cloud-sql-proxy

That is very annoying. I remember having spent some time with this same issue in Google App Engine as well, which also runs Cloud SQL Proxy as a sidecar container. https://github.com/GoogleCloudPlatform/cloudsql-proxy/issues...

We have a web app on GCP CloudRun (GCP's container-as-a-service) and it talks to CloudSQL (GCP's managed Postgres). We noticed random 5xx occurring. Fortunately, we wrote defensive code that asserts on the correct invariant. This time we had a good Stacktrace and noticed the errors: tcp XXXX.X.X.X:XXXX->YYYY.Y.Y.Y:YYYY: read: connection reset by peer Where XXXX is the the IP address of our machine and YYYY is the IP address of CloudSql. We discovered this thread of other people experiencing this same issue with GCP CloudSQL. https://github.com/GoogleCloudPlatform/cloud-sql-proxy/issues/343 One particular comment on the thread stood out and rubbed me the wrong way: "Hey folks - commenting on a closed/stale issue is generally considered a bad practice." As indicated by the downvotes, I'm not alone. Having had to interact with GCP Dev

I wish they would reuse the pattern of Cloud SQL where you can get temporary access without manually handling the Authorized Networks setting. The Cloud SQL API lets you exchange your API access token for a short lived TLS client certificate. This is done client side by things like cloudsql-proxy[1] and the cloud-sql-jdbc-socket-factory java library[2]. This way, I can access my Cloud SQL instance from my IDE, even though my list of authorized networks is empty. I feel like the gke-gcloud-auth-plugin cloud do something very similar. [1]: https://github.com/GoogleCloudPlatform/cloudsql-proxy [2]: https://github.com/GoogleCloudPlatform/cloud-sql-jdbc-socket...

you already could connect to cloudsql instances. however you needed a proxy, but not because of AppEngine, you need it because of security. either you whitelisted your ips or you used the proxy (which go appengine could already use). so with go you just needed to use https://github.com/GoogleCloudPlatform/cloudsql-proxy which means you just need to change the query string. however a new feature is emerging where you can have a private ip that is connected to your internal services, however it is still a beta feature. Source: myself, but not a googler, just a regular user

Yes, it is wise to do that. If you don't want the overhead of running your own SQL instance, you definitely don't want the overhead of running it on kubernetes; it's quite tricky (but the addition of StatefulSets in 1.5 has made it easier). If you're running a CloudSQL instance, you can use a sidecar container to manage proxying the connection to the database: https://github.com/GoogleCloudPlatform/cloudsql-proxy "The Cloud SQL Proxy allows a user with the appropriate permissions to connect to a Second Generation Cloud SQL database without having to deal with IP whitelisting or SSL certificates manually."