​
Overview

Follow the steps below to create a Cloud SQL instance with Private Service Connect (PSC) enabled within Google Cloud.

​
Create using Terraform

​
What’s Created

  • Necessary APIs enabled
  • VPC with firewall rule
  • Private Service Access (PSA) enabled with IP reserved
  • Cloud SQL PostgreSQL Instance with Private Service Connect (PSC) enabled

​
Prerequisites

Software Requirements:
  • Install Google Cloud CLI.
  • Install Terraform CLI.
  • Git (for cloning the repository).
GCP Account Requirements:

​
Step 1 - Clone Control Plane Terraform

git clone https://github.com/controlplane-com/gcp-psc-producer-automation
cd gcp-psc-producer-automation
  • This repository contains Terraform modules for provisioning GCP infrastructure that integrates with Control Plane via Private Service Connect.

​
Step 2 - Create Configuration File

  • Create a terraform.tfvars file in the root of the cloned repository.
    terraform.tfvars
    project_id   = "your-gcp-project-id"
region       = "us-central1"
db_username  = "postgres"
db_password  = "SecurePassword123!"

​
Step 3 - Deploy Infrastructure

  • Run the Terraform with your configuration:
terraform init
terraform plan
terraform apply
  • The Terraform will automatically provision all necessary resources and output your service attachment.
  • For more information, refer to the repository README
Follow Next Steps.

​
Create using the GCP Console

​
Prerequisites

  • Google Cloud Platform (GCP) account.
  • Install the latest Google Cloud CLI.
  • Existing GCP project
  • Enable the following APIs in your GCP project:
    • SQL Admin
    • Compute Engine
    • Service Networking

​
Step 1 - Create a VPC

  1. Navigate to VPC Networks and select Create VPC Network.
  2. Name the VPC, enable the necessary firewall rules for your intended use and click Create.
    A subnet is not required for PSC with Cloud SQL. Cloud SQL lives in Google’s managed data center and the VPC is only required for using a private IP, routing, and firewall rules.

​
Step 2 - Create Cloud SQL

  1. Navigate to SQL and select Create Instance.
  2. Choose your database engine (ex. PostgreSQL).
  3. Select your preferred SQL edition.
  4. Name your SQL instance and choose a secure password.
Ensure the region selected in the Cloud SQL matches the region in your Control Plane workload. If the regions are not the same, the Private Service Connection will fail.
  1. Scroll to the bottom of the page and click Show Configuration Options to drop down more options.
  2. Select the Connections tab, disable Public IP and enable Private IP.
  3. Enable Private Service Access (PSA)
    • Under Private IP, a drop down should appear to configure PSA.
    • Choose your VPC and select Set up connection.
    • You can allocate an IP range by either automatically allocating or by selecting your own range
    • Select Continue and Create Connection
  4. Once the connection is created you can create your instance
Private Service Connect enablement is not currently supported in the GCP console. After the instance is created, you must edit the Cloud SQL instance using the CLI.

​
Edit existing Cloud SQL Instance

The following steps will show how to enable Private Service Connect with the allowed consumer project for Control Plane in an existing Cloud SQL instance.

​
Prerequisites

  • Cloud SQL created with private IP only (no public IP)
  • Private Service Access (PSA) enabled with reserved IP (required when using private IP only)

​
Step 1 - Verify current project using the CLI

Ensure you are in the correct project before patching the Cloud SQL instance. 
gcloud config set project YOUR_PROJECT_ID

​
Step 2 - Patch the Cloud SQL instance

Use the gcloud CLI to edit the Cloud SQL instance. When patching the Cloud SQL instance, you must specify the allowed consumer project id(s) that will be used to consume the instance. Use the following gcloud command: 
gcloud sql instances patch INSTANCE_NAME \
--enable-private-service-connect \
--allowed-psc-projects=cpln-prod01
If you need to change the allowed consumer projects in the future, use the same command and omit the ---enable-private-service-connect flag.
Once patching is complete, your Cloud SQL instance will have PSC enabled with the necessary Control Plane project allowed to connect to your workload.
  • You can find your service attachment in the console under Connections for your Cloud SQL instance.

​
Next Steps

  • Contact support@controlplane.com with your service attachment and region.
  • Control Plane will use this to create the consumer-side endpoint connection.
    When using Cloud SQL, there is no manual required acceptance for new connections created by specified allowed consumer projects.
  • Proceed to follow the Native Networking Setup in Control Plane.