cloud-run-job-cloudsql-setup

Cloud Run Job with CloudSQL Setup

Problem

Setting up Cloud Run Jobs to connect to CloudSQL involves multiple non-obvious steps and gotchas that cause confusing errors. The main issues are:

1. Wrong gcloud flags for CloudSQL connection
2. Incorrect socket path configuration
3. Missing IAM permissions
4. App code trying to start proxy when Cloud Run already provides it

Context / Trigger Conditions

• Error: "unrecognized arguments: --add-cloudsql-instances" (wrong flag name)
• Error: "Cloud SQL Proxy not found" (app trying to start proxy in container)
• Error: "password authentication failed" (socket path misconfigured or newline in secret)
• Error: "Permission denied on secret" (missing secretAccessor role)
• Error: "does not have permission to access namespaces" (missing cloudsql.client role)

Solution

1. Create the Job with Correct Flags

gcloud run jobs create my-job \
  --region=us-central1 \
  --image=gcr.io/PROJECT/IMAGE:latest \
  --set-cloudsql-instances=PROJECT:REGION:INSTANCE \  # NOT --add-cloudsql-instances
  --set-env-vars="POSTGRES_SOCKET_PATH=/cloudsql/PROJECT:REGION:INSTANCE,POSTGRES_DATABASE=mydb,POSTGRES_USER=myuser" \
  --set-secrets="POSTGRES_PASSWORD=my-secret:latest"

Key: Use --set-cloudsql-instances NOT --add-cloudsql-instances

2. Configure Socket Path in App

For Node.js with pg library:

// Use socketPath for unix socket, not host
if (config.socketPath) {
  pool = new Pool({
    host: config.socketPath,  // e.g., "/cloudsql/project:region:instance"
    database: config.database,
    user: config.user,
    password: config.password,
  });
}

Environment variable: POSTGRES_SOCKET_PATH=/cloudsql/PROJECT:REGION:INSTANCE

3. Grant Required IAM Permissions

# Secret access
gcloud secrets add-iam-policy-binding my-secret \
  --member="serviceAccount:[email protected]" \
  --role="roles/secretmanager.secretAccessor"

# CloudSQL connection
gcloud projects add-iam-policy-binding PROJECT_ID \
  --member="serviceAccount:[email protected]" \
  --role="roles/cloudsql.client"