GoogleCloudPlatform / GoogleCloudPlatform/alloydb-auth-proxy
Allow bypassing managed connection pooling
- Dominant language
- Go
- Stars
- 82
- Forks
- 19
- Avg merge
- 9d 4h
- Merged PRs (30d)
- 10
Description
### Feature Description
When managed connection pooling is enabled on an instance, all connections through the AlloyDB Auth Proxy are routed through the pooler. There is no per-connection opt-out.
Current behavior: in a single psql session via alloydb-auth-proxy (v1.16.x), running pg_backend_pid() produces a changing pid, indicating transaction-pooling semantics. This breaks workloads that require session state, such as e.g. migration tooling.
[The documented port-based choice](https://docs.cloud.google.com/alloydb/docs/configure-managed-connection-pooling#connect-managed-connection-pooling) (5432 direct vs 6432 pooled) only exists for direct IP connections. Proxy/connector connections all enter via the server-side proxy (hardcoded as port 5433) and are pooled whenever pooling is enabled on the instance.
Desired behavior: a way to opt-out from the pooling, e.g. via a flag `--bypass-pooling` or by allowing user to select a server port e.g. `--server-port 5432`.
P.S. I think similar behavior exists on language connectors as well, but I didn't want to balloon the scope.
### Sample code
### Alternatives Considered
1. Direct connection with an OAuth token as password - working workaround:
```bash
PGPASSWORD=$(gcloud auth print-access-token \
--impersonate-service-account=SA@PROJECT.iam.gserviceaccount.com) \
psql "host=INSTANCE_IP port=5432 user=SA@PROJECT.iam dbname=DB sslmode=require"
```
It seems to me that in this setup the connection is un-pooled: it had stable pg_backend_pid(). However, the token expires after ~1h with no refresh, and this path loses the connector's automatic cert rotation and credential handling, so alloydb-auth-proxy is still preferable.
2. Disabling managed pooling instance-wide - defeats the purpose; we want pooling for the bulk of traffic and direct connections only for specific workloads.
### Additional Details
Environment: latest alloydb-auth-proxy (1.16.0) with --auto-iam-authn --impersonate-service-account=..., instance in europe-west1, managed connection pooling enabled
Contributor guide
Assessment
This issue has not been assessed yet.