title: Failure to connect to proxy "Certificate signed by unknown authority"
body: <p>I'm attempting to connect to a CloudSQL instance via a cloudsql-proxy container on my Kubernetes deployment. I have the cloudsql credentials mounted and the value of <code>GOOGLE_APPLICATION_CREDENTIALS</code> set. </p>
  
  <p>However, I'm still receiving the following error in my logs:</p>
  
  <pre><code>2018/10/08 20:07:28 Failed to connect to database: Post https://www.googleapis.com/sql/v1beta4/projects/[projectID]/instances/[appName]/createEphemeral?alt=json&amp;prettyPrint=false: oauth2: cannot fetch token: Post https://oauth2.googleapis.com/token: x509: certificate signed by unknown authority
  </code></pre>
  
  <p>My connection string looks like this: </p>
  
  <pre><code>[dbUser]:[dbPassword]@cloudsql([instanceName])/[dbName]]?charset=utf8&amp;parseTime=True&amp;loc=Local
  </code></pre>
  
  <p>And the proxy dialer is shadow-imported as:</p>
  
  <pre><code>_ github.com/GoogleCloudPlatform/cloudsql-proxy/proxy/dialers/mysql
  </code></pre>
  
  <p>Anyone have an idea what might be missing?</p>
  
  <p><strong>EDIT:</strong></p>
  
  <p>Deployment Spec looks something like this (JSON formatted):</p>
  
  <pre><code>{
    "replicas": 1,
    "selector": {
      ...
    },
    "template": {
      ...
      "spec": {
        "containers": [
          {
            "image": "[app-docker-imager]",
            "name": "...",
            "env": [
              ...
              {
                "name": "MYSQL_PASSWORD",
                ...
              },
              {
                "name": "MYSQL_USER",
                ...
              },
              {
                "name": "GOOGLE_APPLICATION_CREDENTIALS",
                "value": "..."
              }
            ],
  
            "ports": [
              {
                "containerPort": 8080,
                "protocol": "TCP"
              }
            ],
            "volumeMounts": [
              {
                "mountPath": "/secrets/cloudsql",
                "name": "[secrets-mount-name]",
                "readOnly": true
              }
            ]
          },
          {
            "command": [
              "/cloud_sql_proxy",
              "-instances=...",
              "-credential_file=..."
            ],
            "image": "gcr.io/cloudsql-docker/gce-proxy:1.11",
            "name": "...",
            "ports": [
              {
                "containerPort": 3306,
                "protocol": "TCP"
              }
            ],
            "volumeMounts": [
              {
                "mountPath": "/secrets/cloudsql",
                "name": "[secrets-mount-name]",
                "readOnly": true
              }
            ]
          }
        ],
        "volumes": [
          {
            "name": "[secrets-mount-name]",
            "secret": {
              "defaultMode": 420,
              "secretName": "[secrets-mount-name]"
            }
          }
        ]
      }
    }
  }
  </code></pre>