This page shows you how to deploy a sample app on Google Kubernetes Engine (GKE) connected to a PostgreSQL instance using the Google Cloud console and a client application. The resources created in this quickstart typically cost less than one dollar (USD), assuming you complete the steps, including the clean up, in a timely manner.
Before you begin Note: The name you use for your project must be between 4 and 30 characters. When you type the name, the form suggests a project ID, which you can edit. The project ID must be between 6 and 30 characters, with a lowercase letter as the first character. You can use a dash, lowercase letter, or digit for the remaining characters, but the last character cannot be a dash.In the Google Cloud console, on the project selector page, select or create a Google Cloud project.
Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.Make sure that billing is enabled for your Google Cloud project.
In the Google Cloud console, on the project selector page, select or create a Google Cloud project.
Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.Make sure that billing is enabled for your Google Cloud project.
Click Enable APIs to enable the APIs required for this quickstart.
This enables the following APIs:
Click the following button to open Cloud Shell, which provides command-line access to your Google Cloud resources directly from the browser. Cloud Shell can be used to run the gcloud
commands presented throughout this quickstart.
Run the gcloud services enable
command as follows using Cloud Shell to enable the APIs required for this quickstart.:
gcloud services enable compute.googleapis.com sqladmin.googleapis.com \ container.googleapis.com artifactregistry.googleapis.com cloudbuild.googleapis.com
This command enables the following APIs:
In the Google Cloud console, go to the Cloud SQL Instances page.
quickstart-instance
for Instance ID.Click Create Instance and wait until the instance initializes and starts.
Before running the gcloud sql instances create
command as follows, replace DB_ROOT_PASSWORD with the password of your database user.
Optionally, modify the values for the following parameters:
us-central
is used. See the full list of regions.Run the gcloud sql instances create
command to create a Cloud SQL instance.
gcloud sql instances create quickstart-instance \ --database-version=POSTGRES_13 \ --cpu=1 \ --memory=4GB \ --region=us-central \ --root-password=DB_ROOT_PASSWORDPrivate IP Console Create an instance with a private IP address and SSL enabled
In the Google Cloud console, go to the Cloud SQL Instances page.
quickstart-instance
for Instance ID.Creating an instance with a private IP address only requires configuring private services access to enable connections from other Google Cloud services, such as GKE.
gcloud compute addresses create
command to allocate an IP range for a private services access connection:gcloud compute addresses create google-managed-services-default \ --global \ --purpose=VPC_PEERING \ --prefix-length=16 \ --description="peering range for Google" \ --network=default
gcloud services vpc-peerings connect
command to create the private services access connection:gcloud services vpc-peerings connect \ --service=servicenetworking.googleapis.com \ --ranges=google-managed-services-default \ --network=default
Before running the gcloud sql instances create
command to create an instance as follows, replace DB_ROOT_PASSWORD with the password of your database user.
Optionally, modify the values for the following parameters:
us-central1
is used. See the full list of regions.Run the gcloud sql instances create
command to create a Cloud SQL instance with a private IP address.
gcloud beta sql instances create quickstart-instance \ --database-version=POSTGRES_13 \ --cpu=1 \ --memory=4GB \ --region=us-central \ --root-password=DB_ROOT_PASSWORD \ --no-assign-ip \ --network=default
Run the gcloud sql instances patch
command to allow only SSL connections for the instance.
gcloud sql instances patch quickstart-instance --require-ssl
In the Google Cloud console, go to the Cloud SQL Instances page.
quickstart-instance
.quickstart-db
.Run the gcloud sql databases create
command to create a database.
gcloud sql databases create quickstart-db --instance=quickstart-instanceCreate a user Console
In the Google Cloud console, go to the Cloud SQL Instances page.
quickstart-user
Before running the command as follows, replace DB_PASS with a password for your database user. Make a note of this for use in a later step of this quickstart.
Run the gcloud sql users create
command to create the user.
gcloud sql users create quickstart-user \ --instance=quickstart-instance \ --password=DB_PASS
User name length limits are the same for Cloud SQL as for on-premises PostgreSQL.
Create a GKE cluster ConsoleIn the Google Cloud console, go to the Google Kubernetes Engine page.
gke-cloud-sql-quickstart
.Run the gcloud container clusters create-auto
command to create the cluster.
gcloud container clusters create-auto gke-cloud-sql-quickstart \ --region us-central1Clone a Cloud SQL sample app into Cloud Shell Editor
With a Cloud SQL instance, a database, and a GKE cluster, you can now clone and configure a sample application to connect to your Cloud SQL instance. The remaining steps in this quickstart require using the gcloud
and kubectl
command-line tools. Both tools are pre-installed in Cloud Shell.
