Repository: google/go-cloud

Issue #3164: postgres/gcppostgres: SIGSEGV Trying to Connect to CloudSQL PostgreSQL Instance from Cloud Run
Created: 2022-09-14T03:14:05Z
Describe the bug
Trying to connect to a CloudSQL PostgreSQL Instance in Cloud Run using v0.26.0 causes a SIGSEGV:
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x18 pc=0xc93612]

goroutine 47 [running]:
github.com/GoogleCloudPlatform/cloudsql-proxy/proxy/certs.(*RemoteCertSource).Local(0xc000723b60, {0xc0007381e0, 0x2a})
	/go/pkg/mod/github.com/!google!cloud!platform/cloudsql-proxy@v1.32.0/proxy/certs/certs.go:225 +0x252
github.com/GoogleCloudPlatform/cloudsql-proxy/proxy/proxy.(*Client).refreshCfg(0xc00014b080, {0xc0007381e0, 0x2a})
	/go/pkg/mod/github.com/!google!cloud!platform/cloudsql-proxy@v1.32.0/proxy/proxy/client.go:205 +0x1bb
github.com/GoogleCloudPlatform/cloudsql-proxy/proxy/proxy.(*Client).startRefresh.func1()
	/go/pkg/mod/github.com/!google!cloud!platform/cloudsql-proxy@v1.32.0/proxy/proxy/client.go:284 +0xad
created by github.com/GoogleCloudPlatform/cloudsql-proxy/proxy/proxy.(*Client).startRefresh
	/go/pkg/mod/github.com/!google!cloud!platform/cloudsql-proxy@v1.32.0/proxy/proxy/client.go:282 +0xcc

Switching back to v0.25.0 solves the issue
To Reproduce
Trying to connect to a CloudSQL PostgreSQL Instance from a Cloud Run Instance with v0.26.0:
package main

import (
	"fmt"
	"gocloud.dev/postgres"
	_ "gocloud.dev/postgres/gcppostgres"
	"context"
)

func main(){
	db, err := postgres.Open(context.Background(), "gcppostgres://postgres:postgres@my-project/us-east4/cloudsqlinstance/postgres")
	if err != nil {
		panic(err)
	}

	err = db.Ping()
	if err != nil {
		panic(err)
	}

	fmt.Println("Database successfully pinged.")
}
Expected behavior
Connecting without SIGSEGV
Version
v0.26.0
Additional context
I suspect this is related: #3122 but I doubled checked and my CloudSQL instance has the cloudsql.iam_authentication turned on.
Before the SIGSEGV the following was logged:
2022/09/14 02:38:19 refreshing ephemeral certificate for instance my-project:us-east4:cloudsqlinstance
2022/09/14 02:38:19 Generated RSA key in 250.263502ms

Duplicate issue #3121: postgres: Support IAM auth for GCP
Created: 2022-04-14T21:25:40Z
Is your feature request related to a problem? Please describe.
The cloudsql-proxy supports using IAM database auth but this package does not. This also means that packages that rely on this, such as the postgresql terraform module, must copy passwords around, as in the example.
Describe the solution you'd like
I should be able to pass in an enable_iam_login parameter, and have it passed through to cloudsql-proxy. I really would love to be able to use that with the terraform postgresql package which relies on this.
Describe alternatives you've considered
Otherwise, we have to keep throwing SQL password strings around, which is annoying and less secure. Alternately, switch to AWS, where this is supported.
Additional context
I believe this can be implemented by doing the following (based on a cursory review of the code):

Add an iam auth option to go-cloud/gcp/cloudsql/cloudsql.go, and use that to set EnableIAMLogin: true, in certs.RemoteOpts{}
Add a url parameter for iam auth, and read it in from lazyCredsOpener.OpenPostgresURL (in gcppostgres/gcppostgres.go)
Filter out the url parameter from the previous step in URLOpener.OpenPostgresURL (in gcppostgres/gcppostgres.go) when doing parameter validation.

Closing comment (2022-10-13T15:24:24Z): I'm rolling back this change and reopening this due to the problem reported in #3164.