GCP: connect to CloudSQL instances via peering

Question

I want to interconnect three different projects with their own VPC's;

Project A; test-project
Project B; dev-project
Project C; vpn-project

Project A & B have their VPC's peered with project C. Project C also serves as a host for a shared VPC that's also attached to Project A & B. This Shared VPC has been created so that CloudSQL-instances can be accessed from the VPN project

After creating the shared VPC there were 2 CloudSQL instances created within project A & B, and you are able to contact those projects from Project C.

The problem is that there are also Compute Instances in Project A & B, but those servers are not part of the Shared VPC. I would like to connect those instances to the CloudSQL but that doesn't work at the moment. I've tried to create custom routes and import them, but without any luck.

How do I establish a connection between the compute instances and the Cloud SQL from an other project than their own?

guillaume blaquiere guillaume blaquiere · Accepted Answer · 2020-06-22T19:05:37

Directly in GCP, you can't. Just to explain you the problem. Firstly, its name: peering transitivity. (4th paragraph before the end of restrictions)

Then the rule: Project A -> Peering -> Project B -> Peering -> Project C

Resource into VPC of Project A can access to resource into VPC of Project B
Resource into VPC of Project B can access to resource into VPC of Project C
Resource into VPC of Project A can't access to resource into VPC of Project C

Now, I apply this to your context (you have to know that when you attach your Cloud SQL instance to your VPC, this a Peering connection):

Project A -> Peering -> Project C -> Peering -> Cloud SQL

With a shared VPC, no problem, because resources inside the Shared VPC are in the same VPC and the peering with the Cloud SQL is only 1 hop, not 2!.

How to solve

You have to set up a proxy in your shared VPC that forward the requests from outside the shared VPC to inside it. Like this, the hop is not manage by Google and you don't violate the peering transitivity rule.

Problem: you have to host, configure, manage, update, ensure the high availability of this proxy.

GCP: connect to CloudSQL instances via peering

1 Answers