Open in Cloud Shell
dialog, click Confirm to download the sample app code and open the sample app directory in Cloud Shell Editor.Open in Cloud Shell
dialog, click Confirm to download the sample app code and open the sample app directory in Cloud Shell Editor.Open in Cloud Shell
dialog, click Confirm to download the sample app code and open the sample app directory in Cloud Shell Editor.Open in Cloud Shell
dialog, click Confirm to download the sample app code and open the sample app directory in Cloud Shell Editor.Enable the GKE cluster you just created as the default cluster to be used for the remaining commands in this quickstart.
Run thegcloud container clusters get-credentials
command as follows to enable the GKE cluster.
gcloud container clusters get-credentials gke-cloud-sql-quickstart \ --region us-central1Set up a service account
Create and configure a Google Cloud service account to be used by GKE so that it has the
Cloud SQL Clientrole with permissions to connect to Cloud SQL.
gcloud iam service-accounts create
command as follows to create a new service account:
gcloud iam service-accounts create gke-quickstart-service-account \ --display-name="GKE Quickstart Service Account"
gcloud projects add-iam-policy-binding
command as follows to add the Cloud SQL Client role to the Google Cloud service account you just created. Replace YOUR_PROJECT_ID with the project ID.
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \ --member="serviceAccount:gke-quickstart-service-account@YOUR_PROJECT_ID.iam.gserviceaccount.com" \ --role="roles/cloudsql.client"
gcloud projects add-iam-policy-binding
command as follows to add the Log Writer role to the Google Cloud service account you just created. Replace YOUR_PROJECT_ID with the project ID.
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \ --member="serviceAccount:gke-quickstart-service-account@YOUR_PROJECT_ID.iam.gserviceaccount.com" \ --role="roles/logging.logWriter"
gcloud projects add-iam-policy-binding
command as follows to add the Artifact Registry Reader role to the service account. Replace YOUR_PROJECT_ID with the project ID.
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \ --member="serviceAccount:gke-quickstart-service-account@YOUR_PROJECT_ID.iam.gserviceaccount.com" \ --role="roles/artifactregistry.reader"
Create a Kubernetes service account configured to have access to Cloud SQL by binding it to the Google Cloud service account using
Workload Identity Federation for GKE.
service-account.yaml
file in Cloud Shell Editor. Replace <YOUR-KSA-NAME>
with ksa-cloud-sql
.kubectl apply
command as follows in Cloud Shell:
kubectl apply -f service-account.yaml
gcloud iam service-accounts add-iam-policy-binding
command as follows to enable IAM binding of the Google Cloud Service Account and the Kubernetes Service Account. Make the following replacements:
default
, which is the default namespace for clusters created in GKE.ksa-cloud-sql
.gcloud iam service-accounts add-iam-policy-binding \ --role="roles/iam.workloadIdentityUser" \ --member="serviceAccount:YOUR_PROJECT_ID.svc.id.goog[YOUR_K8S_NAMESPACE/YOUR_KSA_NAME]" \ gke-quickstart-service-account@YOUR_PROJECT_ID.iam.gserviceaccount.com
kubectl annotate
command as follows to annotate the Kubernetes Service Account with IAM binding. Make the following replacements:
ksa-cloud-sql
.kubectl annotate serviceaccount \ YOUR_KSA_NAME \ iam.gke.io/gcp-service-account=gke-quickstart-service-account@YOUR_PROJECT_ID.iam.gserviceaccount.com
Run the kubectl create secret generic
command as follows to create Kubernetes secrets for the database, user, and user password to be used by the sample app. The values of each secret are based on the values specified in the previous steps of this quickstart. Replace DB_PASS with the password of the quickstart-user
that you created in the previous Create a user quickstart step.
kubectl create secret generic gke-cloud-sql-secrets \ --from-literal=database=quickstart-db \ --from-literal=username=quickstart-user \ --from-literal=password=DB_PASSBuild the sample app Go
gcloud artifacts repositories create
command in Cloud Shell to create a repository in the Artifact Registry named gke-cloud-sql-repo in the same region as your cluster. Replace YOUR_PROJECT_ID with the project ID.
gcloud artifacts repositories create gke-cloud-sql-repo \ --project=YOUR_PROJECT_ID \ --repository-format=docker \ --location=us-central1 \ --description="GKE Quickstart sample app"
gcloud builds submit
command as follows in Cloud Shell to build a Docker container and publish it to Artifact Registry. Replace YOUR_PROJECT_ID with the project ID.
