Accessing Cloud SQL from another GCP project

9
votes

I want to connect to Cloud SQL from a different GCP project.

Cloud SQL is location in ProjectSQL and a VPC network is there in ProjectSQL project with name sql_vpc

There is another project ProjectDataflow and this has a vpc dataflow_vpc. I want to connect to cloudSQL from ProjectSQL with the VM launched in ProjectDataflow project

Things I have tried with success and failure.

Private ACCESS:

VPC Peering:

Enable Private IP access in Cloud with the vpc sql_vpc
Creating VPC peering between dataflow_vpc and sql_vpc
This solution does not work because you can not access the Peered Network.
https://cloud.google.com/sql/docs/mysql/private-ip
Status: FAILED

Shared Network

As per doc I can create the CloudSQL in shared VPC network, that says I 
have to create the CloudSQL in host project, and to access the Cloud 
SQL from  VM instance, it has be in the same network as of authorized 
private ip network of Cloud SQL
Status: NOT TRIED but looks to be Negative

Public Access:

Create a Cloud NAT in ProjectDataflow with dataflow_vpc with manual IP
Use the Cloud NAT public ip to whitelist in CloudSQL instance
Now I can access the CloudSQL from project ProjectDataflow using CloudSQL Public IP
STATUS: Success

Please share your experience accessing Cloud SQL from another project. Is there any best practice to connect cloud SQL from another gcp project?

1
google-cloud-platformgoogle-cloud-sqlgoogle-cloud-networking

1 Answers

7
votes

EDIT:

Newer instances seem to be having this option enabled by default and there's no need to contact support anymore. However, if after all the process, the setup is still not working, it may be needed to contact support.

IMPORTANT: The VPC peering option will not work anymore, as stated in the documentation, more precisely in the Considerations topic. Then the only available option to achieve it is using Shared VPCs

The process of interconnecting a Cloud SQL with another GCP project it is pretty straightforward following the documentation. The only thing you need to take into consideration in order to make it work is that you will have to request Google Cloud Support to enable custom routes for your Cloud SQL speckle umbrella instance in which your Cloud SQL is running under otherwise you won’t be able to access your Cloud SQL within your GCP project.

The following steps will work for you:

-Configuring VPC for Cloud SQL instance

Inside the project where you have your Cloud SQL instance, create a VPC network with the ip address range of your desire. Choose the same zone for the VPC in which your instance is located.

-Configuring VPC for GCP project

Now switch to the project where your CloudDataflow instance is located and follow the same process. Create the VPC network being careful that the IP ranges do not collide between each other. You can use the following tool to check if the IP addresses range collide. Also take into consideration that both VPC networks must be in the same zone.

-Connecting VPC of both projects with peering

Once both VPC networks are created it is needed to configure the VPC network peering from both projects. From the Cloud SQL instance side, configure the peering specifying the project and VPC network name to connect with and also select the option to export custom routes. This way the other part of the peering, in this case your GCP project, will have visibility of your Cloud SQL instance. Now, from the GCP project side, configure the peering specifying the Cloud SQL project name and the VPC network name to connect with. The same way we did with the Cloud SQL peering, we have to set up the peering to import custom routes as it will receive exported routes coming from the other side of the connection, which in our case is your Cloud SQL instance.

Here you can check more information about importing and exporting routes between any VPC network peerings.

-Request Google Cloud Support to enable for you the exchange custom routes for your Cloud SQL

Reach Google Cloud Support and ask them to enable the exchange of custom routes for your speckle-umbrella VPC network associated with your instance that is automatically created upon the Cloud SQL instance is created.

Take into consideration that this last step is very important, all SQL projects run under the umbrella project, hence without requesting Google Cloud Support to enable the exchange custom routes for your instance this will never work.

Shared VPC

As for Shared VPC, the only thing you need to take into consideration is that you need to enable the option once creating your Cloud SQL instance as you can’t add it afterwards.

You will find a configuration guide for Shared VPC in the following link.