<p>I'm trying to setup a Cloud SQL Proxy Docker image for PostgreSQL as mentioned <a href="https://cloud.google.com/sql/docs/postgres/connect-kubernetes-engine#proxy" rel="nofollow noreferrer">here</a>.
I can get my app to connect to the proxy docker image but the proxy times out. I suspect it's my credentials or the port, so how do I debug and find out if it works?
This is what I have on my project</p>

<pre><code>kubectl create secret generic cloudsql-instance-credentials --from-file=credentials.json=my-account-credentials.json
</code></pre>

<p>My deploy spec snippet:</p>

<pre><code>spec:
      containers:
        - name: mara ...
        - name: cloudsql-proxy
          image: gcr.io/cloudsql-docker/gce-proxy:1.11
          command: ["/cloud_sql_proxy",
                    "-instances=&lt;MY INSTANCE NAME&gt;=tcp:5432",
                    "-credential_file=/secrets/cloudsql/credentials.json"]
          volumeMounts:
            - name: cloudsql-instance-credentials
              mountPath: /secrets/cloudsql
              readOnly: true
      volumes:
        - name: cloudsql-instance-credentials
          secret:
            secretName: cloudsql-instance-credentials
</code></pre>

<p>The logs of my cloudsql-proxy show a timeout:</p>

<pre><code>2019/05/13 15:08:25 using credential file for authentication; email=646092572393-compute@developer.gserviceaccount.com
2019/05/13 15:08:25 Listening on 127.0.0.1:5432 for &lt;MY INSTANCE NAME&gt;
2019/05/13 15:08:25 Ready for new connections
2019/05/13 15:10:48 New connection for "&lt;MY INSTANCE NAME&gt;"
2019/05/13 15:10:58 couldn't connect to &lt;MY INSTANCE NAME&gt;: dial tcp &lt;MY PRIVATE IP&gt;:3307: getsockopt: connection timed out
</code></pre>

<p>Questions:</p>

<ul>
<li><p>I specify 5432 as my port, but as you can see in the logs above,it's hitting 3307. Is that normal and if not, how do I specify 5432?</p></li>
<li><p>How do I check if it is a problem with my credentials? My credentials file is from my service account <code>123-compute@developer.gserviceaccount.com</code>
and the service account shown when I go to my cloud sql console is <code>p123-&lt;somenumber&gt;@gcp-sa-cloud-sql.iam.gserviceaccount.com</code>. They don't seem the same? Does that make a difference?</p></li>
</ul>

<p>If I make the Cloud SQL instance available on a public IP, it works.</p>

<blockquote>
  <p>I specify 5432 as my port, but as you can see in the logs above,it's
  hitting 3307</p>
</blockquote>

<p>The proxy listens locally on the port you specified (in this case <code>5432</code>), and connects to your Cloud SQL instance via port 3307. This is expected and normal.</p>

<blockquote>
  <p>How do I check if it is a problem with my credentials?</p>
</blockquote>

<p>The proxy returns an authorization error if the Cloud SQL instance doesn't exist, or if the service account doesn't have access. The connection timeout error means it failed to reach the Cloud SQL instance. </p>

<blockquote>
  <p>My credentials file is from my service account 123-compute@developer.gserviceaccount.com and the service account shown when I go to my cloud sql console is p123-@gcp-sa-cloud-sql.iam.gserviceaccount.com. They don't seem the same?</p>
</blockquote>

<p>One is just the name of the file, the other is the name of the service account itself. The name of the file doesn't have to match the name of the service account. You can check the name and IAM roles of a service account on the Service Account <a href="https://console.cloud.google.com/iam-admin/serviceaccounts?_ga=2.78504593.-442290695.1543247497" rel="nofollow noreferrer">page</a>. </p>

<blockquote>
  <p>2019/05/13 15:10:58 couldn't connect to : dial tcp :3307: getsockopt: connection timed out</p>
</blockquote>

<p>This error means that the proxy failed to establish a network connection to the instance (usually because a path from the current location doesn't exist). There are two common causes for this:</p>

<p>First, make sure there isn't a firewall or something blocking outbound connections on port 3307.</p>

<p>Second, since you are using Private IP, you need to make sure the resource you are running the proxy on meets the <a href="https://cloud.google.com/sql/docs/mysql/private-ip#network_requirements" rel="nofollow noreferrer">networking requirements</a>.</p>
