{"record":{"id":"eb0a42f68e0c275f","repo":"googleapis/mcp-toolbox","slug":"unable-to-get-cloud-sql-connection-config-w-eb0a42","errorCode":null,"errorMessage":"unable to get Cloud SQL connection config: %w","messagePattern":"unable to get Cloud SQL connection config: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/sources/cloudsqlpg/cloud_sql_pg.go","lineNumber":195,"sourceCode":"\tif readOnly {\n\t\t// IMPORTANT: Must use underscore ('cloudsql_session_read_only'), NOT a dot.\n\t\t// PostgreSQL treats dotted GUCs (e.g. 'cloudsql.session_read_only') as custom placeholders\n\t\t// and silently ignores them at connection time, leaving the session in read-write mode.\n\t\tdsn += \" options='-c cloudsql_session_read_only=locked'\"\n\t}\n\n\treturn dsn, useIAM, nil\n}\n\nfunc initCloudSQLPgConnectionPool(ctx context.Context, tracer trace.Tracer, name, project, region, instance, ipType, user, pass, dbname string, readOnly bool) (*pgxpool.Pool, error) {\n\t//nolint:all // Reassigned ctx\n\tctx, span := sources.InitConnectionSpan(ctx, tracer, SourceType, name)\n\tdefer span.End()\n\n\t// Configure the driver to connect to the database\n\tdsn, useIAM, err := getConnectionConfig(ctx, user, pass, dbname, readOnly)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to get Cloud SQL connection config: %w\", err)\n\t}\n\n\tconfig, err := pgxpool.ParseConfig(dsn)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to parse connection uri: %w\", err)\n\t}\n\n\t// Create a new dialer with options\n\tuserAgent, err := util.UserAgentFromContext(ctx)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\topts, err := sources.GetCloudSQLOpts(ipType, userAgent, useIAM)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\td, err := cloudsqlconn.NewDialer(ctx, opts...)\n\tif err != nil {","sourceCodeStart":177,"sourceCodeEnd":213,"githubUrl":"https://github.com/googleapis/mcp-toolbox/blob/8cc6e09de2ad7b8bffc77751799585a1401a48eb/internal/sources/cloudsqlpg/cloud_sql_pg.go#L177-L213","documentation":"initCloudSQLPgConnectionPool builds the DSN via getConnectionConfig and wraps any failure — invalid user/password combination, ADC email lookup failure — with this message before pool creation. It aggregates all credential-derivation problems for the Cloud SQL Postgres source during Initialize.","triggerScenarios":"Initialize of a cloud-sql-postgres source where getConnectionConfig fails: password without username (612) or ADC principal email lookup failure (613).","commonSituations":"Malformed source config with mismatched credentials; missing ADC in the runtime environment; typo'd user field preventing DSN construction.","solutions":["Check the wrapped cause: fix the user/password pairing or the ADC environment per the inner error message.","Provide both 'user' and 'password', or neither (IAM via ADC).","Verify ADC validity with 'gcloud auth application-default print-access-token'."],"exampleFix":"# before\npassword: secret  # user missing\n# after\nuser: myuser\npassword: secret","handlingStrategy":"validation","validationCode":"// validate credential pairing before Initialize\nif (user == \"\") != (pass == \"\") && pass != \"\" {\n    return errors.New(\"invalid credential combination\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Fix the inner cause (612/613) rather than this wrapper","Validate source configs at deploy time","Keep credentials either fully explicit or fully IAM-based","Read the wrapped error: it names the exact failing step"],"tags":["configuration","cloudsql","postgres","credentials","connection"],"backgroundTag":"incomplete-credentials-config","analyzedSha":"8cc6e09de2ad7b8bffc77751799585a1401a48eb","analyzedAt":"2026-09-05T01:10:36.887Z","contentChangedAt":"2026-09-05T01:10:36.887Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}