gcloud builds submit \ --tag us-central1-docker.pkg.dev/YOUR_PROJECT_ID/gke-cloud-sql-repo/gke-sql .
gcloud artifacts repositories create
command in Cloud Shell to create a repository in the Artifact Registry named gke-cloud-sql-repo in the same region as your cluster. Replace YOUR_PROJECT_ID with the project ID.
gcloud artifacts repositories create gke-cloud-sql-repo \ --project=YOUR_PROJECT_ID \ --repository-format=docker \ --location=us-central1 \ --description="GKE Quickstart sample app"
mvn
command as follows in Cloud Shell to build a Docker container and publish it to Artifact Registry. Replace YOUR_PROJECT_ID with the project ID.
mvn clean package com.google.cloud.tools:jib-maven-plugin:2.8.0:build \ -Dimage=us-central1-docker.pkg.dev/YOUR_PROJECT_ID/gke-cloud-sql-repo/gke-sql \ -DskipTests -Djib.to.credHelper=gcloud
gcloud artifacts repositories create
command in Cloud Shell to create a repository in the Artifact Registry named gke-cloud-sql-repo in the same region as your cluster. Replace YOUR_PROJECT_ID with the project ID.
gcloud artifacts repositories create gke-cloud-sql-repo \ --project=YOUR_PROJECT_ID \ --repository-format=docker \ --location=us-central1 \ --description="GKE Quickstart sample app"
gcloud builds submit
command as follows in Cloud Shell to build a Docker container and publish it to Artifact Registry. Replace YOUR_PROJECT_ID with the project ID.
gcloud builds submit \ --tag us-central1-docker.pkg.dev/YOUR_PROJECT_ID/gke-cloud-sql-repo/gke-sql .
gcloud artifacts repositories create
command in Cloud Shell to create a repository in the Artifact Registry named gke-cloud-sql-repo in the same region as your cluster. Replace YOUR_PROJECT_ID with the project ID.
gcloud artifacts repositories create gke-cloud-sql-repo \ --project=YOUR_PROJECT_ID \ --repository-format=docker \ --location=us-central1 \ --description="GKE Quickstart sample app"
gcloud builds submit
command as follows in Cloud Shell to build a Docker container and publish it to Artifact Registry. Replace YOUR_PROJECT_ID with the project ID.
gcloud builds submit \ --tag us-central1-docker.pkg.dev/YOUR_PROJECT_ID/gke-cloud-sql-repo/gke-sql .
With the sample app configuration in place, you can now deploy the sample app.
GoThe deployed sample app connects to your Cloud SQL instance using the Cloud SQL proxy running in a Kubernetes sidecar pattern. The sidecar pattern is accomplished by deploying a workload with an additional container that shares the same Kubernetes pod as the sample app's container.
gcloud sql instances describe
command:
gcloud sql instances describe quickstart-instance --format='value(connectionName)'
deployment.yaml
file in Cloud Shell Editor. Make the following replacements:
<YOUR_KSA_NAME>
with ksa-cloud-sql
.<LOCATION>
with us-central1
.<YOUR_PROJECT_ID>
with the project ID.<YOUR-DB-SECRET>
with gke-cloud-sql-secrets
.<INSTANCE_CONNECTION_NAME>
with the Cloud SQL instance connection name retrieved from the gcloud
command on the previous step. The format is project_id:region:instance_name. The instance connection name is also visible in the Cloud SQL instance Overview page.kubectl apply
command as follows in Cloud Shell to deploy the sample app:
kubectl apply -f deployment.yaml
kubectl apply
command as follows to add a load balancer in front of the deployment, so that you can access it through the internet:
kubectl apply -f service.yaml
kubectl get
command as follows to get the service details:
kubectl get services
The deployed sample app connects to your Cloud SQL instance using the Cloud SQL Java connector.
