0

In the google cloud docs it is clearly stated that connectivity to Cloud SQL using private IP can be established across regions, however it's not what I see at the moment. private access was enabled, but I still cannot connect to the instance in the West1 region. Firewall rules are the same for both regions. Routes for peering networks are autocreated but have different descriptions:

  1. cloudsql-postgres-googleapis-com

  2. servicenetworking-googleapis-com

And have different corresponding next hops, which I didn't see stated anywhere in the docs as well. Can someone shed some light on this issue?

enter image description here

Firewalls out are enabled for all the destinations.

enter image description here

First one connects fine:

enter image description here

Second one timeouts (in a different region):

enter image description here

Reproduced the same behavior on the empty project with newly created VPC.

Update

I tried the experiment with other service which requires private service access: MemoryStore with Redis but for this services it is clearly stated that client must be in the same region as the instance to call it, so should I presume it is a typo in the Cloud Sql documentation?

enter image description here

MemoryStore doc:

enter image description here

Update

I found the contradiction in the google docs for Cloud SQL, the direct specific documentation for Cloud SQL and the generic documentation about private service access, can someone confirm which option is valid?

enter image description here

Here it says otherwise:

enter image description here

Link 1: https://cloud.google.com/vpc/docs/private-access-options#example

Link 2: https://cloud.google.com/sql/docs/mysql/private-ip#quick-reference

4
  • 1
    Is you cluster VPC native? please perform the following test Create a GCE VM on the zone West 3 in the same subnetwork as your Kube cluster and Cloud SQL instance and try to reach both instances, this is to discard issues with VPC and Cloud SQL – Jan Hernandez Sep 30 '20 at 15:26
  • Update the question: created vm same zone, create two cloud SQL instances, the issue persists. – Eddie Jamsession Sep 30 '20 at 17:21
  • Can you please provide the two document links, typically you will find a date at the end of the documents that will tell you the latest update. However I would like to confirm and let you know which statement is true. – Digil Oct 2 '20 at 18:13
  • Hi, added links – Eddie Jamsession Oct 2 '20 at 18:50
1

This document on private access options state that " VM instances in the customer's network can access service resources in any region if the service supports it. Some services might not support cross-region communication. For example, VM instances can only communicate with Cloud SQL instances that are in the same region. View the relevant service's documentation for more information."

Seems like it clear that all though accessing resources cross region is possible but its solely depends on specific Service, which implies that there are services that will not be access from different region. Seems like Cloud SQL is one such product.

The second link you have shared confirms it saying "You can connect through private IP across regions".

Just trying to see the contradiction here, but I don't see that. Documentation seems ok to me.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.