The access_cloud_sql script may silently fail to connect due to missing access

[RSpace]

Spent some time figuring out this gotcha: If the rake assets:precompile step require database access (which is very typical for large Rails apps), the Cloud SQL Proxy can fail to connect if the Cloud Build Service Account does not have the Cloud SQL Client role, but the build will still display "Ready for new connections".

This leads to the asset precompile step failing when it tries to connect to the database. Debugging further, I can see that the actual output from the Cloud SQL Proxy is:

Step #1: 2018/11/29 09:17:19 current FDs rlimit set to 1048576, wanted limit is 8500. Nothing to do here.
Step #1: 2018/11/29 09:17:21 errors parsing config:
Step #1: 	googleapi: Error 403: The client is not authorized to make this request., notAuthorized
Step #1: 2018/11/29 09:17:21 Ready for new connections

... but this is never passed on to the deploy output, so as an App Engine I'm left in the dark to what may be wrong. It could save others time to make this more clear in the output, and it would also be great if https://cloud.google.com/appengine/docs/flexible/ruby/using-cloud-sql-postgres included the information that the Cloud Build Service Account may need to have the Cloud SQL Client role.

[basharh]

Just spent 4-5 hours debugging an issue because of this. Same thing: turns out the cloudbuild.gserviceaccount.com service account was missing cloud sql permissions on GCP but there was no indication from exec-wrapper.