUE_GREEN_NAME, @bgd_id)
-              if @bg_status.nil?
-                @end_time_ns.set(nano_time)
-                return pipeline_callable.call
-              end
+              break if @bg_status.nil?
+
               routing = @bg_status.execute_routing.find { |r| r.match?(current_host, host_role) }
             end
 
             @end_time_ns.set(nano_time)
-            result.nil? ? pipeline_callable.call : result
+            return result unless result.nil?
+
+            # The call may have been held through the switchover (e.g. suspended during IN_PROGRESS and
+            # released at POST, which has no execute routing). Re-check whether this connection is now a
+            # stale blue connection before running it, so a held call is not run against retired blue.
+            invalidate_stale_blue_connection if stale_blue_connection?
+            pipeline_callable.call
           ensure
             @end_time_ns.set(nano_time) if @start_time_ns.get.positive? && @end_time_ns.get.zero?
           end
@@ -202,6 +251,65 @@ module AwsAdvancedRubyDriverWrapper
           end
         end
 
+        # Remembers when this connection was opened and the host it was opened to, so a later switchover
+        # can tell whether it is a blue connection that predates the switchover.
+        def record_connection_open(host_info)
+          return unless @drop_blue_connections
+
+          @connection_open_time_ns = nano_time
+          @connect_time_host = host_info&.host&.downcase
+          # A (re)connect produces a fresh connection (e.g. after failover): reset the per-connection
+          # marker latches so this new incarnation re-evaluates the current marker from a clean slate
+          # instead of inheriting the retired connection's checked/pending state.
+          @checked_drop_marker_id = nil
+          @pending_stale_marker_id = nil
+        end
+
+        # Whether this connection should be invalidated because it was opened to the old blue environment
+        # before a now-confirmed switchover. The marker is read on every call so a later switchover's
+        # marker is noticed. A marker that does not apply to this connection is latched immediately and
+        # never re-examined; a marker that does apply is only latched once #invalidate_stale_blue_connection
+        # confirms the close, so a transient close failure leaves the connection to be invalidated again on
+        # its next use instead of silently serving stale reads for the rest of its life.
+        def stale_blue_connection?
+          return false unless @drop_blue_connections
+
+          marker = storage_service.get(DROP_MARKER_NAME, self.class.drop_marker_key(@bgd_id), register_access: false)
+          return false unless marker.is_a?(DropBlueConnectionsMarker) && marker.active?
+          return false if marker.id == @checked_drop_marker_id
+
+          if marker.stale?(@connect_time_host, @connection_open_time_ns)
+            @pending_stale_marker_id = marker.id
+            true
+          else
+            # This connection does not predate the switchover and never will against this marker (markers
+            # are immutable), so latch it now to skip re-reading the marker on every future call.
+            @checked_drop_marker_id = marker.id
+            false
+          end
+        end
+
+        # Closes the connection directly through the driver dialect rather than the pipeline's close
+        # method. Going through the pipeline would set the failover plugin's @closed_explicitly, which
+        # would stop it from reconnecting. Closing it out from under the pipeline instead lets the
+        # failover plugin (if enabled) see a connection closed that it did not close, fail over, and
+        # raise FailoverSuccessError; without failover the driver raises its closed-connection error.
+        def invalidate_stale_blue_connection
+          logger.info do
+            "[bgd_id: '#{@bgd_id}'] Invalidating a connection to #{@connect_time_host} from the old blue environment " \
+              'retired by a Blue/Green switchover. It will fail over (or raise a closed-connection error) on this use.'
+          end
+
+          conn = @service_container.connection_service.current_connection
+          @service_container.dialect_service.driver_dialect.close_connection(conn) unless conn.nil?
+          # Only now that the close is confirmed do we latch the marker as handled. If the close raised
+          # and was swallowed below, the marker stays unlatched so the next use retries the invalidation
+          # rather than serving a stale read from retired blue for the rest of the connection's life.
+          @checked_drop_marker_id = @pending_stale_marker_id
+        rescue StandardError => e
+          logger.debug { "[bgd_id: '#{@bgd_id}'] Failed to invalidate stale blue connection: #{e.class}: #{e.message}" }
+        end
+
         def storage_service
           @service_container.storage_service
         end

