PSC with Cloud SQL

​

Overview

​

Create using Terraform

​

What’s Created

• Necessary APIs enabled
• VPC with firewall rule
• Private Service Access (PSA) enabled with IP reserved
• Cloud SQL PostgreSQL Instance with Private Service Connect (PSC) enabled

​

Prerequisites

• Install Google Cloud CLI.
• Install Terraform CLI.
• Git (for cloning the repository).

• Google Cloud Platform (GCP) account with billing enabled.
• Deploy resources in the same region as your Control Plane workload.

​

Step 1 - Clone Control Plane Terraform

git clone https://github.com/controlplane-com/gcp-psc-producer-automation
cd gcp-psc-producer-automation

• This repository contains Terraform modules for provisioning GCP infrastructure that integrates with Control Plane via Private Service Connect.

​

Step 2 - Create Configuration File

• Create a terraform.tfvars file in the root of the cloned repository.
  terraform.tfvars

  project_id   = "your-gcp-project-id"
  region       = "us-central1"
  db_username  = "postgres"
  db_password  = "SecurePassword123!"
  

​

Step 3 - Deploy Infrastructure

• Run the Terraform with your configuration:

terraform init
terraform plan
terraform apply

• The Terraform will automatically provision all necessary resources and output your service attachment.
• For more information, refer to the repository README

​

Create using the GCP Console

​

Prerequisites

• Google Cloud Platform (GCP) account.
• Install the latest Google Cloud CLI.
• Existing GCP project
• Enable the following APIs in your GCP project:
  • SQL Admin
  • Compute Engine
  • Service Networking

​

Step 1 - Create a VPC

1. Navigate to VPC Networks and select Create VPC Network.
2. Name the VPC, enable the necessary firewall rules for your intended use and click Create.
   A subnet is not required for PSC with Cloud SQL. Cloud SQL lives in Google’s managed data center and the VPC is only required for using a private IP, routing, and firewall rules.

​

Step 2 - Create Cloud SQL

1. Navigate to SQL and select Create Instance.
2. Choose your database engine (ex. PostgreSQL).
3. Select your preferred SQL edition.
4. Name your SQL instance and choose a secure password.

5. Scroll to the bottom of the page and click Show Configuration Options to drop down more options.
6. Select the Connections tab, disable Public IP and enable Private IP.
7. Enable Private Service Access (PSA)
   • Under Private IP, a drop down should appear to configure PSA.
   • Choose your VPC and select Set up connection.
   • You can allocate an IP range by either automatically allocating or by selecting your own range
   • Select Continue and Create Connection
8. Once the connection is created you can create your instance

​

Edit existing Cloud SQL Instance

​

Prerequisites

• Cloud SQL created with private IP only (no public IP)
• Private Service Access (PSA) enabled with reserved IP (required when using private IP only)

​

Step 1 - Verify current project using the CLI

gcloud config set project YOUR_PROJECT_ID

​

Step 2 - Patch the Cloud SQL instance

gcloud sql instances patch INSTANCE_NAME \
--enable-private-service-connect \
--allowed-psc-projects=cpln-prod01

• You can find your service attachment in the console under Connections for your Cloud SQL instance.

​

Next Steps

• Contact support@controlplane.com with your service attachment and region.
• Control Plane will use this to create the consumer-side endpoint connection.
  When using Cloud SQL, there is no manual required acceptance for new connections created by specified allowed consumer projects.
• Proceed to follow the Native Networking Setup in Control Plane.