Can't connect to Cloud SQL instance from local proxy because of service account

[alexandre-br]

I'm new to GCP and currently trying to connect a local project to a Cloud SQL instance, but the proxy tells me that the certificate is invalid. The credentials file was initially generated from a newly created service account that had the Client SQL role; it didn't worked, so I created a new one that has the Cloud SQL Admin role, but the error won't go away. That's what the proxy tells me:

cloudsql-proxy | 2023/02/14 12:06:15 couldn't connect to "<my-project>:southamerica-east1:<my-instance>": x509: certificate is valid for 16-c57c61b2-a060-46c4-b781-ca7113f5f75b.southamerica-east1.sql.goog, not <my-project>:<my-instance>

Now, the description seems clear to me: the current account doesn't have access to the instance; but I couldn't find a way to grant said access. What am I missing?

[darsh_shukla]

Hi,

If you are using a service account to authenticate the Cloud SQL follow these steps. 

If you want to connect with SSL/TLS certificates follow these steps. Remember you have to patch your instance.

gcloud sql instances patch <instance-name> --require-ssl

[BenTheMeta]

I am experiencing the same issue. Except I have had several PostgreSQL DBs running for years and I recently created a new one. When deploying the new proxy, it attempts to connect to the new DB and I get the above error. In the proxy connection string, if I change nothing but the DB instance name to an old DB instance, it connects properly. My old DBs nor my new DB do not require SSL.

This means the service account credentials are being applied correctly.

Also, I am able to run the proxy locally and it connects properly.

[BenTheMeta · Accepted solution]

Upgrading the gcr.io/cloudsql-docker/gce-proxy from 1.11 to 1.33.2 fixed my issue.

[alexandre-br]

Thanks, @BenTheMeta.

(Replying just now because we chose to use the proxy only in production, which we are deploying now.)

[kenwizz]

This solved my issue too. After about 2 hrs of turning my pods describe and logs inside out trying to establish why my health checks are not running. Thanks Ben.