Pros and Cons - Cloud SQL language specific connectors vs Cloud SQL Auth Proxy Binary form

[dheerajpanyam]

I would like to understand the pros and cons of choosing Cloud SQL language specific connectors (using client specific libraries) over the  binary  form .  In my opinion client specific libraries provide  a neat way of handling connections using code and more flexible compared to the binary which needs to deployed as a separate process (for example sidecar in case of GKE deployments) so there is operational overhead in choosing the latter. 

[robertcarlos]

Hi @dheerajpanyam,

Welcome to Google Cloud Community!

Here are the benefits for each connection options:

Benefits of Cloud SQL Language Connectors:

• IAM authorization: Uses identity and access management (IAM) permissions to control who or what can connect to your Cloud SQL instances.
• Convenience: Removes the requirement to manage SSL certificates, configure firewall rules, or enable authorized networks.

Benefits of the Cloud SQL Auth Proxy:

• Secure connections: The Cloud SQL Auth Proxy automatically encrypts traffic to and from the database using TLS 1.3 with a 256-bit AES cipher. SSL certificates are used to verify client and server identities, and are independent of database protocols; you won't need to manage SSL certificates.
• Easier connection authorization: The Cloud SQL Auth Proxy uses IAM permissions to control who and what can connect to your Cloud SQL instances. Thus, the Cloud SQL Auth Proxy handles authentication with Cloud SQL, removing the need to provide static IP addresses.
• IAM database authentication. Optionally, the Cloud SQL Auth Proxy supports an automatic refresh of OAuth 2.0 access tokens. For information about this functionality, see Cloud SQL IAM database authentication.

You may check the following documentations for each connector:

• Cloud SQL Language Connectors overview 
• About the Cloud SQL Auth Proxy 

You can also check other means of connecting to your Cloud SQL instance.

Hope this helps.

[dheerajpanyam]

Thanks @robertcarlos  I don't see much difference. Both support secure SSL connections and use IAM based authorization. My point of view is that cloud sql auth proxy requires an operational overhead / DevOps team while the connector is entirely dev focussed.

[robertcarlos]

Hi @dheerajpanyam,

Both works similarly however the basic difference would be convenience. Cloud SQL Language Connectors doesn't require any additional complex network setup while Cloud SQL Auth proxy is more secured as it requires certificate and encryption to verify clients.

[dheerajpanyam]

Thanks @robertcarlos . One last question before i accept the solution.

1. Are both methods designed for production usecases or is there any preference of one over the other?

2. Does language connectors option work with most of the services like GKE, Cloud Run, Cloud Functions etc?

[robertcarlos]

To address your questions @dheerajpanyam,

1. Both can be used on your preferred programming language (Java, Python, Go, Nodejs) however some Google Cloud services (App Engine, Cloud Functions, Cloud Run) use Cloud SQL Auth Proxy to provide connections for public IP paths for encryption and autorization to make it more secure.
2. Cloud SQL Language connectors only applies when using IAM and Cloud SQL instance since this works within Cloud SQL only. If you want to access it externally, either via IP or other Google Cloud services, it is recommended to use Cloud SQL Auth Proxy. You can check this documentation on connecting to to other Google Cloud services.

Hope this helps.

[dheerajpanyam]

Sorry this is getting more confusing. My usecase is connecting to Cloud SQL  instance from Cloud Run via private IP since this has low latency versus public IP. Is this something that Cloud SQL language connector can fulfill or do i need to use the Cloud SQL Auth Proxy? I don't understand this  line from link you shared "Cloud SQL recommends using the Cloud SQL Language Connectors to connect to your Cloud SQL instance over other connection options"

[robertcarlos]

I only mentioned that this is recommended as this is more secured. You can still use Cloud SQL Connector if that's your preference as it is easier to use. It would still depend on your setup and which connector would be more beneficial for your setup. Both have their benefits so you can choose whichever fits your needs.

Hope this helps.

[dheerajpanyam · Accepted solution]

Thanks @robertcarlos I don't want to bother you anymore but from what i understood Cloud SQL Language connectors also provide secure SSL connections similar to Auth Proxy. I just it is more of a convenience choice.

[robatbross]

i also faced this problem in my website please resolve my issue 

[dheerajpanyam]

What problem did you face specifically @robatbross ?

[dheerajpanyam]

@robertcarlos  Are  Cloud SQL language connectors  ====  Cloud SQL Auth proxy?