GCP configure an external master issue

Question

I'm following GCP tutorial to create a replica instance from an external master. The Cloud SQL API is enabled and I am using google shell from the console to run the commands. I have also tried from a compute engine instance using gcloud auth login to get credentials but run into the exact same issue.

I'm creating the internal master without any issue:

ACCESS_TOKEN="$(gcloud auth application-default print-access-token)"
curl --header "Authorization: Bearer ${ACCESS_TOKEN}" \
 --header 'Content-Type: application/json' \
 --data '{"name": "int-clouddb5",
          "region": "us-central1-a",
          "databaseVersion": "MYSQL_5_5",
          "onPremisesConfiguration": {"hostPort": "79.xx.xx.xx:3306"}}' \
 -X POST \
 https://www.googleapis.com/sql/v1beta4/projects/my-project-222/instances

But then when setting up the replica this way:

curl --header "Authorization: Bearer ${ACCESS_TOKEN}" \
 --header 'Content-Type: application/json' \
 --data '{"replicaConfiguration":
           {"mysqlReplicaConfiguration":
             {"username": "xxxx", "password": "xxxxx",
              "dumpFilePath": "gs://xxxbucket-data/xxxxmpv2.sql" }},
          "settings": {"tier": "D4","activationPolicy": "ALWAYS"},
          "databaseVersion": "MYSQL_5_5",
          "masterInstanceName": "int-clouddb5", "name": "sla-clouddb3"}' \
 -X POST \
 https://www.googleapis.com/sql/v1beta4/projects/xxxxxx/instances

I get the following error message:

{
 "error": {
  "errors": [
   {
    "domain": "global",
    "reason": "notAuthorized",
    "message": "The client is not authorized to make this request."
   }
  ],
  "code": 403,
  "message": "The client is not authorized to make this request."
 }
}

GCP support suggested to use us-central-1a as they had bugs reported on other regions but that doesn't change anything and the guy doesn't seem to understand my request. Has anyone an idea about what's wrong there?

EDIT: the account used to perform everything is the Owner account, it has all permissions on all projects.

Answer 1

The sample uses $(gcloud auth application-default print-access-token) to get the access token for the request, so you want to use gcloud auth application-default login, not gcloud auth login. You'll also want to ensure that your account has correct permissions to configure the external master.

Answer 2

As of now, the answer is that Cloud SQL external master replication is broken. The suggestion from the support team are quite... hmmm I let you judge.

*Hello, As per checking with our backend team, there are similary bugs already raised for the concern on the external master replication. The team concerned is already handling this issue however no estimated time of resolution has been provided although this is already on high priority. For the meantime, below workarounds is being suggested:

a.) Use mysqldump with a down time [1]

b.) Use GCE instance for replication [2]*

I hope that this is helpful. Please do let me know if you need further clarification. Sincerely, E. Google Cloud Platform Support