data/lib/aws_advanced_ruby_driver_wrapper/plugins/blue_green/drop_blue_connections_marker.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+#  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+#
+#  Licensed under the Apache License, Version 2.0 (the "License").
+#  You may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at
+#
+#  http://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#  See the License for the specific language governing permissions and
+#  limitations under the License.
+
+require 'securerandom'
+
+module AwsAdvancedRubyDriverWrapper
+  module Plugins
+    module BlueGreen
+      # Records that a Blue/Green switchover is retiring the blue environment, so that connections
+      # opened to blue before the switchover can be invalidated the next time they are used.
+      #
+      # Ruby cannot safely abort a connection from another thread, so instead of dropping blue connections
+      # from the monitor thread, each connection checks this marker on its own thread the next time it is
+      # used. See the +bg_drop_blue_connections+ property and BlueGreenPlugin#execute.
+      #
+      # A marker is immutable. It becomes +pending+ when the switchover reaches IN_PROGRESS and is
+      # replaced by an +active+ copy (see #activated) once the switchover is confirmed by POST or
+      # COMPLETED. It is cleared on rollback.
+      class DropBlueConnectionsMarker
+        # @return [String] a unique identity for this switchover's marker, so a connection can tell
+        #   whether it has already been checked against it.
+        attr_reader :id
+
+        # @return [Integer] monotonic time (nanoseconds) at which the switchover reached IN_PROGRESS.
+        attr_reader :switchover_time_ns
+
+        # @return [Set<String>] the blue host set: downcased cluster and instance endpoint names plus
+        #   their pre-switchover IP addresses.
+        attr_reader :blue_hosts
+
+        # @param blue_hosts [Enumerable<String>] blue endpoint names and their pre-switchover IPs
+        # @param switchover_time_ns [Integer] monotonic time the switchover reached IN_PROGRESS
+        # @param id [String] unique identity for this marker
+        # @param active [Boolean] false while the switchover is in progress, true once it is confirmed
+        def initialize(blue_hosts:, switchover_time_ns:, id: SecureRandom.uuid, active: false)
+          @id = id
+          @switchover_time_ns = switchover_time_ns
+          @blue_hosts = blue_hosts.to_set.freeze
+          @active = active
+          freeze
+        end
+
+        def active?
+          @active
+        end
+
+        # @return [DropBlueConnectionsMarker] an active copy of this marker, keeping its identity.
+        def activated
+          return self if @active
+
+          DropBlueConnectionsMarker.new(
+            blue_hosts: @blue_hosts, switchover_time_ns: @switchover_time_ns, id: @id, active: true
+          )
+        end
+
+        # Whether a connection opened to the given host at the given time is now a stale blue connection.
+        #
+        # @param host [String, nil] the downcased connect-time host of the connection
+        # @param open_time_ns [Integer, nil] the monotonic time the connection was opened
+        # @return [Boolean]
+        def stale?(host, open_time_ns)
+          return false unless @active
+          return false if host.nil? || open_time_ns.nil?
+          return false unless open_time_ns < @switchover_time_ns
+
+          @blue_hosts.include?(host)
+        end
+      end
+    end
+  end
+end

data/lib/aws_advanced_ruby_driver_wrapper/plugins/blue_green/host_mapper.rb

@@ -39,8 +39,10 @@ module AwsAdvancedRubyDriverWrapper
           build_cluster_pairs(source_status, target_status)
         end
 
+        # Keyed by downcased host so lookups line up with role_by_host (also downcased); the blue host
+        # set the drop-blue-connections marker is built from indexes this map with downcased endpoints.
         def merge_ips(ip_map)
-          @host_ip_addresses.merge!(ip_map)
+          ip_map.each { |host, ip| @host_ip_addresses[host.downcase] = ip }
         end
 
         def register_role(host_names, role)

data/lib/aws_advanced_ruby_driver_wrapper/plugins/blue_green/routing/base_routing.rb

@@ -15,6 +15,7 @@
 #  limitations under the License.
 
 require_relative '../../../logging'
+require_relative '../../../utils/telemetry/telemetry_const'
 
 module AwsAdvancedRubyDriverWrapper
   module Plugins
@@ -24,6 +25,7 @@ module AwsAdvancedRubyDriverWrapper
           include Logging
 
           MINIMUM_SLEEP_CHUNK_SEC = 0.05
+          TELEMETRY_SWITCHOVER = 'Blue/Green Deployment switchover'
 
           def match?(host_info, role)
             (@host.nil? || @host.downcase == host_info&.host&.downcase) &&
@@ -39,6 +41,11 @@ module AwsAdvancedRubyDriverWrapper
               "bgd_id: #{defined?(@bgd_id) ? (@bgd_id || '<null>') : '<n/a>'}]"
           end
 
