google-app-engine - 在本地使用 cloud_sql_proxy 获取 notAuthorized 错误

Question

我正在尝试为第二代云 sql 实例在本地设置连接。

调用代理是

./cloud_sql_proxy -dir=/cloudsql -instances=status-1268:us-central1:status-dev=tcp:3306 & mysql -u status_stg --host 127.0.0.1

我不太清楚如何从 API 部分正确设置服务帐户，所以我尝试了两种默认设置，App 引擎默认服务帐户和计算引擎默认服务帐户。我还创建了一个新的服务帐户。对于他们中的每一个，我都从管理权限部分将服务帐户 ID 分配为编辑者和所有者。也许还有另一种方法可以为这些帐户启用 Cloud SQL Admin API？

当我的服务试图与 DB 对话时代理的输出:

./cloud_sql_proxy -dir=/cloudsql -instances=status-1268:us-central1:status-   dev=tcp:3306 & mysql -u status_stg --host 127.0.0.1
ERROR 2003 (HY000): Can't connect to MySQL server on '127.0.0.1' (61)
2016/04/04 11:26:58 Open socket for "status-1268:us-central1:status-dev" at     "127.0.0.1:3306"
2016/04/04 11:26:58 Socket prefix: /cloudsql
2016/04/04 11:27:10 Got a connection for "status-1268:us-central1:status-dev"
2016/04/04 11:27:11 couldn't connect to "status-1268:us-central1:status-dev": googleapi: Error 403: The client is not authorized to make this request., notAuthorized
2016/04/04 11:29:08 Got a connection for "status-1268:us-central1:status-dev"
2016/04/04 11:29:08 couldn't connect to "status-1268:us-central1:status-dev": googleapi: Error 403: The client is not authorized to make this request., notAuthorized

关于寻找什么的想法？我想我在这里配置服务帐户时遗漏了一些基本的东西。

(总的来说，对于我的项目，我正在运行一个 node.js express 应用程序，并希望将它连接到第二代云 sql 数据库实例，而不必像我目前正在工作的那样使用 0.0.0.0 公开它)

谢谢

Answer 1

TL;DR:如果您的错误日志包含Error during createEphemeral..，请继续阅读。

对我有用的解决方案来自 Github Cloud-SQL-Proxy Issue Tracker .

It seems that you may have encountered a bug in backend that is triggered when there is an old service account with the same name. Follow the steps below to solve your issue:

1. Go to the Cloud Project IAM page (Left Menu > IAM & Admin > IAM)
2. Look for the row with the robot account that is having the issue.
3. It should say "Cloud SQL Client" on the role column.
4. Click on it to open the dropdown
5. Click on the 'Cloud SQL Client' role that is checked to uncheck it.
6. Click the blue save button above.
7. Verify that the service account is removed from the IAM page.
8. Click the Add button above in the same page.
9. Enter the service account email address and select the Cloud SQL Client role
10. Click Add
11. The service account should appear again in the the list.

归功于 Chees ，但积分是我的:P。希望它能解决您的问题。