Cannot connect to Google Cloud SQL from Kubernetes Engine

Question

I have one Google Cloud SQL Second generation instance and one Google Kubernetes Engine cluster. The problem is that I cannot connect to the Cloud SQL with the Private IP. I have enabled Private IP in the Cloud SQL dashboard and assigned it to my VPC network. However, the container still can't connect.

Is it maybe related to peering routes? Do I need to create one?

PS. I followed this guide https://cloud.google.com/sql/docs/mysql/connect-kubernetes-engine

Result of gcloud container clusters describe:

$ gcloud container clusters describe sirodoht-32-fec8e2914780bf2c
addonsConfig:
  kubernetesDashboard:
    disabled: true
  networkPolicyConfig:
    disabled: true
clusterIpv4Cidr: 10.40.0.0/14
createTime: '2019-05-12T17:07:17+00:00'
currentMasterVersion: 1.12.7-gke.10
currentNodeCount: 6
currentNodeVersion: 1.11.8-gke.6
defaultMaxPodsConstraint:
  maxPodsPerNode: '110'
endpoint: <retracted ip>
initialClusterVersion: 1.11.8-gke.6
initialNodeCount: 1
instanceGroupUrls:
- https://www.googleapis.com/compute/v1/projects/sirodoht-32/zones/europe-west3-a/instanceGroupManagers/gke-sirodoht-32-fep8e29-pool-94e97802-grp
ipAllocationPolicy:
  clusterIpv4Cidr: 10.40.0.0/14
  clusterIpv4CidrBlock: 10.40.0.0/14
  clusterSecondaryRangeName: gke-sirodoht-32-fec8e2914780bf2c-pods-4439d109
  servicesIpv4Cidr: 10.170.0.0/20
  servicesIpv4CidrBlock: 10.170.0.0/20
  servicesSecondaryRangeName: gke-sirodoht-32-fec8e2914780bf2c-services-4439d109
  useIpAliases: true
labelFingerprint: a9dc16a7
legacyAbac: {}
location: europe-west3-a
locations:
- europe-west3-a
loggingService: logging.googleapis.com
maintenancePolicy:
  window:
    dailyMaintenanceWindow:
      duration: PT4H0M0S
      startTime: 00:00
masterAuth:
  clientCertificate: <retracted>
  clientKey: <retracted>
  clusterCaCertificate: <retracted>
monitoringService: monitoring.googleapis.com
name: sirodoht-32-fec8e2914780bf2c
network: compute-network-aaa8ff1ec6b52012
networkConfig:
  network: projects/sirodoht-32/global/networks/compute-network-aaa8ff1ec6b52012
  subnetwork: projects/sirodoht-32/regions/europe-west3/subnetworks/subnet-bb2c9eb79b29a825
nodeConfig:
  diskSizeGb: 100
  diskType: pd-standard
  imageType: COS
  machineType: n1-standard-4
  oauthScopes:
  - https://www.googleapis.com/auth/monitoring
  - https://www.googleapis.com/auth/devstorage.read_only
  - https://www.googleapis.com/auth/logging.write
  - https://www.googleapis.com/auth/service.management.readonly
  - https://www.googleapis.com/auth/servicecontrol
  - https://www.googleapis.com/auth/trace.append
  serviceAccount: default
nodePools:
- config:
    diskSizeGb: 100
    diskType: pd-standard
    imageType: COS
    machineType: n1-standard-4
    oauthScopes:
    - https://www.googleapis.com/auth/monitoring
    - https://www.googleapis.com/auth/devstorage.read_only
    - https://www.googleapis.com/auth/logging.write
    - https://www.googleapis.com/auth/service.management.readonly
    - https://www.googleapis.com/auth/servicecontrol
    - https://www.googleapis.com/auth/trace.append
    serviceAccount: default
  initialNodeCount: 6
  instanceGroupUrls:
  - https://www.googleapis.com/compute/v1/projects/sirodoht-32/zones/europe-west3-a/instanceGroupManagers/gke-sirodoht-32-fep8e29-pool-94e97802-grp
  management: {}
  maxPodsConstraint:
    maxPodsPerNode: '110'
  name: pool
  podIpv4CidrSize: 24
  selfLink: https://container.googleapis.com/v1/projects/sirodoht-32/zones/europe-west3-a/clusters/sirodoht-32-fec8e2914780bf2c/nodePools/pool
  status: RUNNING
  version: 1.11.8-gke.6
selfLink: https://container.googleapis.com/v1/projects/sirodoht-32/zones/europe-west3-a/clusters/sirodoht-32-fec8e2914780bf2c
servicesIpv4Cidr: 10.170.0.0/20
status: RUNNING
subnetwork: subnet-bb2c9eb79b29a825
zone: europe-west3-a

* - There is an upgrade available for your cluster(s).

To upgrade nodes to the latest available version, run
  $ gcloud container clusters upgrade sirodoht-32-fec8e2914780bf2c

It seems to not be able to find the hostname, the internal IP, specifically 10.6.1.9 — sirodoht
Yes, same region. No to the others. How do I give the proper role to GKE service account? — sirodoht
Can you edit the question with the output of gcloud container clusters describe <your_cluster_name>? — Andy Shinn

kurtisvg kurtisvg · Accepted Answer · 2019-06-21T19:49:13

Private IP's are only accessible by other resources on the same Virtual Private Cloud (VPC). Follow these instructions to setup a GKE cluster on the same VPC as your Cloud SQL instance.

For more information on the environment requirements for using Private IP on Cloud SQL, please see this page.

Cannot connect to Google Cloud SQL from Kubernetes Engine

1 Answers