+          # Records the time a call is held while the switchover is in progress as a span.
+          def in_switchover_span(telemetry_factory, &)
+            telemetry_factory.in_context(TELEMETRY_SWITCHOVER, Utils::Telemetry::TraceLevel::NESTED, &)
+          end
+
           # Blocks until the Blue/Green switchover phase is no longer IN_PROGRESS, or until the
           # configured timeout elapses.
           def wait_while_in_progress(wrapper_props, storage_service, bgd_id, sleep_time_sec = MINIMUM_SLEEP_CHUNK_SEC)

data/lib/aws_advanced_ruby_driver_wrapper/plugins/blue_green/routing/substitute_connect_routing.rb

@@ -52,57 +52,37 @@ module AwsAdvancedRubyDriverWrapper
                     bg_plugin: nil)
             plugin_manager = service_container.plugin_manager
             dialect_service = service_container.dialect_service
+            driver_dialect = dialect_service.driver_dialect
 
             unless Utils::RdsUtils.ip?(@substitute_host.host)
               return open_connection(plugin_manager, @substitute_host, driver_props, wrapper_props, is_initial_connection, is_internal,
                                      bg_plugin)
             end
 
-            # mysql2 uses :host for both socket connection and TLS CN verification.
-            # Connecting to a raw IP with TLS active causes a CN mismatch.
-            # Fall back to connecting via hostname (DNS will resolve to the correct IP post-switchover),
-            # matching the effective behaviour of the Java/Go MySQL drivers which use the original
-            # hostname for TLS regardless of the socket address.
-            if driver_props[:sslca] && !plugin_manager.plugin_in_use?(Plugins::IamAuthPlugin)
+            # The substitute host is a raw IP, so a connection made by hostname could resolve (via DNS)
+            # to the old instance during the switchover window. Connect to the IP directly instead.
+            if plugin_manager.iam_token_plugin_in_use?
+              return apply_iam(service_container, driver_props, wrapper_props, is_initial_connection, bg_plugin)
+            end
+
+            # pg can pin the socket to the IP (hostaddr) while keeping the original hostname for TLS
+            # verification, so the pinned connection reaches the right instance and still passes
+            # verify-full whatever the CA source.
+            pinned_props = driver_dialect.props_pinned_to_ip(driver_props, @substitute_host.host)
+            if pinned_props
               hostname_host = @substitute_host.deep_dup(host: @host)
-              return open_connection(plugin_manager, hostname_host, driver_props, wrapper_props, is_initial_connection, is_internal,
+              return open_connection(plugin_manager, hostname_host, pinned_props, wrapper_props, is_initial_connection, is_internal,
                                      bg_plugin)
             end
 
-            if plugin_manager.plugin_in_use?(Plugins::IamAuthPlugin)
-              if @iam_hosts.nil? || @iam_hosts.empty?
-                raise StandardError,
-                      'Connecting with IP address when IAM authentication is enabled requires an \'iam_host\' parameter.'
-              end
-
-              @iam_hosts.each do |iam_host|
-                rerouted_host = @substitute_host.deep_dup
-                rerouted_host.id = iam_host.id
-                rerouted_host.availability = Host::HostAvailability::AVAILABLE
-
-                rerouted_wrapper_props = wrapper_props.dup
-                PropertyDefinition::IAM_HOST.set(rerouted_wrapper_props, iam_host.host)
-                PropertyDefinition::IAM_PORT.set(rerouted_wrapper_props, iam_host.port.to_s) if iam_host.port_specified?
-
-                begin
-                  conn = plugin_manager.internal_connect(
-                    rerouted_host,
-                    driver_props,
-                    rerouted_wrapper_props,
-                    is_initial_connection,
-                    plugin_to_skip: bg_plugin
-                  )
-                  begin
-                    @iam_successful_connect_notify&.call(iam_host.host)
-                  rescue StandardError
-                    nil
-                  end
-                  return conn
-                rescue StandardError => e
-                  raise unless dialect_service.login_error?(e)
-                end
-              end
-              return nil
+            # mysql2/trilogy use :host for both the socket and TLS CN verification, so connecting to a
+            # raw IP with TLS active causes a CN mismatch. When TLS is active, fall back to the hostname
+            # (DNS resolves to the correct IP post-switchover), matching the effective behaviour of the
+            # Java/Go drivers which use the original hostname for TLS regardless of the socket address.
+            if driver_props[driver_dialect.tls_ca_property_key]
+              hostname_host = @substitute_host.deep_dup(host: @host)
+              return open_connection(plugin_manager, hostname_host, driver_props, wrapper_props, is_initial_connection, is_internal,
+                                     bg_plugin)
             end
 
