googleapis/mcp-toolbox · error

unable to get Cloud SQL connection config: %w

Error message

unable to get Cloud SQL connection config: %w

What it means

initCloudSQLPgConnectionPool builds the DSN via getConnectionConfig and wraps any failure — invalid user/password combination, ADC email lookup failure — with this message before pool creation. It aggregates all credential-derivation problems for the Cloud SQL Postgres source during Initialize.

Source

Thrown at internal/sources/cloudsqlpg/cloud_sql_pg.go:195

	if readOnly {
		// IMPORTANT: Must use underscore ('cloudsql_session_read_only'), NOT a dot.
		// PostgreSQL treats dotted GUCs (e.g. 'cloudsql.session_read_only') as custom placeholders
		// and silently ignores them at connection time, leaving the session in read-write mode.
		dsn += " options='-c cloudsql_session_read_only=locked'"
	}

	return dsn, useIAM, nil
}

func initCloudSQLPgConnectionPool(ctx context.Context, tracer trace.Tracer, name, project, region, instance, ipType, user, pass, dbname string, readOnly bool) (*pgxpool.Pool, error) {
	//nolint:all // Reassigned ctx
	ctx, span := sources.InitConnectionSpan(ctx, tracer, SourceType, name)
	defer span.End()

	// Configure the driver to connect to the database
	dsn, useIAM, err := getConnectionConfig(ctx, user, pass, dbname, readOnly)
	if err != nil {
		return nil, fmt.Errorf("unable to get Cloud SQL connection config: %w", err)
	}

	config, err := pgxpool.ParseConfig(dsn)
	if err != nil {
		return nil, fmt.Errorf("unable to parse connection uri: %w", err)
	}

	// Create a new dialer with options
	userAgent, err := util.UserAgentFromContext(ctx)
	if err != nil {
		return nil, err
	}
	opts, err := sources.GetCloudSQLOpts(ipType, userAgent, useIAM)
	if err != nil {
		return nil, err
	}
	d, err := cloudsqlconn.NewDialer(ctx, opts...)
	if err != nil {

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Check the wrapped cause: fix the user/password pairing or the ADC environment per the inner error message.
2. Provide both 'user' and 'password', or neither (IAM via ADC).
3. Verify ADC validity with 'gcloud auth application-default print-access-token'.

Example fix

# before
password: secret  # user missing
# after
user: myuser
password: secret

// validate credential pairing before Initialize
if (user == "") != (pass == "") && pass != "" {
    return errors.New("invalid credential combination")
}

When it happens

Trigger: Initialize of a cloud-sql-postgres source where getConnectionConfig fails: password without username (612) or ADC principal email lookup failure (613).

Common situations: Malformed source config with mismatched credentials; missing ADC in the runtime environment; typo'd user field preventing DSN construction.

Related errors

• password is provided without a username. Please provide both
• unable to get AlloyDB connection config: %w
• unable to parse connection uri: %w
• unable to create db connection: %w
• unable to connect successfully: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/eb0a42f68e0c275f. Report an issue: GitHub.