Can't start cloud_sql_proxy

GoogleCloudPlatform / appengine-ruby

Optional integration library for the Ruby runtime for Google App Engine

Apache License 2.0

53 stars 21 forks source link

Can't start cloud_sql_proxy #4

Closed calebwoods closed 7 years ago

calebwoods commented 7 years ago

I've been trying to use this project run database migrations on an app running in the Google App Engine Ruby environment.

When I run bundle exec rake appengine:exec -- bundle exec rake db:migrate, it downloads some images and then runs into this error:

---------- CONNECT CLOUDSQL ----------
ERROR: Failed to start cloud_sql_proxy
2017/08/23 18:09:11 errors parsing config:
    googleapi: Error 403: The client is not authorized to make this request., notAuthorized
ERROR
ERROR: build step "gcr.io/google-appengine/exec-wrapper" failed: exit status 1

I'm not sure how I can debug this is it is a permission issue on my end. I also tried building the cloudbuild.json file manually to test different cases. If I remove the arg -s which seems to corrispond to Cloud SQL, then it procceds, but it then fails as it can't connect the DB.

If there are other things I can try to debug I'm all ears.

dazuma commented 7 years ago

Hi Caleb,

Check the permissions for the cloudbuild service account on your project. Your script runs as that service account, and that account needs sufficient permissions to call the CloudSQL APIs. To add those permissions:

Open the Google Cloud Console (console.cloud.google.com), log in if necessary and select your project.
Navigate to the "IAM & Admin" section in the left-side menu.
You should now be on a page titled "Permissions for project (your project name)". Look for the service account with email "(some number)@cloudbuild.gserviceaccount.com". Under "Roles" It should say "Cloud Container Builder". Pull down that menu and add "Project->Editor".

I realize this isn't documented emphatically enough. I'll try to update the README and other documentation to make this more clear.

Let me know if that doesn't solve it, and we can dig deeper.

Daniel

dazuma commented 7 years ago

@calebwoods Did the above IAM fix solve your issue?

calebwoods commented 7 years ago

@dazuma I ended up solving my problem without using the appengine gem, but I went back and tested and with the IAM change it did seem to get me past that error. Would be great to have that in the README for reference. You can close this issue.

dazuma commented 7 years ago

Added more detail to the README. Closing.

speasley commented 6 years ago

A year after this original post and I'm having the same problem. The proposed solution did not help.