             open_connection(plugin_manager, @substitute_host, driver_props, wrapper_props, is_initial_connection, is_internal, bg_plugin)
@@ -114,6 +94,53 @@ module AwsAdvancedRubyDriverWrapper
 
           private
 
+          # Connects to the substitute IP with IAM auth active, trying each configured IAM host in turn
+          # so the IAM plugin can resolve the correct token hostname. pg pins the socket to the IP
+          # (hostaddr) while presenting the IAM host name for TLS verification; the IAM token is still
+          # generated for the IAM host via the IAM_HOST property. Other drivers connect to the IP as-is.
+          def apply_iam(service_container, driver_props, wrapper_props, is_initial_connection, bg_plugin)
+            plugin_manager = service_container.plugin_manager
+            dialect_service = service_container.dialect_service
+            driver_dialect = dialect_service.driver_dialect
+
+            if @iam_hosts.nil? || @iam_hosts.empty?
+              raise StandardError,
+                    'Connecting with IP address when IAM authentication is enabled requires an \'iam_host\' parameter.'
+            end
+
+            @iam_hosts.each do |iam_host|
+              rerouted_host = @substitute_host.deep_dup
+              rerouted_host.id = iam_host.id
+              rerouted_host.availability = Host::HostAvailability::AVAILABLE
+
+              rerouted_wrapper_props = wrapper_props.dup
+              PropertyDefinition::IAM_HOST.set(rerouted_wrapper_props, iam_host.host)
+              PropertyDefinition::IAM_PORT.set(rerouted_wrapper_props, iam_host.port.to_s) if iam_host.port_specified?
+
+              connect_props = driver_props
+              pinned_props = driver_dialect.props_pinned_to_ip(driver_props, @substitute_host.host)
+              if pinned_props
+                connect_props = pinned_props
+                rerouted_host = rerouted_host.deep_dup(host: iam_host.host)
+              end
+
+              begin
+                conn = plugin_manager.internal_connect(
+                  rerouted_host, connect_props, rerouted_wrapper_props, is_initial_connection, plugin_to_skip: bg_plugin
+                )
+                begin
+                  @iam_successful_connect_notify&.call(iam_host.host)
+                rescue StandardError
+                  nil
+                end
+                return conn
+              rescue StandardError => e
+                raise unless dialect_service.login_error?(e)
+              end
+            end
+            nil
+          end
+
           # Opens a connection through the plugin pipeline. Monitoring connections (is_internal: true)
           # must use internal_connect so they do NOT mutate the shared current connection — otherwise
           # one monitor thread's connect would close another monitor thread's live connection via

data/lib/aws_advanced_ruby_driver_wrapper/plugins/blue_green/routing/suspend_connect_routing.rb

@@ -35,8 +35,10 @@ module AwsAdvancedRubyDriverWrapper
             storage_service = service_container.storage_service
             hold_start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
 
-            wait_while_in_progress(wrapper_props, storage_service, @bgd_id, SLEEP_TIME_SEC) do |timeout_sec|
-              "Blue/Green Deployment switchover is still in progress after #{timeout_sec} s. Try to connect again later."
+            in_switchover_span(service_container.telemetry_factory) do
+              wait_while_in_progress(wrapper_props, storage_service, @bgd_id, SLEEP_TIME_SEC) do |timeout_sec|
+                "Blue/Green Deployment switchover is still in progress after #{timeout_sec} s. Try to connect again later."
+              end
             end
 
             elapsed_ms = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - hold_start_time) * 1000).round

data/lib/aws_advanced_ruby_driver_wrapper/plugins/blue_green/routing/suspend_execute_routing.rb

@@ -31,11 +31,13 @@ module AwsAdvancedRubyDriverWrapper
           end
 
           # Blocks until switchover is no longer IN_PROGRESS
-          def apply(method_name, wrapper_props, storage_service)
+          def apply(method_name, wrapper_props, storage_service, telemetry_factory:)
             hold_start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
 
