The reporter resolved this by switching the Cloud SQL instance to a private IP and running the proxy with the --private-ip flag (they also switched GKE to Cloud DNS at the same time, so they could not isolate which change fixed it). The working theory is that the v2 proxy's dials were going through …
The proxy intentionally dials the Cloud SQL instance on port 3307 (local clients still use 3306; 3307 isolates proxy traffic on the instance side), so your firewall/VPC must allow egress from the proxy host to the instance IP on port 3307. Per the maintainer's closing summary, this error always mean…
This is a known IAM propagation quirk, not a proxy bug: re-grant the role to force it to take effect. Remove the Cloud SQL Client role from the failing service account in IAM & Admin > IAM (uncheck it and Save), verify the account disappears from the list, then Add it back with the Cloud SQL Client …
The reporter resolved this by switching the Cloud SQL instance to a private IP and running the proxy with the --private-ip flag (they also switched GKE to Cloud DNS at the same time, so they could not isolate which change fixed it). The working theory is that the v2 proxy's dials were going through …
The proxy intentionally dials the Cloud SQL instance on port 3307 (local clients still use 3306; 3307 isolates proxy traffic on the instance side), so your firewall/VPC must allow egress from the proxy host to the instance IP on port 3307. Per the maintainer's closing summary, this error always mean…
This is a known IAM propagation quirk, not a proxy bug: re-grant the role to force it to take effect. Remove the Cloud SQL Client role from the failing service account in IAM & Admin > IAM (uncheck it and Save), verify the account disappears from the list, then Add it back with the Cloud SQL Client …