Ubuntu Manpage: cloud_sql_proxy - connect securely to a 2nd generation cloud sql database

Provided by: cloudsql-proxy_1.17.0-5ubuntu0.22.04.3_amd64

NAME

       cloud_sql_proxy - connect securely to a 2nd generation cloud sql database

SYNOPSIS

       cloud_sql_proxy

DESCRIPTION

The Cloud SQL Proxy allows simple, secure connectivity to Google Cloud SQL. It is a long-
running process that opens local sockets (either TCP or Unix sockets) according to the
parameters passed to it. A local application connects to a Cloud SQL instance by using the
corresponding socket.

Authorization
By default, the proxy will authenticate under the default service account of the Compute
Engine VM it is running on. Therefore, the VM must have at least the sqlservice.admin API
scope ⟨https://www.googleapis.com/auth/sqlservice.admin⟩ and the associated project must
have the SQL Admin API enabled. The default service account must also have at least
WRITER/EDITOR privileges to any projects of target SQL instances.

• On Google Compute Engine, the default service account is used. The Cloud SQL API must
be enabled for the VM.

• When the gcloud command-line tool is installed on the local machine, the active
account is used for authentication. Run 'gcloud auth list' to see which accounts are
installed on your local machine and 'gcloud config list account' to view the active
account.

• To configure the proxy using a service account, pass the -credential_file parameter or
set the GOOGLE_APPLICATION_CREDENTIALS environment variable. This will override
gcloud or GCE (Google Compute Engine) credentials, if they exist.

OPTIONS

General
-quiet Disable log messages (e.g. when new connections are established). WARNING: this
option disables ALL logging output (including connection errors), which will likely
make debugging difficult. The -quiet flag takes precedence over the -verbose flag.

-verbose
When explicitly set to false, disable log messages that are not errors nor first-
time startup messages (e.g. when new connections are established
or closed without errors).

-version
Print the version of the proxy and exit

Connection
-credential_file
If provided, this json file will be used to retrieve Service Account credentials.
You may set the GOOGLE_APPLICATION_CREDENTIALS environment variable for the same
effect.

-token When set, the proxy uses this Bearer token for authorization

-max_connections
If provided, the maximum number of connections to establish before refusing new
connections. Defaults to 0 (no limit)

-instances
To connect to a specific list of instances, set the instances parameter to a comma-
separated list of ully qualified instance connection strings (project:region:name).
For example:
-instances=my-project:my-region:my-instance

For connectivity over TCP, you must specify a tcp port as part of the instance
string. For example, the following example opens a loopback TCP socket on port
3306, which will be proxied to connect to the instance 'my-instance' in project
'my-project':
-instances=my-project:my-region:my-instance=tcp:3306

When connecting over TCP, the -instances parameter is required.

Supplying INSTANCES environment variable achieves the same effect. One can use
that to keep k8s manifest files constant across multiple environments. If the name
has the suffix '=tcp:port', a TCP server is opened on the specified port to proxy
to that instance. Otherwise, one socket file per instance is opened in dir. You
may use INSTANCES environment variable for the same effect. Using both will use
value from flag. Not compatible with -fuse

-instances_metadata
When running on GCE (Google Compute Engine) you can avoid the need to specify the
list of instances on the command line by using the Metadata server. This parameter
specifies a path to a metadata value which is then polled for a comma-separated
list of fully qualified instances (project:region:name) to connect to in the
exactly the same way as the -instances parameter. Updates to the metadata value
will be observed and acted on by the Proxy. For example, to use the instance
metadata value named cloud-sql-instances you would provide
instance/attributes/cloud-sql-instances.

-check_region
If specified, the region portion of the connection string is required for Unix
socket-based connections.

-projects
To direct the proxy to open connections for each Cloud SQL Instance in the comma-
separated list of projects specified, set the projects parameter:
-projects=my-project

-refresh_config_throttle
If set, this flag specifies the amount of forced sleep between successive API calls
in order to protect client API quota. Minimum allowed value is 1s

-dir When using Unix sockets (the default for systems which support them), the Proxy
places the sockets representing database instances in the directory specified by
the -dir parameter.

-fuse If your local environment has FUSE installed, you can specify the -fuse flag to
avoid the requirement to specify instances in advance. Mount a directory at dir
using FUSE for accessing instances. Note that the directory at dir must be empty
before this program is started. With FUSE, any attempts to open a Unix socket in
the directory specified by -dir automatically creates that socket and connects to
the corresponding instance.

-fuse_tmp
Used as a temporary directory if -fuse is set. Note that files in this directory
can be removed automatically by this program.

Automatic instance discovery
If the Google Cloud SQL is installed on the local machine and no instance connection flags
are specified, the proxy connects to all instances in the gcloud tool's active project.
Run 'gcloud config list project' to display the active project.

FILES

       Credentials
              By default user account credentials are acquired by gcloud auth  login  and  stored
              locally  on  the  system.   gcloud  auth activate-service-account authorizes access
              using a service account. As with gcloud init and gcloud auth  login,  this  command
              saves  the service account credentials to the local system on successful completion
              and  sets  the  specified  account  as  the  active  account  in  your  Cloud   SDK
              configuration.    To  configure  the  proxy  using  a  service  account,  pass  the
              -credential_file parameter or set  the  GOOGLE_APPLICATION_CREDENTIALS  environment
              variable.  This will override gcloud or GCE (Google Compute Engine) credentials, if
              they exist.

       sockets directory
              When using Unix sockets (the default for systems which  support  them),  the  Proxy
              places  the sockets rep‐ resenting database instances in the directory specified by
              the -dir parameter. With FUSE one can also interact  with  the  proxy  using  thius
              directory to specify instances of cloud SQL databases to connect to on the fly.

       /dev/fuse
              Optional  functionality  can be enabled ( --fuse ) with access to /dev/fuse as well
              as the fusermount binary.

BUGS

       The       upstream       issue       reporting       system       is       at       github
       ⟨https://github.com/GoogleCloudPlatform/cloudsql-proxy/issues⟩

AUTHOR

       Manoj Srivastava <srivasta@google.com>