401 Unauthorized to sqladmin.googleapis when using Spring Cloud to create ephemeral certificate for GCP Cloud SQL

Question

I am connecting a Springboot application on my local computer to GCP Cloud SQL, using Spring cloud dependency com.google.cloud:spring-cloud-gcp-starter-sql-postgresql:4.8.2

The dependency is trying to call below endpoint and got 401 unauthorized.

https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1beta4/connect/generateEphemeralCert

I am calling with a service account with roles Cloud SQL Admin, Cloud SQL Client, Cloud SQL Editor, Cloud SQL Instance User. Downloaded the json key file and put it under my resource folder. Configured application.properties as below.

  datasource:
    driver-class-name: org.postgresql.Driver
    username: username
    password: password
  cloud:
    gcp:
      sql:
        database-name: database-name
        instance-connection-name: instance-connection-name
        credentials:
          location: file:credential.json
          scopes: DEFAULT_SCOPES,https://www.googleapis.com/auth/sqlservice.admin,https://www.googleapis.com/auth/cloud-platform

When I startup my Springboot application, it is saying

java.lang.RuntimeException: Failed to create ephemeral certificate for the Cloud SQL instance.
    at com.google.cloud.sql.core.SqlAdminApiFetcher.addExceptionContext(SqlAdminApiFetcher.java:380)
    at com.google.cloud.sql.core.SqlAdminApiFetcher.fetchEphemeralCertificate(SqlAdminApiFetcher.java:277)
    at com.google.cloud.sql.core.SqlAdminApiFetcher.lambda$getInstanceData$1(SqlAdminApiFetcher.java:117)
    at com.google.common.util.concurrent.CombinedFuture$CallableInterruptibleTask.runInterruptibly(CombinedFuture.java:196)
    at com.google.common.util.concurrent.InterruptibleTask.run(InterruptibleTask.java:74)
    ... 6 common frames omitted
Caused by: com.google.api.client.googleapis.json.GoogleJsonResponseException: 401 Unauthorized
POST https://sqladmin.googleapis.com/sql/v1beta4/projects/my-project-id/instances/my-sql-instance:generateEphemeralCert
    at com.google.api.client.googleapis.json.GoogleJsonResponseException.from(GoogleJsonResponseException.java:146)
    at com.google.api.client.googleapis.services.json.AbstractGoogleJsonClientRequest.newExceptionOnError(AbstractGoogleJsonClientRequest.java:118)
    at com.google.api.client.googleapis.services.json.AbstractGoogleJsonClientRequest.newExceptionOnError(AbstractGoogleJsonClientRequest.java:37)
    at com.google.api.client.googleapis.services.AbstractGoogleClientRequest$3.interceptResponse(AbstractGoogleClientRequest.java:466)
    at com.google.api.client.http.HttpRequest.execute(HttpRequest.java:1111)
    at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:552)
    at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.executeUnparsed(AbstractGoogleClientRequest.java:493)
    at com.google.api.client.googleapis.services.AbstractGoogleClientRequest.execute(AbstractGoogleClientRequest.java:603)
    at com.google.cloud.sql.core.SqlAdminApiFetcher.fetchEphemeralCertificate(SqlAdminApiFetcher.java:275)
    ... 9 common frames omitted

I also tried to add the dependency com.google.cloud:spring-cloud-gcp-starter:4.8.2 and configure credentials and project-id under spring.cloud.gcp, but it does not help at all. I am new to GCP. I also tried to open up firewall rule, also does not help.

I would recommend you give it a try to the Connect using Cloud SQL Language Connectors quickstart as it will guide you through the required steps to properly authenticate. — ruyadorno
– ruyadorno, Commented Oct 23, 2023 at 13:13

at9pm · Accepted Answer · 2023-10-25 00:40:10Z

0

I suspect either there is something wrong for the dependency com.google.cloud:spring-cloud-gcp-starter-sql-postgresql:4.8.2 when using the key file to do authentication, or another explanation is the dependency cannot read my key file but not throwing out any message that it cannot read the key.

I tried another approach by using gcloud cli for ADC, which is working.

answered Oct 25, 2023 at 0:40

at9pm

1

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

401 Unauthorized to sqladmin.googleapis when using Spring Cloud to create ephemeral certificate for GCP Cloud SQL

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related