Connect to Cloud SQL for PostgreSQL from Google Kubernetes Engine

MySQL | PostgreSQL | SQL Server

This page shows you how to deploy a sample app on Google Kubernetes Engine (GKE) connected to a PostgreSQL instance using the Google Cloud console and a client application. The resources created in this quickstart typically cost less than one dollar (USD), assuming you complete the steps, including the clean up, in a timely manner.

Before you begin

Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Go to project selector

Verify that you have the permissions required to complete this guide.

Verify that billing is enabled for your Google Cloud project.

Enable the Artifact Registry, Cloud Build, Cloud SQL Admin, Compute Engine, Kubernetes Engine, Service Networking APIs.

Roles required to enable APIs

To enable APIs, you need the serviceusage.services.enable permission. If you created the project, then you likely already have this permission through the Owner role (roles/owner). Otherwise, you can get this permission through the Service Usage Admin role (roles/serviceusage.serviceUsageAdmin). Learn how to grant roles.

Enable the APIs

Install the gcloud CLI.

Note: If you installed the gcloud CLI previously, make sure you have the latest version by running gcloud components update.

If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

To initialize the gcloud CLI, run the following command:

gcloud init

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Go to project selector

Verify that you have the permissions required to complete this guide.

Verify that billing is enabled for your Google Cloud project.

Enable the Artifact Registry, Cloud Build, Cloud SQL Admin, Compute Engine, Kubernetes Engine, Service Networking APIs.

Roles required to enable APIs

Enable the APIs

Install the gcloud CLI.

Note: If you installed the gcloud CLI previously, make sure you have the latest version by running gcloud components update.

If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

To initialize the gcloud CLI, run the following command:

gcloud init

Required roles

To get the permissions that you need to complete the tasks described in this quickstart, ask your administrator to grant you the following IAM roles on your quickstart project:

Create, update, or delete all Cloud SQL instances, databases, and users:
- Cloud SQL Admin (roles/cloudsql.admin)
- Compute Viewer (roles/compute.viewer)
Create a Cloud SQL instance with private IP (private services access connection): Compute Network Admin (roles/compute.networkadmin)
Create and manage a Google Kubernetes Engine cluster: Kubernetes Engine Admin (roles/container.admin)
Create and manage service accounts for the project:
- Project IAM Admin (roles/resourcemanager.projectIamAdmin)
- Service Account Admin (roles/serviceAccountAdmin)
Create a repository in Artifact Registry for the project: Artifact Registry Administrator (roles/artifactregistry.admin)
Submit and build applications in Cloud Build:
- Cloud Build Editor (roles/cloudbuilds.builds.editor)
- Storage Object Creator (roles/storage.objectCreator)
- Storage Bucket Viewer (roles/storage.bucketViewer)
- Service Account User (roles/iam.serviceAccountUser)
- Logs Viewer (roles/logging.viewer)

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

Set up Cloud SQL

Create a Cloud SQL instance

Public IP

Console

Create an instance with a public IP address

In the Google Cloud console, go to the Cloud SQL Instances page.

Go to Cloud SQL Instances
Click Create Instance.
Click PostgreSQL.
Enter quickstart-instance for Instance ID.
Enter a password for the postgres user. Save this password for future use.
Click the Single zone option for Choose region and zonal availability.
Click and expand the Show Configurations section.
Click and expand the Machine Configuration section:
1. In the Machine menu, select the machine series or type that you want to use, such as N2.
2. Select the vCPU and RAM that you want to use, such as 2 vCPU, 16 GB.
Click Create Instance and wait until the instance initializes and starts.

gcloud

Create an instance with a public IP address

Before running the gcloud sql instances create command as follows, replace DB_ROOT_PASSWORD with the password of your database user.

Optionally, modify the values for the following parameters:

--database_version: The database engine type and version. If left unspecified, the API default is used. See the gcloud database versions documentation to see the currently available versions.
--cpu: The number of cores desired in the machine.
--memory: Whole number value indicating how much memory is desired in the machine. A size unit should be provided (for example, 3072MB or 9GB). If no units are specified, GB is assumed.
--region: Regional location of the instance (for example asia-east1, us-east1). If left unspecified, the default us-central is used. See the full list of regions.

Run the gcloud sql instances create command to create a Cloud SQL instance.

gcloud sql instances create quickstart-instance \
--database-version=POSTGRES_13 \
--cpu=1 \
--memory=4GB \
--region=us-central \
--root-password=DB_ROOT_PASSWORD

Private IP

Console

Create an instance with a private IP address and SSL enabled

In the Google Cloud console, go to the Cloud SQL Instances page.

Go to Cloud SQL Instances
Click Create instance.
Click PostgreSQL.
Enter quickstart-instance for Instance ID.
Enter a password for the postgres user. Save this password for future use.
Click the Single zone option for Choose region and zonal availability.
Click and expand Show configuration options.
Click and expand the Machine Configuration section:
1. In the Machine menu, select the machine series or type that you want to use, such as N2.
2. Select the vCPU and RAM that you want to use, such as 2 vCPU, 16 GB.
In Connections, select Private IP.
Select default in the Network drop-down menu.
If you see a dialog stating Private services access connection required, click the Set Up Connection button.

In the Enable Service Networking API dialog, click the Enable API button.
In the Allocate an IP range dialog, select Use an automatically allocated IP range and click Continue.
In the Create a connection dialog, click Create Connection.

Clear the Public IP checkbox to create an instance only with a private IP.
Click Create instance and then wait for the instance to initialize and start.
Click Connections.
In the Security section, select Allow only SSL connections to enable SSL connections.
In the Allow only SSL connections dialog, click Save and then wait for the instance to restart.

gcloud

Create an instance with a private IP address and SSL enabled

Creating an instance with a private IP address only requires configuring private services access to enable connections from other Google Cloud services, such as GKE.

Run the gcloud compute addresses create command to allocate an IP range for a private services access connection:

gcloud compute addresses create google-managed-services-default \
--global \
--purpose=VPC_PEERING \
--prefix-length=16 \
--description="peering range for Google" \
--network=default

Run the gcloud services vpc-peerings connect command to create the private services access connection:

gcloud services vpc-peerings connect \
--service=servicenetworking.googleapis.com \
--ranges=google-managed-services-default \
--network=default

Before running the gcloud sql instances create command to create an instance as follows, replace DB_ROOT_PASSWORD with the password of your database user.

Optionally, modify the values for the following parameters:

--database_version: The database engine type and version. If left unspecified, the API default is used. See gcloud database versions for a list of currently available versions.
--cpu: The number of cores in the machine.
--memory: A whole number indicating how much memory to include in the machine. A size unit can be provided (for example, 3072MB or 9GB). If no units are specified, GB is assumed.
--region: The regional location of the instance (for example asia-east1, us-east1). If left unspecified, the default us-central1 is used. See the full list of regions.

Run the gcloud sql instances create command to create a Cloud SQL instance with a private IP address.

gcloud beta sql instances create quickstart-instance \
--database-version=POSTGRES_13 \
 --cpu=1 \
 --memory=4GB \
 --region=us-central \
 --root-password=DB_ROOT_PASSWORD \
 --no-assign-ip \
--network=default

Run the gcloud sql instances patch command to allow only SSL connections for the instance.

gcloud sql instances patch quickstart-instance --require-ssl

Create a database

Take the following steps to create a database:

Console

In the Google Cloud console, go to the Cloud SQL Instances page.

Go to Cloud SQL Instances
Select quickstart-instance.
From the SQL navigation menu, select Databases.