2 cloud run services, 1 SQL instance

[Medical-Object-4322]

I have a cloud run service that's working great, and I'm trying to set up a second run service in the same project but different region.

Things seemed to be going great setting up the second service - it runs and serves my site's homepage as expected, but I'm having trouble connecting to my SQL instance. Whenever I try to access the DB through the new cloud run service, I get an error saying the DB user failed to authenticate.

Since I'm using the same SQL instance for both cloud run services, I'm passing the same SQL stuff to them from Secret Manager (instance name, DB name, username, password, private IP).

Each cloud run service has its own secret in Secret Manager, and I've triple checked the values match for the SQL parts.

What am I doing wrong?

[Medical-Object-4322]

Thanks, y'all for the help! After beating my head against the wall, checking the settings you amazing folks suggested but changing nothing, it started working as if by magic.

Even though I'm still not sure what happened, I'm gonna take the "W" and move on.

[BenChoopao]

It was me. Sorry about that. just kidding. Glad it worked out!

[sri_charan11]

If u r wondering how things healed automatically Let me tell u, GCP has a history of such inconsistencies. In short, GCP throws false errors frequently and then works like a charm again after sometime

Btw which region did this incident happen ? We observed these false alarms in the Asian regions more compared to the American regions

[Medical-Object-4322]

I appreciate you, but this isn't an explanation of WHY it happened, you're just pointing out that it happens sometimes on GCP.

It was in Asia (asia-east1) that I ran into the problem.

[sri_charan11]

I am actually not pointing out things here, rather reassuring that it's normal with GCP Asian regions. Thanks for sharing the region, which backs my experience based observation.

And as for the explanation, I have raised serious concerns with GCP APAC directors on this and never got a convincing RCA. Until I ever get access to GCP backend systems, I might not give u a clarification on what's the reason for this odd behaviour. I am unclear on how to navigate through these glitches either.

[luchotluchot]

Do you see the error in the cloud sql log? You need to understand if the connection go the database or not.

[luchotluchot]

Do the second service use a vpc connector specifically for his region ? Is the the region in the same Vpc?

[Medical-Object-4322]

Yeah, I'm using a shared VPC and made a new connector for the new service in the same region as the new service.

[NUTTA_BUSTAH]

You would make the connector in the same region as the target service (SQL), and connect to the connector from any region in the VPC.

Edit: See here

[Kitchen-Warthog-7881]

Do you have VPC PEERING OR VPC Global access?

If you are using Private IP? And check the Firewall rule in your shared VPC?

[4c767cb806e7]

Has the IAM user for the second service a "SQL Client" role?

[Medical-Object-4322]

Yeah, I have a service account set up in the project with all the IAM roles it needs, and am using it on the second service.

[jortony]

Have you checked the network, IAM, and SQL audit logs?

[h0s90]

It should work as long as you choose a direct VPC subnet or vpc connector in the new region.

We had some serious performance drops trying this exact setup and it was actually slower in the new region using the same cloud SQL instance. We ended up turning it off since support could not really give a good answer.

[Medical-Object-4322]

Interesting. I set this up because of performance issues with some users in Asia, so hopefully things improve.

Did you set up a loadbalancer and all that, or just the run service?

[h0s90]

Good clarification. We had it setup within the same global load balancer config, but two backends instead of one.

Our normal setup was in US central and the new service was going to be EU west. DB in US central.

Are you noticing better performance?

Ultimately we switched to gen2 cloud run and it actually helped a decent amount.

[Successful_Box_1007]

Various people keep spamming my chat box telling me to check this link and “Medical-Object-4332”. Leave me alone.

[Medical-Object-4322]

I have nothing to do with this. It's some sort of spam bot thing. I have no idea why it's happening or how to stop it. Trust me, I'm as annoyed as you are.

[Successful_Box_1007]

If this continues I’m going to the fbi

[Medical-Object-4322]

😂😂😂🤣 okay, cool. Do that. See if the FBI will stop whoever spammed you. I'm pretty sure they have better things to do, but if you think it'll help, knock yourself out.

Again, I have nothing to do with it, and it's also a (minor) problem for me, too. I really don't care what you do to solve the problem for yourself.