shahar1 commented on code in PR #73646:
URL: https://github.com/apache/airflow/pull/73646#discussion_r4484712317
##########
providers/google/docs/connections/gcp_sql.rst:
##########
@@ -78,6 +78,48 @@ Extra (optional)
export
AIRFLOW_CONN_GOOGLE_CLOUD_SQL_DEFAULT='gcpcloudsql://user:[email protected]:3306/mydb?database_type=mysql&project_id=example-project&location=europe-west1&instance=testinstance&use_proxy=True&sql_proxy_use_tcp=False'
+Using Cloud SQL Auth Proxy v2
+-----------------------------
+
+By default Airflow runs Cloud SQL Auth Proxy v1. To run Cloud SQL Auth Proxy
v2 instead, set
+``"sql_proxy_major_version": 2`` in the ``extra`` field. ``sql_proxy_version``
must also be set to the v2
+release to download, as there is no "latest" download for v2, unless the
``sql_proxy_binary_path`` argument
+of the hook or operator points to an existing v2 binary. Both must be v2.2.0
or newer.
+
+Cloud SQL for MySQL 8.4 users authenticating with ``caching_sha2_password``
need v2. v1 cannot complete
Review Comment:
minor: "need v2" isn't quite enough here. `caching_sha2_password` support
for Unix socket clients first shipped in proxy
[v2.19.0](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/blob/main/CHANGELOG.md)
through
[cloud-sql-proxy#2489](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/pull/2489).
`WithMdxClientProtocolType` isn't in `internal/proxy/proxy.go` at v2.2.0,
v2.14.0 or v2.18.3. Before that,
[cloud-sql-proxy#2317](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/issues/2317)
reports the same `1045 Access denied` over a Unix socket, so a v2 release
older than v2.19.0, including the v2.14.0 in the example below, should still
hit #72681. Could you say these users need v2.19.0 or newer?
The proxy's README and [Google's connection
docs](https://docs.cloud.google.com/sql/docs/mysql/connect-auth-proxy) still
say Unix sockets with this plugin aren't supported, and the fix also depended
on a back-end rollout. Your reproduction shows it working, so naming the
version you tested would help readers.
---
Drafted-by: Claude Code (Opus 5.5); reviewed by `shahar1` before posting
##########
providers/google/docs/connections/gcp_sql.rst:
##########
@@ -78,6 +78,48 @@ Extra (optional)
export
AIRFLOW_CONN_GOOGLE_CLOUD_SQL_DEFAULT='gcpcloudsql://user:[email protected]:3306/mydb?database_type=mysql&project_id=example-project&location=europe-west1&instance=testinstance&use_proxy=True&sql_proxy_use_tcp=False'
+Using Cloud SQL Auth Proxy v2
+-----------------------------
+
+By default Airflow runs Cloud SQL Auth Proxy v1. To run Cloud SQL Auth Proxy
v2 instead, set
+``"sql_proxy_major_version": 2`` in the ``extra`` field. ``sql_proxy_version``
must also be set to the v2
+release to download, as there is no "latest" download for v2, unless the
``sql_proxy_binary_path`` argument
+of the hook or operator points to an existing v2 binary. Both must be v2.2.0
or newer.
+
+Cloud SQL for MySQL 8.4 users authenticating with ``caching_sha2_password``
need v2. v1 cannot complete
+that plugin's full authentication, so connections fail with ``1045 Access
denied`` after the server's
+authentication cache is emptied, for example by an instance restart.
Review Comment:
minor: this only holds for Unix sockets, the default. Over TCP
(`sql_proxy_use_tcp`), [Google's
docs](https://docs.cloud.google.com/sql/docs/mysql/connect-auth-proxy) say a
MySQL 8.4 client must enable public key retrieval (`--get-server-public-key` or
`allowPublicKeyRetrieval=true`), and a comment on
[cloud-sql-proxy#2317](https://github.com/GoogleCloudPlatform/cloud-sql-proxy/issues/2317)
shows `Authentication requires secure connection` on v2.20.0 without it.
