arno-fukuda commented on code in PR #73646:
URL: https://github.com/apache/airflow/pull/73646#discussion_r4488142240
##########
providers/google/docs/connections/gcp_sql.rst:
##########
@@ -78,6 +78,48 @@ Extra (optional)
export
AIRFLOW_CONN_GOOGLE_CLOUD_SQL_DEFAULT='gcpcloudsql://user:[email protected]:3306/mydb?database_type=mysql&project_id=example-project&location=europe-west1&instance=testinstance&use_proxy=True&sql_proxy_use_tcp=False'
+Using Cloud SQL Auth Proxy v2
+-----------------------------
+
+By default Airflow runs Cloud SQL Auth Proxy v1. To run Cloud SQL Auth Proxy
v2 instead, set
+``"sql_proxy_major_version": 2`` in the ``extra`` field. ``sql_proxy_version``
must also be set to the v2
+release to download, as there is no "latest" download for v2, unless the
``sql_proxy_binary_path`` argument
+of the hook or operator points to an existing v2 binary. Both must be v2.2.0
or newer.
+
+Cloud SQL for MySQL 8.4 users authenticating with ``caching_sha2_password``
need v2. v1 cannot complete
Review Comment:
Confirmed. `WithMdxClientProtocolType` first appears in
`internal/proxy/proxy.go` in v2.19.0, which matches the 2.19.0 changelog entry
(cloud-sql-proxy#2489, closing #2317). Fixed in 8a548ee361: the docs now say
MySQL 8.4 users on `caching_sha2_password` need v2.19.0 or newer.
The reproduction in #72681 used v2.25.4 over the Unix socket, both locally
and in the Composer run through the provider's `MySqlHook`.
---
Drafted-by: Claude Code (Opus 5.5); reviewed by @arno-fukuda before posting
##########
providers/google/docs/connections/gcp_sql.rst:
##########
@@ -78,6 +78,48 @@ Extra (optional)
export
AIRFLOW_CONN_GOOGLE_CLOUD_SQL_DEFAULT='gcpcloudsql://user:[email protected]:3306/mydb?database_type=mysql&project_id=example-project&location=europe-west1&instance=testinstance&use_proxy=True&sql_proxy_use_tcp=False'
+Using Cloud SQL Auth Proxy v2
+-----------------------------
+
+By default Airflow runs Cloud SQL Auth Proxy v1. To run Cloud SQL Auth Proxy
v2 instead, set
+``"sql_proxy_major_version": 2`` in the ``extra`` field. ``sql_proxy_version``
must also be set to the v2
+release to download, as there is no "latest" download for v2, unless the
``sql_proxy_binary_path`` argument
+of the hook or operator points to an existing v2 binary. Both must be v2.2.0
or newer.
+
+Cloud SQL for MySQL 8.4 users authenticating with ``caching_sha2_password``
need v2. v1 cannot complete
+that plugin's full authentication, so connections fail with ``1045 Access
denied`` after the server's
+authentication cache is emptied, for example by an instance restart.
Review Comment:
Agreed. I haven't run TCP through Airflow either, but the hook side is as
you describe: `MySqlHook` only forwards `ssl`, `ssl_mode`, `unix_socket`,
`local_infile` and `init_command`, so there's no way to enable public key
retrieval. The #72681 reproduction ran over the Unix socket. In 8a548ee361 the
docs tell `caching_sha2_password` users to keep `sql_proxy_use_tcp` disabled,
and explain why. The MySQL IAM example keeps TCP, since IAM database users
don't sign in with `caching_sha2_password`.
---
Drafted-by: Claude Code (Opus 5.5); reviewed by @arno-fukuda before posting
##########
providers/google/docs/connections/gcp_sql.rst:
##########
@@ -78,6 +78,48 @@ Extra (optional)
export
AIRFLOW_CONN_GOOGLE_CLOUD_SQL_DEFAULT='gcpcloudsql://user:[email protected]:3306/mydb?database_type=mysql&project_id=example-project&location=europe-west1&instance=testinstance&use_proxy=True&sql_proxy_use_tcp=False'
+Using Cloud SQL Auth Proxy v2
+-----------------------------
+
+By default Airflow runs Cloud SQL Auth Proxy v1. To run Cloud SQL Auth Proxy
v2 instead, set
+``"sql_proxy_major_version": 2`` in the ``extra`` field. ``sql_proxy_version``
must also be set to the v2
+release to download, as there is no "latest" download for v2, unless the
``sql_proxy_binary_path`` argument
+of the hook or operator points to an existing v2 binary. Both must be v2.2.0
or newer.
+
+Cloud SQL for MySQL 8.4 users authenticating with ``caching_sha2_password``
need v2. v1 cannot complete
+that plugin's full authentication, so connections fail with ``1045 Access
denied`` after the server's
+authentication cache is emptied, for example by an instance restart.
+
+Cloud SQL Auth Proxy v2 connects only to the instance's public IP by default,
while v1 falls back to the
+private IP when the instance has no public IP. Airflow passes ``--auto-ip`` to
v2 to keep the v1 behavior,
+so instances with only a private IP work with both versions. ``--auto-ip`` was
added in v2.2.0, which is
+why older v2 releases exit at startup.
+
+The two versions also differ in authentication:
+
+* When the Google Cloud connection has neither ``key_path`` nor
``keyfile_dict``, v1 tries the
+ ``GOOGLE_APPLICATION_CREDENTIALS`` file, then the active ``gcloud`` account,
then Application Default
+ Credentials. v2 uses Application Default Credentials only. A worker
authenticated only with
+ ``gcloud auth login`` or ``gcloud auth activate-service-account`` can
therefore work with v1 but fail,
+ or connect as a different identity, with v2.
+* v2 attributes its Cloud SQL Admin API calls to the quota project of its
credentials. Credentials whose
+ quota project is unrelated to the instance, which is common for local
Application Default Credentials,
+ make v2 fail with ``403 SERVICE_DISABLED`` naming that other project.
+
+Example "extras" field:
+
+.. code-block:: json
+
+ {
+ "database_type": "mysql",
+ "project_id": "example-project",
+ "location": "europe-west1",
+ "instance": "testinstance",
+ "use_proxy": true,
+ "sql_proxy_major_version": 2,
+ "sql_proxy_version": "v2.14.0"
Review Comment:
Done in 8a548ee361. Both docs examples, plus the docstring, error message
and connection-extras docs in `cloud_sql.py`, now use v2.27.0. That's the
current release and meets the 2.26.3 minimum from GCP-2026-071. The tests are
unchanged.
---
Drafted-by: Claude Code (Opus 5.5); reviewed by @arno-fukuda before posting
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
