Connecting to Cloud SQL with Private IP from GCE or GKE

Question

I'm trying to connect to a Postgres database (CloudSQL) from a pod deployed in a GoogleCompute cluster, with a private IP, but I get only connection timeout errors.

I setup the GCP cluster with the following:

gcloud beta container clusters create "gcp-cluster" --zone "europe-west1-b" --no-enable-basic-auth --cluster-version "1.13.6-gke.13" --machine-type "n1-standard-1" --image-type "COS" --disk-type "pd-ssd" --disk-size "20" --metadata disable-legacy-endpoints=true --scopes "https://www.googleapis.com/auth/devstorage.read_only","https://www.googleapis.com/auth/logging.write","https://www.googleapis.com/auth/monitoring","https://www.googleapis.com/auth/servicecontrol","https://www.googleapis.com/auth/service.management.readonly","https://www.googleapis.com/auth/trace.append","https://www.googleapis.com/auth/sqlservice.admin","https://www.googleapis.com/auth/sqlservice" --num-nodes "2" --enable-stackdriver-kubernetes --enable-ip-alias --network "projects/XXX/global/networks/default" --subnetwork "projects/XXX/regions/europe-west1/subnetworks/default" --default-max-pods-per-node "110" --enable-autoscaling --min-nodes "2" --max-nodes "20" --addons HorizontalPodAutoscaling,HttpLoadBalancing --enable-autoupgrade --enable-autorepair --maintenance-window "19:00"

Then I deployed a wildfly pointing to the postgres database IP address (DB created in the same zone/region), but I get only connection timeout. After have enabled a public IP address with source 0.0.0.0/0, I can get a connection.

Any idea to work with private IP address?

Answer 1

Private IP means accessing Cloud SQL through a Virtual Private Cloud (VPC). You have to use a resource (in this case, GCE instance) that is also on that VPC to be able to reach it. See the environment requirements page of the Private IP docs.

Note for future readers: It's a really bad idea to whitelist 0.0.0.0/0 on a Public IP address. This essentially allows the entire internet to attempt to connect to your instance, and should not be left enabled for any extended period of time.

Answer 2

Your gke cluster is in europe-west1-b. Assuming that you use the default network, you must enable Private Google Access for europe-west1 subnet. Click on the subnet to view details and edit it if required to set Private Google Access to "On".

Answer 3

After a couple of hours I got my connection by enabling CloudSql access scope for the VM instances.