Enable Cloud NAT in Project A and disable external IP addresses on the Dataflow worker.

Configure VPC Network Peering between Project A and Project B, then add a firewall rule permitting the peered subnet range to access all network instances.

Authorize the external IP addresses of the Dataflow worker in the Cloud SQL instance's network settings.

Establish VPC Network Peering between Project A and Project B. Deploy a Compute Engine instance in Project B on the peered subnet without an external IP to act as a proxy to the Cloud SQL database.