Cannot connect to DB through Cloud SQL proxy from Cloud Run instance

Question

I'm trying to run Django from Cloud Run, following this guide: https://cloud.google.com/python/django/run. So as far as I can tell I've configured everything correctly.

First off, I have verified that I can connect to my DB through Cloud Shell:

$ gcloud sql connect slsl-db-instance-04a74a9 --database slsl-db-4cfb495 --user=slsl_user --quiet                                                                                                   Allowlisting your IP for incoming connection for 5 minutes...done.     
Connecting to database with SQL user [slsl_user].
Password:
psql (15.1 (Debian 15.1-1.pgdg110+1), server 14.4)
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, compression: off)Type "help" for help.

slsl-db-4cfb495=>

I have also confirmed that I can connect using a Cloud SQL proxy running locally.

Next, I've confirmed that the env vars set for the Cloud Run instance match what I used there (the database, user, and password).

Additionally:

• I have created a service account that I've confirmed has the necessary role: roles/cloudsql.client.
• I have confirmed that the DB is indeed listening on port 5432.
• I have confirmed in the web UI that the Cloud Run service indeed has the Cloud SQL connection configured.
• The DB is using a public IP with no source IPs allowlisted, but it says the Cloud SQL proxy should still work.

However, when my service tries to connect, it fails:

connection to server at "127.0.0.1", port 5432 failed: Connection refused

I'm just trying to connect to 127.0.0.1:5432 like they do in the tutorial. I assume this is how it's meant to work, where the Cloud SQL proxy is accessible to my container at that host:port and then the proxy handles connecting to the DB.

I've tried following other suggestions here to no avail: https://cloud.google.com/sql/docs/debugging-connectivity.

To answer some other questions it asks:

• Is the instance connection name formed correctly in the Cloud SQL Auth proxy connection command?
  • Yes, as far as I can tell. I've selected it in the web UI dropdown just to be sure.
• Have you enabled the Cloud SQL Admin API for your project?
  • Yes.

The deployment is configured fully in Pulumi, so you can see what I'm doing here: https://github.com/banool/slsl_dictionary/tree/main/deployment, minus the secrets values of course.

Any further suggestions on what I'm missing here would be appreciated!

Answer 1

Okay turns out you can't connect via host + port from the Cloud Run environment, you have to either connect to the DB directly using a private IP or use the Unix socket exposed by the Cloud SQL proxy.

Read more here: Accessing Cloud SQL from Cloud Run on Google Cloud.