<p>I am following <a href="https://cloud.google.com/sql/docs/postgres/connect-kubernetes-engine" rel="nofollow noreferrer">these docs</a> on how to setup a sidecar proxy to my cloud-sql database. It refers to a <a href="https://github.com/GoogleCloudPlatform/kubernetes-engine-samples/blob/master/cloudsql/postgres_deployment.yaml" rel="nofollow noreferrer">manifest on github</a> that -as I find it all over the place on github repos etc- seems to work for 'everyone' but I run into trouble. The proxy container can not mount to /secrets/cloudsql it seems as it can not succesfully start. When I run <code>kubectl logs [mypod] cloudsql-proxy</code>:</p>

<pre><code>invalid json file "/secrets/cloudsql/mysecret.json": open /secrets/cloudsql/mysecret.json: no such file or directory
</code></pre>

<p>So the secret seems to be the problem. </p>

<p>Relevant part of the manifest:</p>

<pre><code>- name: cloudsql-proxy
  image: gcr.io/cloudsql-docker/gce-proxy:1.11
  command: ["/cloud_sql_proxy",
            "-instances=pqbq-224713:europe-west4:osm=tcp:5432",
            "-credential_file=/secrets/cloudsql/mysecret.json"]
  securityContext:
    runAsUser: 2
    allowPrivilegeEscalation: false
  volumeMounts:
    - name: cloudsql-instance-credentials
      mountPath: /secrets/cloudsql
      readOnly: true
volumes:
  - name: cloudsql-instance-credential
      secret:
        secretName: mysecret
</code></pre>

<p>To test/debug the secret I mount the volume to an another container that does start, but then the path and file /secrets/cloudsql/mysecret.json does not exist either. However when I mount the secret to an already EXISTING folder I can find in this folder not the mysecret.json file (as I expected...) but (in my case) two secrets it contains, so I find: <code>/existingfolder/password</code>  and <code>/existingfolder/username</code> (apparently this is how it works!? When I cat these secrets they give the proper strings, so they seem fine).  </p>

<p>So it looks like the path can not be made by the system, is this a permission issue? I tried simply mounting in the proxy container to the root ('/') so no folder, but that gives an error saying it is not allowed to do so. As the image <code>gcr.io/cloudsql-docker/gce-proxy:1.11</code> is from Google and I can not get it running I can not see what folder it has. </p>

<p>My questions:</p>

<ol>
<li>Is the mountPath created from the manifest or should it be already
in the container? </li>
<li>How can I get this working?</li>
</ol>

<p>I solved it. I was using the same secret on the cloudsql-proxy as the ones used on the app (env), but it needs to be a key you generate from a service account and then make a secret out of that. Then it works. <a href="https://shinesolutions.com/2018/10/25/deploying-a-full-stack-application-to-google-kubernetes-engine/" rel="nofollow noreferrer">This tutorial</a> helped me through.</p>
