无法使用cloud_sql_proxy从容器连接到云 SQL

Question

因此，由于某种原因，我无法通过cloud_sql_proxy连接到SQL实例。

---

我尝试在wordpress容器上做一个telnet 127.0.0.1 3306(通过kubectl exec ...(：

bash-4.3# telnet 127.0.0.1 3306
Connection closed by foreign host

即使我kubectl exec..cloudsql-proxy容器中，我也会遇到与上述相同的行为。

但是，在本地执行此操作可以正常工作。

---

如何诊断此问题，原因可能是什么？

---

这是我的容器配置(在部署中(：

containers:
- image: eu.gcr.io/abcxyz/wordpress:initial
name: wordpress
imagePullPolicy: "Always"
env:
- name: WORDPRESS_HOST
value: localhost
- name: WORDPRESS_DB_USERNAME
valueFrom:
secretKeyRef:
name: cloudsql-db-credentials
key: username
volumeMounts:
- name: wordpress-persistent-storage
mountPath: /var/www/html
- image: eu.gcr.io/abcxyz/nginx:initial
name: nginx
imagePullPolicy: "Always"
ports:
- containerPort: 80
name: nginx
volumeMounts:
- name: wordpress-persistent-storage
mountPath: /var/www/html
- image: gcr.io/cloudsql-docker/gce-proxy:1.09
name: cloudsql-proxy
command: ["/cloud_sql_proxy", "--dir=/cloudsql",
"-instances=abcxyz:europe-west1:wordpressdb=tcp:3306",
"-credential_file=/secrets/cloudsql/credentials.json"]
volumeMounts:
- name: cloudsql-instance-credentials
mountPath: /secrets/cloudsql
readOnly: true
- name: ssl-certs
mountPath: /etc/ssl/certs
- name: cloudsql
mountPath: /cloudsql

---

如果从cloudsql-proxy获取日志，我会看到以下内容：

2017/08/11 12:55:03 New connection for "abcxyz:europe-west1:wordpressdb"
2017/08/11 12:55:03 couldn't connect to "abcxyz:europe-west1:wordpressdb": ensure that the account has access to "abcxyz:europe-west1:wordpressdb" (and make sure there's no typo in that name). Error during createEphemeral for abcxyz:europe-west1:wordpressdb: googleapi: Error 403: The client is not authorized to make this request., notAuthorized

有问题的服务帐户确实具有Cloud SQL Admin权限。

Answer 1

我需要将Cloud SQL Client权限添加到服务帐户。

更新：我再次遇到此问题，由于某种原因，服务帐户会继续遇到上述错误。我必须创建另一个有效的服务帐户...