GoogleCloudPlatform / GoogleCloudPlatform/alloydb-auth-proxy

Allow bypassing managed connection pooling

Open
#967 4 comments 0 reactions 1 assignee Claimed by @nancynh View on GitHub
type: feature request
Dominant language
Go
Stars
82
Forks
19
Avg merge
9d 4h
Merged PRs (30d)
10

Description

### Feature Description

When managed connection pooling is enabled on an instance, all connections through the AlloyDB Auth Proxy are routed through the pooler. There is no per-connection opt-out.

Current behavior: in a single psql session via alloydb-auth-proxy (v1.16.x), running pg_backend_pid() produces a changing pid, indicating transaction-pooling semantics. This breaks workloads that require session state, such as e.g. migration tooling.

[The documented port-based choice](https://docs.cloud.google.com/alloydb/docs/configure-managed-connection-pooling#connect-managed-connection-pooling) (5432 direct vs 6432 pooled) only exists for direct IP connections. Proxy/connector connections all enter via the server-side proxy (hardcoded as port 5433) and are pooled whenever pooling is enabled on the instance.

Desired behavior: a way to opt-out from the pooling, e.g. via a flag `--bypass-pooling` or by allowing user to select a server port e.g. `--server-port 5432`.

P.S. I think similar behavior exists on language connectors as well, but I didn't want to balloon the scope.

### Sample code

### Alternatives Considered

1. Direct connection with an OAuth token as password - working workaround:

```bash
PGPASSWORD=$(gcloud auth print-access-token \
--impersonate-service-account=SA@PROJECT.iam.gserviceaccount.com) \
psql "host=INSTANCE_IP port=5432 user=SA@PROJECT.iam dbname=DB sslmode=require"
```

It seems to me that in this setup the connection is un-pooled: it had stable pg_backend_pid(). However, the token expires after ~1h with no refresh, and this path loses the connector's automatic cert rotation and credential handling, so alloydb-auth-proxy is still preferable.

2. Disabling managed pooling instance-wide - defeats the purpose; we want pooling for the bulk of traffic and direct connections only for specific workloads.

### Additional Details

Environment: latest alloydb-auth-proxy (1.16.0) with --auto-iam-authn --impersonate-service-account=..., instance in europe-west1, managed connection pooling enabled

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.