Connecting to DB in Private VPC

[anteecy]

Hello ~ I am writing a CI/CD pipeline to deploy a three-tier web app as specified on the GCP official docs: https://cloud.google.com/solutions/three-tier-web-app/ Basically, I have a Cloud SQL DB inside of a private VPC. There is also a VPC access connector for this VPC along with a global address for internal vpc peering.

I want to either create a pipeline or a service that can perform schema migrations on the DB. Is there a way for me to connect to the DB even if it is in a private VPC without spinning up a separate service? I know I could just run a Cloud Function that uses the vpc connector to connect to the DB and perform the migrations, but I would like to avoid infrastructure if possible.

Please let me know if any more details are necessary

[Marvin_Lucero]

Hi @anteecy ,

It seems there is no direct way for Cloud SQL database to be accessed using a VPN or VPC Peering. 

You can try using Cloud SQL Auth proxy to connect to the database from a VM on a different VPC.

- Create an allow firewall rule in Cloud SQL's database. Allow connections on SQL instance private IP (port 3307)
- Create a startup script that sets up Cloud SQL Auth proxy. Make sure to specify it on the metadata of the DB Bastion VM.
- Set a network tag of  db-bastion  to the instance.
- For the Terraform code, specify the Startup Script using the startup-script metadata field.

Once this is done, download the Cloud SQL Auth proxy binary to the VM. Create a Unix domain socket for the Cloud SQL Auth proxy to listen on.

Start the Cloud SQL Auth proxy and specify the Unix domain socket, the Cloud SQL instance connection name, and the Cloud SQL instance user and password. 

Note : The Cloud SQL Auth proxy can also be run using Docker.

I hope this helps.

[anteecy]

What about using Google Cloud Build with a private pool? Theoretically, I should be able to write a CI/CD pipeline that executes directly in the private VPC of my cloud sql database. That way I will be able to deploy sql migrations to my database from within the pipeline.

This to me sounds like a viable solution. Thoughts?