gcloud sql instances describe
command:
gcloud sql instances describe quickstart-instance --format='value(connectionName)'
deployment.yaml
file in Cloud Shell Editor. Make the following replacements:
<YOUR_KSA_NAME>
with ksa-cloud-sql
.<LOCATION>
with us-central1
.<YOUR_PROJECT_ID>
with the project ID.<YOUR-DB-SECRET>
with gke-cloud-sql-secrets
.<INSTANCE_CONNECTION_NAME>
with the Cloud SQL instance connection name retrieved from the gcloud
command on the previous step. The format is project_id:region:instance_name. The instance connection name is also visible in the Cloud SQL instance Overview page.kubectl apply
command as follows in Cloud Shell to deploy the sample app:
kubectl apply -f deployment.yaml
kubectl apply
command as follows to add a load balancer in front of the deployment, so that you can access it through the internet:
kubectl apply -f service.yaml
kubectl get
command as follows to get the service details:
kubectl get services
The deployed sample app connects to your Cloud SQL instance using the Cloud SQL proxy running in a Kubernetes sidecar pattern. The sidecar pattern is accomplished by deploying a workload with an additional container that shares the same Kubernetes pod as the sample app's container.
gcloud sql instances describe
command:
gcloud sql instances describe quickstart-instance --format='value(connectionName)'
deployment.yaml
file in Cloud Shell Editor. Make the following replacements:
<YOUR_KSA_NAME>
with ksa-cloud-sql
.<LOCATION>
with us-central1
.<YOUR_PROJECT_ID>
with the project ID.<YOUR-DB-SECRET>
with gke-cloud-sql-secrets
.<INSTANCE_CONNECTION_NAME>
with the Cloud SQL instance connection name retrieved from the gcloud
command on the previous step. The format is project_id:region:instance_name. The instance connection name is also visible in the Cloud SQL instance Overview page.kubectl apply
command as follows in Cloud Shell to deploy the sample app:
kubectl apply -f deployment.yaml
kubectl apply
command as follows to add a load balancer in front of the deployment, so that you can access it through the internet:
kubectl apply -f service.yaml
kubectl get
command as follows to get the service details:
kubectl get services
The deployed sample app connects to your Cloud SQL instance using the Cloud SQL proxy running in a Kubernetes sidecar pattern. The sidecar pattern is accomplished by deploying a workload with an additional container that shares the same Kubernetes pod as the sample app's container.
gcloud sql instances describe
command:
gcloud sql instances describe quickstart-instance --format='value(connectionName)'
deployment.yaml
file in Cloud Shell Editor. Make the following replacements:
<YOUR_KSA_NAME>
with ksa-cloud-sql
.<LOCATION>
with us-central1
.<YOUR_PROJECT_ID>
with the project ID.<YOUR-DB-SECRET>
with gke-cloud-sql-secrets
.<INSTANCE_CONNECTION_NAME>
with the Cloud SQL instance connection name retrieved from the gcloud
command on the previous step. The format is project_id:region:instance_name. The instance connection name is also visible in the Cloud SQL instance Overview page.kubectl apply
command as follows in Cloud Shell to deploy the sample app:
kubectl apply -f deployment.yaml
kubectl apply
command as follows to add a load balancer in front of the deployment, so that you can access it through the internet:
kubectl apply -f service.yaml
kubectl get
command as follows to get the service details:
kubectl get services
With the sample app configuration in place, you can now deploy the sample app.
GoThe deployed sample app connects to your Cloud SQL instance using the Cloud SQL proxy running in a Kubernetes sidecar pattern. The sidecar pattern is accomplished by deploying a workload with an additional container that shares the same Kubernetes pod as the sample app's container.
gcloud sql instances describe
command:
gcloud sql instances describe quickstart-instance --format='value(connectionName)'
deployment.yaml
file in Cloud Shell Editor. Make the following replacements and edits:
<YOUR_KSA_NAME>
with ksa-cloud-sql
.<LOCATION>
with us-central1
.<YOUR_PROJECT_ID>
with the project ID.<YOUR-DB-SECRET>
with gke-cloud-sql-secrets
.<INSTANCE_CONNECTION_NAME>
with the Cloud SQL instance connection name retrieved from the gcloud
command on the previous step. The format is project_id:region:instance_name. The instance connection name is also visible in the Cloud SQL instance Overview page."-ip_address_types=PRIVATE"
flag by removing the #
comment symbol and its trailing white space. The uncommented flag should look like this:
- "-ip_address_types=PRIVATE"
kubectl apply
command as follows in Cloud Shell to deploy the sample app:
kubectl apply -f deployment.yaml
kubectl apply
command as follows to add a load balancer in front of the deployment, so that you can access it through the internet:
kubectl apply -f service.yaml
kubectl get
command as follows to get the service details:
kubectl get services
The deployed sample app connects to your Cloud SQL instance using the Cloud SQL Java connector.
