调试Cloud Build数据库连接

Question

我的云构建CI管道失败了，几乎没有调试信息，但有几个因素指向数据库连接失败。这是构建日志的最后一部分:

...
Step #3 - "tests": webpack compiled successfully
Step #3 - "tests": [ info ]  running tests...
Step #3 - "tests": 
Step #3 - "tests":    connect ENOENT /cloudsql/w121-cms:europe-west1:w121/.s.PGSQL.5432
Step #3 - "tests":   
Step #3 - "tests": 
Finished Step #3 - "tests"
ERROR
ERROR: build step 3 "gcr.io/cloud-builders/npm" failed: step exited with non-zero status: 1

这是我的构建脚本:

steps:
- id: install
name: 'gcr.io/cloud-builders/npm'
args: ['install']
- id: lint
name: 'gcr.io/cloud-builders/npm'
args: ['run', 'lint']
- id: proxy-install
name: 'gcr.io/cloud-builders/npm'
entrypoint: sh
args:
- -c
- 'wget -O /workspace/cloud_sql_proxy https://dl.google.com/cloudsql/cloud_sql_proxy.linux.386 &&  chmod +x /workspace/cloud_sql_proxy'
- id: tests
name: 'gcr.io/cloud-builders/npm'
timeout: 100s
entrypoint: sh
args:
- -c
- '(/workspace/cloud_sql_proxy $PROJECT_ID:europe-west1:w121 & sleep 2) && npm run ci:test'
env:
- 'NODE_ENV=test'
- 'DB_CONNECTION=pg'
- 'PG_HOST=/cloudsql/$PROJECT_ID:europe-west1:w121'
- 'PG_PORT=5432'
- 'PG_USER=postgres'
- 'PG_DB_NAME=testing'
- others ...
secretEnv: ['PG_PASSWORD', 'APP_KEY']
availableSecrets:
secretManager:
- env: 'PG_PASSWORD'
versionName: projects/$PROJECT_ID/secrets/PG_PASSWORD/versions/1
- env: 'APP_KEY'
versionName: projects/$PROJECT_ID/secrets/APP_KEY/versions/1

我检查了什么:

连接参数所有DB_CONNECTION,PG_HOST,PG_PORT和PG_USER与另一个工作构建脚本相同。从日志输出中，我们可以看到主机值中的$PROJECT_ID解析正确。在postgres实例中肯定有一个名为testing的数据库。

Service worker权限

运行此查询:

gcloud projects get-iam-policy $PROJECTNUM

我得到这个确认，构建帐户可以访问秘密和云SQL服务:

bindings:
- members:
- serviceAccount:[e-mail]
role: roles/cloudbuild.builds.builder
- members:
- serviceAccount:[e-mail]
role: roles/cloudbuild.serviceAgent
- members:
- serviceAccount:[e-mail]
role: roles/cloudsql.client
- members:
- serviceAccount:[e-mail]
- serviceAccount:[e-mail]
role: roles/secretmanager.secretAccessor

网络访问

在我的cd脚本中，我成功地使用gcr在同一个数据库实例上运行迁移。Io/google-appengine/exec-wrapper和类似的连接变量。因为我不想为每个拉请求添加构建工件，所以我在这里不是在容器内构建，推送和运行，而是试图通过代理隧道连接。

谁能发现一个问题或有关于如何进一步调试的建议?

谢谢!

Answer 1

所以!终于把CI管道修好了。这个错误与PG_HOST值有关。当我在本地运行云代理时，它报告:

监听/path/to/project/w121-cms:europe-west1:w121/. s.p gsql。5432 for w121-cms:europe-west:w121

但是在管道中运行它是:

Listening on 127.0.0.1:5432 for w121-cms:europe-west1:w121

有效的配置步骤是:

- id: proxy-install
name: 'gcr.io/cloud-builders/npm'
entrypoint: sh
args:
- -c
- |
wget -O /workspace/cloud_sql_proxy https://dl.google.com/cloudsql/cloud_sql_proxy.linux.386
chmod +x /workspace/cloud_sql_proxy
- id: tests
name: 'gcr.io/cloud-builders/npm'
timeout: 100s
entrypoint: sh
args:
- -c
- |
/workspace/cloud_sql_proxy -dir=/workspace -instances=w121-cms:europe-west1:w121=tcp:5432 & sleep 2
npm run ci:test
env:
- 'NODE_ENV=test'
- 'DB_CONNECTION=pg'
- 'PG_HOST=127.0.0.1'
- 'PG_PORT=5432'
- 'PG_USER=postgres'
- 'PG_DB_NAME=testing'
secretEnv: ['PG_PASSWORD', 'APP_KEY']