google-cloud-sql - 在公司防火墙后面使用 cloud_sql_proxy - 无法连接到 mysql 实例

Question

当我将 http_proxy 和 https_proxy 变量设置为正确的值时，我已经能够在公司防火墙后面使用 google cloud sdk。服务帐户的初始 Oauth 连接看起来也适用于这些代理变量集。但是，当我尝试使用 mysql 客户端连接到运行代理的机器时，与 google mysql 实例的连接失败。

这是我的代理命令，顺便说一句(已验证代理 cmd/setup 在不在公司防火墙后面的系统上工作):

cloud_sql_proxy -instances=api-project-1054727403053:us-east1:mysql-google-v1=tcp:3306 -credential_file=c:\tools\myeditor.json

2017/09/14 09:39:29 using credential file for authentication; email=myeditor@api
-project-1054727403053.iam.gserviceaccount.com
2017/09/14 09:39:29 Listening on 127.0.0.1:3306 for api-project-1054727403053:us
-east1:mysql-google-v1
2017/09/14 09:39:29 Ready for new connections
2017/09/14 09:39:34 New connection for "api-project-1054727403053:us-east1:mysql
-google-v1"
2017/09/14 09:39:57 couldn't connect to "api-project-1054727403053:us-east1:mysq
l-google-v1": dial tcp 35.190.176.161:3307: connectex: A connection attempt fail
ed because the connected party did not properly respond after a period of time,
or established connection failed because connected host has failed to respond.
2017/09/14 09:39:58 New connection for "api-project-1054727403053:us-east1:mysql
-google-v1"
2017/09/14 09:40:19 Throttling refreshCfg(api-project-1054727403053:us-east1:mys
ql-google-v1): it was only called 43.386s ago
2017/09/14 09:40:40 couldn't connect to "api-project-1054727403053:us-east1:mysq
l-google-v1": dial tcp 35.190.176.161:3307: connectex: A connection attempt fail
ed because the connected party did not properly respond after a period of time,
or established connection failed because connected host has failed to respond.
2017/09/14 09:40:41 New connection for "api-project-1054727403053:us-east1:mysql
-google-v1"
2017/09/14 09:41:23 couldn't connect to "api-project-1054727403053:us-east1:mysq
l-google-v1": dial tcp 35.190.176.161:3307: connectex: A connection attempt fail
ed because the connected party did not properly respond after a period of time,
or established connection failed because connected host has failed to respond.

错误看起来像...调用 tcp 35.190.176.161:3307: connectex: 连接尝试失败ed是因为连接方在一段时间后没有正常响应

同样，我已经验证了上述代理设置可以在不在公司防火墙后面的系统上运行，所以我想知道是否可以配置云代理以使用 http_proxy/https_proxy 建立连接和通信？

谢谢

Answer 1

MySQL 有自己的协议(protocol)，它完全独立于 HTTP，通常在端口 3306 上。虽然 Cloud SQL 代理使用 HTTP 进行初始身份验证设置，但实际的 SQL 连接在端口 3307 上将此协议(protocol)包装在 TLS 中。不幸的是，没有办法通过 HTTP 代理运行 MySQL 协议(protocol)。相反，您需要公司防火墙的异常(exception)。

如果您只需要在命令行上访问 Cloud SQL，我建议从 Cloud Shell 执行此操作，如 https://cloud.google.com/sql/docs/mysql/connect-admin-ip#cloud-shell 中所述.

如果您想构建一个从防火墙后面访问 Cloud SQL 的更复杂的应用程序，您可以构建一个公开 HTTP API 的 GAE 应用程序。然后，您可以通过代理使用该 API，并且 GAE 应用可以连接到 Cloud SQL。