-            wait_while_in_progress(wrapper_props, storage_service, @bgd_id, SLEEP_TIME_SEC) do |timeout_sec|
-              "Blue/Green Deployment switchover is still in progress after #{timeout_sec} s. Try '#{method_name}' again later."
+            in_switchover_span(telemetry_factory) do
+              wait_while_in_progress(wrapper_props, storage_service, @bgd_id, SLEEP_TIME_SEC) do |timeout_sec|
+                "Blue/Green Deployment switchover is still in progress after #{timeout_sec} s. Try '#{method_name}' again later."
+              end
             end
 
             elapsed_ms = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - hold_start_time) * 1000).round

data/lib/aws_advanced_ruby_driver_wrapper/plugins/blue_green/routing/suspend_until_corresponding_host_found_connect_routing.rb

@@ -35,8 +35,14 @@ module AwsAdvancedRubyDriverWrapper
           # Blocks until a corresponding green host is found for host_info.host, the switchover
           # completes, or the timeout elapses.
           def apply(host_info, _, wrapper_props, _is_initial_connection, service_container, is_internal: false, bg_plugin: nil)
-            storage_service = service_container.storage_service
+            in_switchover_span(service_container.telemetry_factory) do
+              hold_until_corresponding_host_found(host_info, wrapper_props, service_container.storage_service)
+            end
+          end
+
+          private
 
+          def hold_until_corresponding_host_found(host_info, wrapper_props, storage_service)
             bg_status = storage_service.get(BlueGreenPlugin::BLUE_GREEN_NAME, @bgd_id)
             corresponding_pair = bg_status&.corresponding_hosts&.[](host_info.host)
 

data/lib/aws_advanced_ruby_driver_wrapper/plugins/blue_green/status_builder.rb

@@ -223,7 +223,7 @@ module AwsAdvancedRubyDriverWrapper
             next [] if host_pair.nil?
 
             blue_host_spec    = host_pair[0]
-            blue_ip_entry     = @host_mapper.host_ip_addresses[blue_host_spec.host]
+            blue_ip_entry     = @host_mapper.host_ip_addresses[blue_host_spec.host.downcase]
             blue_ip_host_spec = blue_ip_entry ? Host::HostInfo.new(host: blue_ip_entry, port: blue_host_spec.port,
                                                                    role: blue_host_spec.role) : blue_host_spec
 

data/lib/aws_advanced_ruby_driver_wrapper/plugins/blue_green/status_monitor.rb

@@ -394,7 +394,7 @@ module AwsAdvancedRubyDriverWrapper
         end
 
         def iam_enabled?
-          @service_container.plugin_manager.plugin_in_use?(Plugins::IamAuthPlugin)
+          @service_container.plugin_manager.iam_token_plugin_in_use?
         end
 
         def driver_dialect
@@ -421,14 +421,6 @@ module AwsAdvancedRubyDriverWrapper
           true
         end
 
-        def syntax_error?(err)
-          driver_dialect.sql_state(err)&.start_with?('42') || false
-        end
-
-        def db_error?(err)
-          !driver_dialect.sql_state(err).nil?
-        end
-
         # @note Callers must hold @connection_mutex (invoke within a @connection_mutex.synchronize block).
         def status_available?(conn)
           dialect = @service_container.dialect_service.db_dialect
@@ -508,11 +500,11 @@ module AwsAdvancedRubyDriverWrapper
         end
 
         def handle_collect_status_error(err, conn)
-          if syntax_error?(err)
+          if @service_container.dialect_service.schema_error?(err)
             @current_phase = Phase::NOT_CREATED
             logger.warn { "[#{@role}] current_phase: #{@current_phase}, exception while querying for blue/green status." }
-          elsif db_error?(err)
-            if err.message.include?('An error occurred while retrieving the blue/green fast switchover metadata')
+          elsif @service_container.dialect_service.database_error?(err)
+            if err.message.include?('while retrieving the blue/green fast switchover metadata')
               @current_phase = Phase::NOT_CREATED
               return
             end
@@ -557,7 +549,8 @@ module AwsAdvancedRubyDriverWrapper
             @service_container.plugin_manager,
             @service_container.session_state_service,
             @service_container.storage_service,
-            @service_container.monitor_service
+            @service_container.monitor_service,
+            @service_container.telemetry_factory
           )
 
           @host_list_provider = @service_container.dialect_service.db_dialect.create_host_list_provider(scoped_container)