connect securely to a 2nd generation Cloud SQL DB

 The Cloud SQL Proxy allows a user with the appropriate permissions to
 connect to a Second Generation Google Cloud SQL database without having
 to deal with IP whitelisting or SSL certificates manually. It works by
 opening unix/tcp sockets on the local machine and proxying
 connections to the associated Cloud SQL instances when the sockets
 are used.
 .
 Optional functionality can be enabled (--fuse) with access to `/dev/fuse`
 as well as the `fusermount` binary.
 .
 By default, the proxy will authenticate under the default service account
 of the Compute Engine VM it is running on. Therefore, the VM must have at
 least the sqlservice.admin API scope
 ("https://www.googleapis.com/auth/sqlservice.admin")
 and the associated project must have the SQL Admin API enabled. The default
 service account must also have at least WRITER/EDITOR privileges to any
 projects of target SQL instances.