cannot fetch token: Post https://accounts.google.com/o/oauth2/token: x509: failed to load system roots and no roots provided about cloud-sql-proxy

[Carrotman42]

Please try the 1.09 release, it should include those certificates in the docker container.

[norbert-yoimo]

That fixed it, thank you.

[duzy]

Hi, I'm using the proxy lib (instead of cloud_sql_proxy) in my Go program. But I'm having exactly the same issue as this. All my guess is the cert files are missing, but not sure what to do for a fix!

2017-04-11T11:04:38.746339777Z 2017/04/11 11:04:38.746134 create table contributor: error: Post https://www.googleapis.com/sql/v1beta4/projects/xxxx/instances/yyyy/createEphemeral?alt=json: x509: failed to load system roots and no roots provided

[Carrotman42]

Are you creating your own docker container? If so, you have to include certificates for yourself. Look at the Dockerfile in this repo for the base container image we use.

[duzy]

Yes indeed, I'm doing so. Thanks, I'm trying to add the certs manually.

[jerairrest]

Hello, I'm using 1.09 and trying to connect through a socket across containers on GCE and am receiving this error. I've tried using a msql client as well as receive the same message on stdout of my cloudsql container. Any thoughts on how to debug this?

[Carrotman42]

Are you building your own container? If so, please follow the advise in a previous post of mine on this issue. If not, please provide a little more information about your setup (OS, other containers, etc). If you're using the precompiled docker image for 1.09 the certificates should already be available and automatically be detected.

[jerairrest]

I'm using the pre-compiled docker container gcr.io/cloudsql-docker/gce-proxy:1.06 and connecting to it through a Kubernetes deployment using a stock alpine:3.5 image as well I've tried debian:jessie

my deployment is as follows: (I took some env information out but this is similar)

{
  "apiVersion": "extensions/v1beta1",
  "kind": "Deployment",
  "metadata": {
    "name": "test-go",
    "namespace": "test",
    "labels": {
      "name": "test-go"
    }
  },
  "spec": {
    "replicas": 1,
    "revisionHistoryLimit": 3,
    "template": {
      "metadata": {
        "labels": {
          "name": "test-go"
        }
      },
      "spec": {
        "containers": [
          {
            "name": "test-go",
            "image": "alpine:3.5",
            "volumeMounts": [
              {
                "name": "cloudsql",
                "mountPath": "/cloudsql"
              }
            ],
            "command": ["ping", "localhost"]
            "imagePullPolicy": "Always",
            "resources": {
              "limits": {
                "cpu": "250m",
                "memory": "500Mi"
              }
            }
          },
            {
            "name": "cloud-sql-proxy",
            "image": "gcr.io/cloudsql-docker/gce-proxy:1.06",
            "volumeMounts": [
              {
                "name": "cloudsql",
                "mountPath": "/cloudsql"
              },
              {
                "name": "cloudsql-oauth-credentials",
                "mountPath": "/secrets/cloudsql",
                "readOnly": true
              }
            ],
            "command": ["/cloud_sql_proxy", "-dir=/cloudsql", "-credential_file=/secrets/cloudsql/cloud-sql-proxy-service-account.json", "-instances=MYCLOUDSQLINSTANCE"],
            "imagePullPolicy": "Always",
            "resources": {
              "limits": {
                "cpu": "250m",
                "memory": "500Mi"
              }
            }
          }
        ],
        "volumes": [
          {
            "name": "cloudsql-oauth-credentials",
            "secret": {
              "secretName": "cloudsql-oauth-credentials"
            }
          },
          {
            "name": "cloudsql",
            "emptyDir": {}
          }
        ]
      }
    }
  }
}

[jerairrest]

wwwwoooowww..... 6 < 9. I'm sorry! Ignore me :)