mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-04 02:21:02 +08:00
15 lines
604 B
Plaintext
15 lines
604 B
Plaintext
If you intend to use "Allow only SSL connections" option on your Cloud SQL
|
|
database, the service account must include the following permission to be
|
|
able to generate ephemeral client certificates:
|
|
|
|
```ini
|
|
cloudsql.sslCerts.createEphemeral
|
|
```
|
|
|
|
GCP does not currently support granting this permission to custom roles so
|
|
you'd need to assign "Cloud SQL Admin" role to the Teleport service account.
|
|
|
|
Note that "Allow only SSL connections" setting only forces the client to
|
|
provide a client certificate - all communication between Teleport and the
|
|
database is still over TLS even with this setting disabled.
|