title: Kubernetes Cloud SQL sidecar connection timed out. How to check if credentials work?
body: <p>I'm trying to setup a Cloud SQL Proxy Docker image for PostgreSQL as mentioned <a href="https://cloud.google.com/sql/docs/postgres/connect-kubernetes-engine#proxy" rel="nofollow noreferrer">here</a>.
  I can get my app to connect to the proxy docker image but the proxy times out. I suspect it's my credentials or the port, so how do I debug and find out if it works?
  This is what I have on my project</p>
  
  <pre><code>kubectl create secret generic cloudsql-instance-credentials --from-file=credentials.json=my-account-credentials.json
  </code></pre>
  
  <p>My deploy spec snippet:</p>
  
  <pre><code>spec:
        containers:
          - name: mara ...
          - name: cloudsql-proxy
            image: gcr.io/cloudsql-docker/gce-proxy:1.11
            command: ["/cloud_sql_proxy",
                      "-instances=&lt;MY INSTANCE NAME&gt;=tcp:5432",
                      "-credential_file=/secrets/cloudsql/credentials.json"]
            volumeMounts:
              - name: cloudsql-instance-credentials
                mountPath: /secrets/cloudsql
                readOnly: true
        volumes:
          - name: cloudsql-instance-credentials
            secret:
              secretName: cloudsql-instance-credentials
  </code></pre>
  
  <p>The logs of my cloudsql-proxy show a timeout:</p>
  
  <pre><code>2019/05/13 15:08:25 using credential file for authentication; email=646092572393-compute@developer.gserviceaccount.com
  2019/05/13 15:08:25 Listening on 127.0.0.1:5432 for &lt;MY INSTANCE NAME&gt;
  2019/05/13 15:08:25 Ready for new connections
  2019/05/13 15:10:48 New connection for "&lt;MY INSTANCE NAME&gt;"
  2019/05/13 15:10:58 couldn't connect to &lt;MY INSTANCE NAME&gt;: dial tcp &lt;MY PRIVATE IP&gt;:3307: getsockopt: connection timed out
  </code></pre>
  
  <p>Questions:</p>
  
  <ul>
  <li><p>I specify 5432 as my port, but as you can see in the logs above,it's hitting 3307. Is that normal and if not, how do I specify 5432?</p></li>
  <li><p>How do I check if it is a problem with my credentials? My credentials file is from my service account <code>123-compute@developer.gserviceaccount.com</code>
  and the service account shown when I go to my cloud sql console is <code>p123-&lt;somenumber&gt;@gcp-sa-cloud-sql.iam.gserviceaccount.com</code>. They don't seem the same? Does that make a difference?</p></li>
  </ul>
  
  <p>If I make the Cloud SQL instance available on a public IP, it works.</p>