`CloudSQLDatabaseHook` only sets `unix_socket` in the connection extras and
`MySqlHook` has no option for this, so as far as I can tell Airflow users can't
turn it on. I haven't run this through Airflow. Could you add a sentence
telling these users to keep the default Unix socket mode, or correct me if TCP
worked in your tests?
---
Drafted-by: Claude Code (Opus 5.5); reviewed by `shahar1` before posting
##########
providers/google/docs/connections/gcp_sql.rst:
##########
@@ -78,6 +78,48 @@ Extra (optional)
export
AIRFLOW_CONN_GOOGLE_CLOUD_SQL_DEFAULT='gcpcloudsql://user:[email protected]:3306/mydb?database_type=mysql&project_id=example-project&location=europe-west1&instance=testinstance&use_proxy=True&sql_proxy_use_tcp=False'
+Using Cloud SQL Auth Proxy v2
+-----------------------------
+
+By default Airflow runs Cloud SQL Auth Proxy v1. To run Cloud SQL Auth Proxy
v2 instead, set
+``"sql_proxy_major_version": 2`` in the ``extra`` field. ``sql_proxy_version``
must also be set to the v2
+release to download, as there is no "latest" download for v2, unless the
``sql_proxy_binary_path`` argument
+of the hook or operator points to an existing v2 binary. Both must be v2.2.0
or newer.
+
+Cloud SQL for MySQL 8.4 users authenticating with ``caching_sha2_password``
need v2. v1 cannot complete
+that plugin's full authentication, so connections fail with ``1045 Access
denied`` after the server's
+authentication cache is emptied, for example by an instance restart.
+
+Cloud SQL Auth Proxy v2 connects only to the instance's public IP by default,
while v1 falls back to the
+private IP when the instance has no public IP. Airflow passes ``--auto-ip`` to
v2 to keep the v1 behavior,
+so instances with only a private IP work with both versions. ``--auto-ip`` was
added in v2.2.0, which is
+why older v2 releases exit at startup.
+
+The two versions also differ in authentication:
+
+* When the Google Cloud connection has neither ``key_path`` nor
``keyfile_dict``, v1 tries the
+ ``GOOGLE_APPLICATION_CREDENTIALS`` file, then the active ``gcloud`` account,
then Application Default
+ Credentials. v2 uses Application Default Credentials only. A worker
authenticated only with
+ ``gcloud auth login`` or ``gcloud auth activate-service-account`` can
therefore work with v1 but fail,
+ or connect as a different identity, with v2.
+* v2 attributes its Cloud SQL Admin API calls to the quota project of its
credentials. Credentials whose
+ quota project is unrelated to the instance, which is common for local
Application Default Credentials,
+ make v2 fail with ``403 SERVICE_DISABLED`` naming that other project.
+
+Example "extras" field:
+
+.. code-block:: json
+
+ {
+ "database_type": "mysql",
+ "project_id": "example-project",
+ "location": "europe-west1",
+ "instance": "testinstance",
+ "use_proxy": true,
+ "sql_proxy_major_version": 2,
+ "sql_proxy_version": "v2.14.0"
Review Comment:
nit: people will copy this version. v2.14.0 is below what [Google's release
notes](https://docs.cloud.google.com/sql/docs/mysql/release-notes) ask for:
proxy 2.26.3 or later for GCP-2026-071 (2026-10-23), and 2.14.3 or later on
customer-managed CA instances (2025-05-08). It also lacks the MySQL fix above.
Could you use a current release here, on line 201, and in the docstrings and
error message in `cloud_sql.py` (lines 604, 717 and 946)? The tests can stay as
they are.
```suggestion
"sql_proxy_version": "v2.27.0"
```
---
Drafted-by: Claude Code (Opus 5.5); reviewed by `shahar1` before posting
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
