Connectivity between Cloud Run and Cloud SQL (Internal IP)

Question

I have created my organisation infrastructure in GCP following the Cloud Foundation Toolkit using the Terraform modules provided by Google.

The following table list the IP ranges for all environments:

Now I am in the process of deploying my application that consists of basically Cloud Run services and a Cloud SQL (Postgres) instance. The Cloud SQL instance was created with a private IP from the "unallocated" IP range that is reserved for peered services (such as Cloud SQL).

In order to establish connectivity between Cloud Run and Cloud SQL, I have also created the Serverless VPC Connector (ip range 10.1.0.16/28) and configured the Cloud SQL proxy.

When I try to connect to the database from the Cloud Run service I get this error after ~10s:

CloudSQL connection failed. Please see https://cloud.google.com/sql/docs/mysql/connect-run for additional details: Post "https://www.googleapis.com/sql/v1beta4/projects/[my-project]/instances/platform-db/createEphemeral?alt=json&prettyPrint=false": context deadline exceeded

I have granted roles/vpcaccess.user for both the default Cloud Run SA and the one used by the application in the host project.

I have granted roles/compute.networkUser for both SAs in the service project. I also granted roles/cloudsql.client for both SAs.

I have enabled servicenetworking.googleapis.com and vpcaccess.googleapis.com in the service project.

I have run out of ideas and I can't figure out what the issue is.

It seems like a timeout error when Cloud Run tries to create a POST request to the Cloud SQL API. So it seems like the VPC connector (10.1.0.16/28) cannot connect to the Cloud SQL instance (10.0.80.0/20).

Has anyone experienced this issue before?

question from:https://stackoverflow.com/questions/65839334/connectivity-between-cloud-run-and-cloud-sql-internal-ip

Answer 1

When you use the Cloud SQL built-in connexion in Cloud Run (but also App Engine and Cloud Function) a connexion similar to Cloud SQL proxy is created. This connexion can be achieved only on a Cloud SQL public IP, even if you have a serverless VPC connector and your database reachable through the VPC.

If you have only a private IP on Cloud SQL, you need to use the private IP to reach the database, not the built-in Cloud SQL connector. More detail in the documentation

I also wrote an article on this