> ## Documentation Index
> Fetch the complete documentation index at: https://docs.controlplane.com/llms.txt
> Use this file to discover all available pages before exploring further.

# PSC with Cloud SQL

> Create a Google Cloud SQL instance with Private Service Connect (PSC) for secure private connectivity to Control Plane workloads.

## Overview

Follow the steps below to create a [Cloud SQL](https://cloud.google.com/sql/docs/introduction) instance with [Private Service Connect](https://cloud.google.com/vpc/docs/private-service-connect) (PSC) enabled within Google Cloud.

## Create using Terraform

### What's Created

* Necessary APIs enabled
* VPC with firewall rule
* Private Service Access (PSA) enabled with IP reserved
* Cloud SQL PostgreSQL Instance with Private Service Connect (PSC) enabled

### Prerequisites

**Software Requirements:**

* Install Google Cloud [CLI](https://cloud.google.com/sdk/docs/install).
* Install Terraform [CLI](https://developer.hashicorp.com/terraform).
* [Git](https://git-scm.com/) (for cloning the repository).

**GCP Account Requirements:**

* [Google Cloud Platform (GCP)](https://cloud.google.com/) account with billing enabled.
* Deploy resources in the same region as your Control Plane [workload](/concepts/workload).

### Step 1 - Clone Control Plane Terraform

```bash theme={null}
git clone https://github.com/controlplane-com/gcp-psc-producer-automation
cd gcp-psc-producer-automation
```

* This [repository](https://github.com/controlplane-com/gcp-psc-producer-automation) contains Terraform modules for provisioning GCP infrastructure that integrates with Control Plane via Private Service Connect.

### Step 2 - Create Configuration File

* Create a `terraform.tfvars` file in the root of the cloned repository.
  ```hcl terraform.tfvars theme={null}
  project_id   = "your-gcp-project-id"
  region       = "us-central1"
  db_username  = "postgres"
  db_password  = "SecurePassword123!"
  ```

### Step 3 - Deploy Infrastructure

* Run the Terraform with your configuration:

```bash theme={null}
terraform init
terraform plan
terraform apply
```

* The Terraform will automatically provision all necessary resources and output your service attachment.

* For more information, refer to the [repository README](https://github.com/controlplane-com/gcp-psc-producer-automation?tab=readme-ov-file#readme)

Follow [Next Steps](/guides/native-networking/private-service-connect/cloud-sql#next-steps).

## Create using the GCP Console

### Prerequisites

* [Google Cloud Platform (GCP)](https://cloud.google.com/) account.
* Install the latest Google Cloud [CLI](https://cloud.google.com/sdk/docs/install).
* Existing GCP project
* Enable the following APIs in your GCP project:
  * `SQL Admin`
  * `Compute Engine`
  * `Service Networking`

### Step 1 - Create a VPC

1. Navigate to `VPC Networks` and select `Create VPC Network`.
2. Name the VPC, enable the necessary firewall rules for your intended use and click `Create`.
   <Note>A subnet is not required for PSC with Cloud SQL. Cloud SQL lives in Google's managed data center and the VPC is only required for using a private IP, routing, and firewall rules.</Note>

### Step 2 - Create Cloud SQL

1. Navigate to `SQL` and select `Create Instance`.
2. Choose your database engine (ex. PostgreSQL).
3. Select your preferred SQL edition.
4. Name your SQL instance and choose a secure password.

<Warning>
  Ensure the region selected in the Cloud SQL matches the region in your Control Plane [workload](/concepts/workload). If the regions are not the same, the Private Service Connection will fail.
</Warning>

5. Scroll to the bottom of the page and click `Show Configuration Options` to drop down more options.
6. Select the `Connections` tab, disable Public IP and enable Private IP.
7. Enable Private Service Access (PSA)
   * Under Private IP, a drop down should appear to configure PSA.
   * Choose your VPC and select `Set up connection`.
   * You can allocate an IP range by either automatically allocating or by selecting your own range
   * Select `Continue` and `Create Connection`
8. Once the connection is created you can create your instance

<Warning>
  Private Service Connect enablement is not currently supported in the GCP console. After the instance is created, you must [edit the Cloud SQL instance](/guides/native-networking/private-service-connect/cloud-sql#edit-existing-cloud-sql-instance) using the [CLI](https://cloud.google.com/sdk/docs/install).
</Warning>

## Edit existing Cloud SQL Instance

The following steps will show how to enable Private Service Connect with the allowed consumer project for Control Plane in an existing Cloud SQL instance.

### Prerequisites

* Cloud SQL created with private IP only (no public IP)
* Private Service Access (PSA) enabled with reserved IP (required when using private IP only)

### Step 1 - Verify current project using the CLI

Ensure you are in the correct project before patching the Cloud SQL instance.

```bash theme={null}
gcloud config set project YOUR_PROJECT_ID
```

### Step 2 - Patch the Cloud SQL instance

Use the `gcloud` CLI to edit the Cloud SQL instance. When patching the Cloud SQL instance, you must specify the allowed consumer project id(s) that will be used to consume the instance.

Use the following `gcloud` command:

```bash theme={null}
gcloud sql instances patch INSTANCE_NAME \
--enable-private-service-connect \
--allowed-psc-projects=cpln-prod01
```

<Tip>
  If you need to change the allowed consumer projects in the future, use the same command and omit the `---enable-private-service-connect` flag.
</Tip>

Once patching is complete, your Cloud SQL instance will have PSC enabled with the necessary Control Plane project allowed to connect to your [workload](/concepts/workload).

* You can find your service attachment in the console under `Connections` for your Cloud SQL instance.

## Next Steps

* Contact <a href="mailto:support@mintlify.com">[support@controlplane.com](mailto:support@controlplane.com)</a> with your service attachment and region.
* Control Plane will use this to create the consumer-side endpoint connection.
  <Note>
    When using Cloud SQL, there is no manual required acceptance for new connections created by specified allowed consumer projects.
  </Note>
* Proceed to follow the [Native Networking Setup](/guides/native-networking/native-networking-setup) in Control Plane.