ConnectionString is the ready-to-use DSN, credential included. RETURNED HERE ONCE: no read beside this one carries it, so a caller that does not keep it must provision again.
Database is the logical database, collection, index or bucket this resource resolves to on its backend. It is derived from Name under an org-namespacing hash, so it is not Name and two orgs cannot land on one.
Host is the address that routes to this resource — a dedicated instance's own in-cluster Service, or the public gateway for a shared one. Never the internal admin address of a shared backend.
Password is the minted credential, in plaintext, for the kinds that have one. RETURNED HERE ONCE — where KMS is configured it is sealed there and only a reference is persisted; where it is not, it is stored nowhere at all. It is never held in plaintext on either side.
Status is "ready", or "provisioning" while a dedicated instance is still being materialized by the operator. A shared-backend create is "ready" here; a dedicated one answers 201 still launching, and reaches ready only when a later read reconciles it against the operator's live CR — never fabricated.
Username is the credential's user, for the kinds that mint one per resource. Absent for a kind whose backend authenticates with a shared, out-of-band key.