gcloud sql instances describe
command:
gcloud sql instances describe quickstart-instance --format='value(connectionName)'
deployment.yaml
file in Cloud Shell Editor. Make the following replacements:
<YOUR_KSA_NAME>
with ksa-cloud-sql
.<LOCATION>
with us-central1
.<YOUR_PROJECT_ID>
with the project ID.<YOUR-DB-SECRET>
with gke-cloud-sql-secrets
.<INSTANCE_CONNECTION_NAME>
with the Cloud SQL instance connection name retrieved from the gcloud
command on the previous step. The format is project_id:region:instance_name. The instance connection name is also visible in the Cloud SQL instance Overview page.kubectl apply
command as follows in Cloud Shell to deploy the sample app:
kubectl apply -f deployment.yaml
kubectl apply
command as follows to add a load balancer in front of the deployment, so that you can access it through the internet:
kubectl apply -f service.yaml
kubectl get
command as follows to get the service details:
kubectl get services
The deployed sample app connects to your Cloud SQL instance using the Cloud SQL proxy running in a Kubernetes sidecar pattern. The sidecar pattern is accomplished by deploying a workload with an additional container that shares the same Kubernetes pod as the sample app's container.
gcloud sql instances describe
command:
gcloud sql instances describe quickstart-instance --format='value(connectionName)'
deployment.yaml
file in Cloud Shell Editor. Make the following replacements and edits:
<YOUR_KSA_NAME>
with ksa-cloud-sql
.<LOCATION>
with us-central1
.<YOUR_PROJECT_ID>
with the project ID.<YOUR-DB-SECRET>
with gke-cloud-sql-secrets
.<INSTANCE_CONNECTION_NAME>
with the Cloud SQL instance connection name retrieved from the gcloud
command on the previous step. The format is project_id:region:instance_name. The instance connection name is also visible in the Cloud SQL instance Overview page."-ip_address_types=PRIVATE"
flag by removing the #
comment symbol and its trailing white space. The uncommented flag should look like this:
- "-ip_address_types=PRIVATE"
kubectl apply
command as follows in Cloud Shell to deploy the sample app:
kubectl apply -f deployment.yaml
kubectl apply
command as follows to add a load balancer in front of the deployment, so that you can access it through the internet:
kubectl apply -f service.yaml
kubectl get
command as follows to get the service details:
kubectl get services
The deployed sample app connects to your Cloud SQL instance using the Cloud SQL proxy running in a Kubernetes sidecar pattern. The sidecar pattern is accomplished by deploying a workload with an additional container that shares the same Kubernetes pod as the sample app's container.
gcloud sql instances describe
command:
gcloud sql instances describe quickstart-instance --format='value(connectionName)'
deployment.yaml
file in Cloud Shell Editor. Make the following replacements and edits:
<YOUR_KSA_NAME>
with ksa-cloud-sql
.<LOCATION>
with us-central1
.<YOUR_PROJECT_ID>
with the project ID.<YOUR-DB-SECRET>
with gke-cloud-sql-secrets
.<INSTANCE_CONNECTION_NAME>
with the Cloud SQL instance connection name retrieved from the gcloud
command on the previous step. The format is project_id:region:instance_name. The instance connection name is also visible in the Cloud SQL instance Overview page."-ip_address_types=PRIVATE"
flag by removing the #
comment symbol and its trailing white space. The uncommented flag should look like this:
- "-ip_address_types=PRIVATE"
kubectl apply
command as follows in Cloud Shell to deploy the sample app:
kubectl apply -f deployment.yaml
kubectl apply
command as follows to add a load balancer in front of the deployment, so that you can access it through the internet:
kubectl apply -f service.yaml
kubectl get
command as follows to get the service details:
kubectl get services
To avoid incurring charges to your Google Cloud account for the resources used on this page, follow these steps.
In the Google Cloud console, go to the Cloud SQL Instances page.
quickstart-instance
instance to open the Instance details page.quickstart-instance
, and then click Delete to delete the instance.In the Google Cloud console, go to the Google Kubernetes Engine page.
gke-cloud-sql-quickstart
service name.If you're not using the Google Cloud service account you created for this quickstart, you can remove it.
In the Google Cloud console, go to the IAM page.
gke-quickstart-service-account
.If you're not using the APIs that were enabled as part of this quickstart, you can disable them.
In the Google Cloud console, go to the APIs page.
Select any API that you would like to disable and then click the Disable API button.
You also can learn about creating PostgreSQL users and databases for your Cloud SQL instance.
Also see the Cloud SQL pricing information.
Learn more about:
Additionally, you can learn about connecting to a Cloud SQL instance from other Google Cloud applications:
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4