<p>I'm attempting to connect to a CloudSQL instance via a cloudsql-proxy container on my Kubernetes deployment. I have the cloudsql credentials mounted and the value of <code>GOOGLE_APPLICATION_CREDENTIALS</code> set. </p>

<p>However, I'm still receiving the following error in my logs:</p>

<pre><code>2018/10/08 20:07:28 Failed to connect to database: Post https://www.googleapis.com/sql/v1beta4/projects/[projectID]/instances/[appName]/createEphemeral?alt=json&amp;prettyPrint=false: oauth2: cannot fetch token: Post https://oauth2.googleapis.com/token: x509: certificate signed by unknown authority
</code></pre>

<p>My connection string looks like this: </p>

<pre><code>[dbUser]:[dbPassword]@cloudsql([instanceName])/[dbName]]?charset=utf8&amp;parseTime=True&amp;loc=Local
</code></pre>

<p>And the proxy dialer is shadow-imported as:</p>

<pre><code>_ github.com/GoogleCloudPlatform/cloudsql-proxy/proxy/dialers/mysql
</code></pre>

<p>Anyone have an idea what might be missing?</p>

<p><strong>EDIT:</strong></p>

<p>Deployment Spec looks something like this (JSON formatted):</p>

<pre><code>{
  "replicas": 1,
  "selector": {
    ...
  },
  "template": {
    ...
    "spec": {
      "containers": [
        {
          "image": "[app-docker-imager]",
          "name": "...",
          "env": [
            ...
            {
              "name": "MYSQL_PASSWORD",
              ...
            },
            {
              "name": "MYSQL_USER",
              ...
            },
            {
              "name": "GOOGLE_APPLICATION_CREDENTIALS",
              "value": "..."
            }
          ],

          "ports": [
            {
              "containerPort": 8080,
              "protocol": "TCP"
            }
          ],
          "volumeMounts": [
            {
              "mountPath": "/secrets/cloudsql",
              "name": "[secrets-mount-name]",
              "readOnly": true
            }
          ]
        },
        {
          "command": [
            "/cloud_sql_proxy",
            "-instances=...",
            "-credential_file=..."
          ],
          "image": "gcr.io/cloudsql-docker/gce-proxy:1.11",
          "name": "...",
          "ports": [
            {
              "containerPort": 3306,
              "protocol": "TCP"
            }
          ],
          "volumeMounts": [
            {
              "mountPath": "/secrets/cloudsql",
              "name": "[secrets-mount-name]",
              "readOnly": true
            }
          ]
        }
      ],
      "volumes": [
        {
          "name": "[secrets-mount-name]",
          "secret": {
            "defaultMode": 420,
            "secretName": "[secrets-mount-name]"
          }
        }
      ]
    }
  }
}
</code></pre>

<p>The error message indicates that your client is not able to trust the certificate of <a href="https://www.googleapis.com" rel="noreferrer">https://www.googleapis.com</a>. There are two possible causes for this:</p>

<ol>
<li><p>Your client does not know what root certificates to trust. The official <a href="https://cloud.google.com/sql/docs/mysql/connect-docker" rel="noreferrer">cloudsql-proxy docker image</a> includes root certificates, so if you are using that image, this is not your problem. If you are not using that image, you should (or at least install ca certificates in your image).</p></li>
<li><p>Your outbound traffic is being intercepted by a proxy server that is using a different, untrusted, certificate. This might be malicious (in which case you need to investigate who is intercepting your traffic). More benignly, you might be in a organization using an outbound proxy to inspect traffic according to policy. If this is the case, you should build a new docker image that includes the CA certificate used by your organization's outbound proxy.</p></li>
</ol>
