I got to this post trying to make pt-show-grants work with Google Cloud Platform (GCP) CloudSQL. Leaving a trace of the fix here:
SSL_DSN=“;mysql_ssl=1”
SSL_DSN=“$SSL_DSN;mysql_ssl_client_key=$(pwd)/client-key.pem”
SSL_DSN=“$SSL_DSN;mysql_ssl_client_cert=$(pwd)/client-cert.pem”
SSL_DSN=“$SSL_DSN;mysql_ssl_ca_file=$(pwd)/server-ca.pem”
pt-show-grants -F $(pwd)/.my.cnf $SSL_DSN