使用Sequelize无法连接Cloud SQL（PostgreSQL）实例的求助

一、修复401认证错误 #

Cloud Build执行时使用的是Cloud Build服务账号，而非你本地的个人账号——哪怕你是项目所有者，服务账号也需要单独配置权限：

• 找到你的Cloud Build服务账号（格式：[PROJECT_NUMBER]@cloudbuild.gserviceaccount.com），给它添加Cloud SQL Admin角色
• 确认Cloud SQL Admin API已在Google Cloud控制台的API库中启用

另外你的cloudbuild.yaml存在语法错误：echo "DB_HOST=12.34.56.78 >> .env 缺少闭合双引号，修正后内容如下：

steps:
  - name: 'gcr.io/cloud-builders/docker'
    entrypoint: 'bash'
    args:
      - '-c'
      - |
        echo "ENVIRONMENT=development" > .env
        echo "DB_HOST=12.34.56.78" >> .env
        echo "DB_NAME=my-database-dev" >> .env
        echo "DB_USERNAME=postgres" >> .env
        echo "DB_PASSWORD=password" >> .env
        echo "DB_DIALECT=postgres" >> .env
        echo "CLOUD_SQL_INSTANCE=$_CLOUD_SQL_INSTANCE" >> .env

  - name: 'gcr.io/cloud-builders/npm'
    args: [ 'install' ]
  - name: 'gcr.io/cloud-builders/npm'
    args: [ 'run', 'db:migrate' ]

二、解决psql连接超时问题 #

psql超时大概率是Cloud SQL的防火墙规则未允许来源IP：

• 若用公网IP连接，需将Cloud Build的出口IP段添加到Cloud SQL的授权网络中（可在Cloud Build设置页面查看出口IP）
• 更安全的方案是在Cloud Build中使用Cloud SQL Auth Proxy，无需开放公网授权，修改cloudbuild.yaml添加代理启动步骤：

steps:
  # 创建.env文件（已修正语法错误）
  - name: 'gcr.io/cloud-builders/docker'
    entrypoint: 'bash'
    args:
      - '-c'
      - |
        echo "ENVIRONMENT=development" > .env
        echo "DB_HOST=127.0.0.1" >> .env  # 改为代理本地地址
        echo "DB_NAME=my-database-dev" >> .env
        echo "DB_USERNAME=postgres" >> .env
        echo "DB_PASSWORD=password" >> .env
        echo "DB_DIALECT=postgres" >> .env
        echo "CLOUD_SQL_INSTANCE=$_CLOUD_SQL_INSTANCE" >> .env

  # 后台启动Cloud SQL Auth Proxy
  - name: 'gcr.io/cloudsql-docker/gce-proxy'
    args: ['/cloud_sql_proxy', '-instances', '$_CLOUD_SQL_INSTANCE=tcp:5432']
    background: true

  - name: 'gcr.io/cloud-builders/npm'
    args: [ 'install' ]
  - name: 'gcr.io/cloud-builders/npm'
    args: [ 'run', 'db:migrate' ]

三、修正Sequelize配置冲突 #

你同时指定了host和Connector的clientOpts，这会导致连接逻辑冲突。使用Cloud SQL Connector时，无需手动设置host，Connector会自动处理连接路径，修正后的代码：

const connector = new Connector();
const clientOpts = connector.getOptions({
  instanceConnectionName: process.env.CLOUD_SQL_INSTANCE,
  ipType: IpAddressTypes.PUBLIC,
  authType: process.env.DB_PASSWORD ? AuthTypes.PASSWORD : AuthTypes.IAM,
});
dbConfig = {
  username: process.env.DB_USERNAME,
  password: process.env.DB_PASSWORD,
  database: process.env.DB_NAME,
  dialect: process.env.DB_DIALECT,
  dialectOptions: clientOpts,
};
export const sequelize = new Sequelize({
  ...dbConfig,
  models: [/* ... */],
});

// 测试连接
console.log('[sequelize.ts] Testing connection ..');
sequelize.authenticate()
  .then(() => console.log('Connection has been established successfully.'))
  .catch(err => console.error('Unable to connect to the database:', err));

额外检查点 #

• 确认Cloud SQL实例状态为运行中
• 验证$_CLOUD_SQL_INSTANCE替换后的实例连接名格式正确：PROJECT_ID:REGION:INSTANCE_NAME
• 本地gcloud sql connect能成功，说明实例本身无问题，重点排查Cloud Build的权限与网络配置

内容的提问来源于stack exchange，提问作者Stefan Falk