Google cloud sql using wrong ssl cert to to establish socket connection from kubernetes about cloud-sql-proxy

[4dex]

In case anyone else encounters this issue again, I came across it when using an older version of the cloud_sql_proxy image. Had to update the image before the proxy would connect to my cloud sql instances.

Updated from image: gcr.io/cloudsql-docker/gce-proxy:1.11 to image: gcr.io/cloudsql-docker/gce-proxy:1.33.2 and the x509: certificate is valid for project-name:name-db, not project-name:name-db-whatever issue went away.

[Carrotman42]

Interesting, I'm wondering whether something is messed up on the backend. Can you email your project name and instances to [email protected] and I can help debug the issue from there?

Some debugging we can do in public, though: how are your staging/production databases set up? Is one created from a backup of another or something?

[Jakedavies]

The staging/production databases are essentially the exact same, and there is a nightly cron that takes the backup from the production and restores it to the staging database.

[Carrotman42]

To follow up, the workaround here was to reset the SSL configuration of the instance. I'm currently investigating the root cause of the issue.

[roberthbailey]

@Carrotman42 — Let me know if you need any help debugging from the GKE-side of things.

[Carrotman42]

Thanks for the offer, but it turned out to be a strictly Cloud SQL-related problem. I submitted a fix this morning and it should be in production within a week or so. There may still be bugs related to this one which are yet undiscovered, but until then the workaround of resetting SSL configuration should work for this class of bug.

I will close this bug when the fix finishes rolling out.

[Carrotman42]

The fix should be rolled out. Please reopen if you're still encountering the problem.

[retnuh]

Hi there, after creating a new instance and restoring from a backup of a different instance, we encountered the same issue. Doing a reset of the SSL configuration cleared the problem.