arno-fukuda commented on code in PR #73646:
URL: https://github.com/apache/airflow/pull/73646#discussion_r4476609904
##########
providers/google/docs/connections/gcp_sql.rst:
##########
@@ -78,6 +78,32 @@ Extra (optional)
export
AIRFLOW_CONN_GOOGLE_CLOUD_SQL_DEFAULT='gcpcloudsql://user:[email protected]:3306/mydb?database_type=mysql&project_id=example-project&location=europe-west1&instance=testinstance&use_proxy=True&sql_proxy_use_tcp=False'
+Using Cloud SQL Auth Proxy v2
+-----------------------------
+
+By default Airflow runs Cloud SQL Auth Proxy v1. To run Cloud SQL Auth Proxy
v2 instead, set
Review Comment:
Added in 7913c42584. The v2 section now says that Cloud SQL for MySQL 8.4
users authenticating with `caching_sha2_password` need v2, and that otherwise
connections fail with `1045 Access denied` after the authentication cache is
emptied, for example by a restart.
---
Drafted-by: Claude Code (Opus 5.5); reviewed by @arno-fukuda before posting
##########
providers/google/docs/connections/gcp_sql.rst:
##########
@@ -78,6 +78,32 @@ Extra (optional)
export
AIRFLOW_CONN_GOOGLE_CLOUD_SQL_DEFAULT='gcpcloudsql://user:[email protected]:3306/mydb?database_type=mysql&project_id=example-project&location=europe-west1&instance=testinstance&use_proxy=True&sql_proxy_use_tcp=False'
+Using Cloud SQL Auth Proxy v2
+-----------------------------
+
+By default Airflow runs Cloud SQL Auth Proxy v1. To run Cloud SQL Auth Proxy
v2 instead, set
+``"sql_proxy_major_version": 2`` in the ``extra`` field. ``sql_proxy_version``
must also be set to the v2
+release to download, as there is no "latest" download for v2, unless the
``sql_proxy_binary_path`` argument
Review Comment:
Confirmed against the proxy sources: `--auto-ip` isn't defined in
`cmd/root.go` for v2.0.0 to v2.1.2 and first appears in v2.2.0. The other flags
the runner uses (`--unix-socket`, `--auto-iam-authn`, `?port=`) exist from
v2.0.0, so `--auto-ip` sets the minimum. The docs now say both
`sql_proxy_version` and a binary from `sql_proxy_binary_path` must be v2.2.0 or
newer, and explain why older v2 releases exit at startup. I left the version
regex as it is, because a check there would only cover downloads and not
`sql_proxy_binary_path`.
---
Drafted-by: Claude Code (Opus 5.5); reviewed by @arno-fukuda before posting
##########
providers/google/docs/connections/gcp_sql.rst:
##########
@@ -78,6 +78,32 @@ Extra (optional)
export
AIRFLOW_CONN_GOOGLE_CLOUD_SQL_DEFAULT='gcpcloudsql://user:[email protected]:3306/mydb?database_type=mysql&project_id=example-project&location=europe-west1&instance=testinstance&use_proxy=True&sql_proxy_use_tcp=False'
+Using Cloud SQL Auth Proxy v2
+-----------------------------
+
+By default Airflow runs Cloud SQL Auth Proxy v1. To run Cloud SQL Auth Proxy
v2 instead, set
+``"sql_proxy_major_version": 2`` in the ``extra`` field. ``sql_proxy_version``
must also be set to the v2
+release to download, as there is no "latest" download for v2, unless the
``sql_proxy_binary_path`` argument
+of the hook or operator points to an existing v2 binary.
+
+Cloud SQL Auth Proxy v2 connects only to the instance's public IP by default,
while v1 falls back to the
+private IP when the instance has no public IP. Airflow passes ``--auto-ip`` to
v2 to keep the v1 behavior,
+so instances with only a private IP work with both versions.
Review Comment:
Both points check out in the sources, so both are now documented.
- Credentials: one detail to add to your summary. v1.37.0's
`authenticatedClient` tries `GOOGLE_APPLICATION_CREDENTIALS` first, then
gcloud, then the rest of ADC, while v2's default branch logs "Authorizing with
Application Default Credentials" and uses ADC only. Passing `--gcloud-auth`
wouldn't help with IAM login, since v2 rejects it together with
`--auto-iam-authn`, so a docs note seemed like the right fix. I also reworded
the "Falling back to default activated account" log line so it's accurate for
both versions.
- Quota project: documented that v2 bills its Cloud SQL Admin API calls to
the credentials' quota project, and that an unrelated one causes `403
SERVICE_DISABLED`.
---
Drafted-by: Claude Code (Opus 5.5); reviewed by @arno-fukuda before posting
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
