I'm trying to move my dynamic website and database from my own VM's to the Google cloud. For the DB, I'm using the Google Cloud SQL, and for the website I made a host under compute.
The problem is, I can't seem to connect to the DB from the VM using an internal IP address. Somehow my Cloud SQL DB only has an external IP address.
I also have phpMyAdmin running on a compute VM, this machine can also only connect to the external ip address (this works, but I'm guessing is not very secure)
What am I doing wrong? Must I use the app engine instead for my website? I've done the training exercise but, to be honest, I have no clue what I was doing.
CloudSQL does not currently support private networks. You either need to connect via external IP or use CloudSQL proxy.
In order to increase security make sure to connect via SSL when using external IP.
Related
There are already many questions about how to connect to an external MySQL database but they all focus on how to open a remote connection, which is simply fixed by enabling billing.
However none if these questions address how to open an exception in your MySQL database so that the GCP App engine can connect to it. Normally a static IP would do, except it seems static IPs are for Compute Instances VM.
It seems like the previous solution was using "Google Secure Data Connector", but it's been decommissioned.
I found something else on Google Cloud documentation that says:
Your App Engine app connects over the Internet using that external
service's public IP address.
However there is no further information and I have no idea if that address is static or ephemeral, but this documentation page seems to say the address will never be static and can not be assigned a static IP:
App Engine does not currently provide a way to map static IP addresses
to an application.
Has anyone ever succeeded? How did you set your exception on the external, non-GCP MySQL server?
AppEngine can connect to internet but with a pool of IP address. You can't define one and use always the same. If your Database has to authorize only one IP it's not yet supported.
However, you could cheat by plugging a serverless VPC Connector to your AppEngine and using a VM as proxy but the solution is ugly and I don't guaranty good response time, which is critical for a database...
I don't understand why I got inconsistent connection from my local MySQL Workbench to Google Cloud SQL.
Something, I can connect to my database the first time, sometimes, I need to try multiples times before getting a connection. Sadly, most of the time, it's not working.
Because I can rarely connect to the database, what kind of configuration can cause this problem?
Here's some infos:
My application hosted on Google Compute Engine don't have any connection problem.
My public IP (personnal computer) is added to the Authorised networks in my Google Cloud SQL instance. See: Enabling public IP and adding an authorized address
I have added a Firewall rules to allow port 3306 in Google Cloud VPC network
SSL is currently disable for the testing purpose
I followed these instructions: How to connect to your Cloud SQL instance database with MySQL Workbench
For the benefit of future readers, the result of the comments above was:
The problem was that the client was alternating between two possible external IP addresses. One had been authorized to access Google Cloud, and the other one had not been authorized.
Enable all client IP addresses to connect, and that should fix it.
I'm trying to establish a basic mysql connection from a google compute engine instance in one project to a google cloud sql instance (2nd generation) in a different project.
I've done this many times before without any problem. You simply add the ip address of the google compute instance to the list of authorized networks for the google cloud sql instance. This has always worked in the past but it is not working now.
The only thing that I can think of which is different about this situation is that I've recently been experimenting with using the cloudsql-proxy to establish a connection from a different gce instance to the same google cloud sql instance. Could this be the problem? Perhaps the google cloud sql instance is getting confused by having to support both connection mechanisms?
I just need the connection to work. Is there a work-around?
There isn't a problem using both modes of connectivity simultaneously.
The only thing I can think of is that you are accidentally using an ephemeral IP addresses for your VMs instead of static, which means the VM may have a different IP address than you expect (after a restart, for example).
If that's not the case, please send a mail to cloud-sql#google.com with a little bit more information (project and database name, project/name/ip of your VM) so that we can figure out what's going on in the backend.
The new Google Cloud SQL Engine creates its own VM instance to run a MySQL database, with an exposed public IP address. I was hoping that it would be possible to VPN into the Google Compute Cloud, then connect to the MySQL VM instance internally. Is this possible? The computer I am trying to connect from is a physical machine located outside of the cloud.
If it's not possible, what if I connect via VPN and use the public IP address to connect to the MySQL instance? Would it resolve to the internal network quickly and mimic the behavior of a local connection (no delay)? Or would it have the same performance as connected to the external IP address with no VPN in place?
Sorry, there's currently no VPN/private IP support for Cloud SQL. At the moment, you can use instance settings to control which IPs are allowed to connect. By default, the mysql server is locked down from all external connectivity.
Connecting through a VPN should not improve latency and may in fact hurt it depending on how things are setup. I would recommend doing your own test if that's something you wish to verify.
You can also use the Cloud SQL Proxy to connect externally which uses SSL certs to establish an SSL tunnel to MySQL.
I have just created cloud storage on google for mysql database.
I have added local IP address and server's IP address in authorization (under access control).
It's getting connected in mysql work bench in my local machine. But, it's not connecting with the website which is running on windows azure platform.
Which IP address am I supposed to use in access control?
Website is in basic package of azure.
This is a relatively non-trivial thing to achieve as the GCP services need to know about the public source IP of the Azure service. Azure's IP surface is pretty wide so you'd be unlikely to successfully connect the two. You'll be unlikely to be able use just a single source IP address.
You may be better off looking at a VPN connection out of an Azure VNet to your GCP environment.
To be honest, trying to build any form of performant web experience that hosts the web and data tiers in different public clouds is going to be extremely challenging.
Actually I resolved this issue by opening ticket in azure support.
They have outbound IP addresses range available online. We need to provide those IP addresses to third party access control.
I am sharing you that link here.
https://social.msdn.microsoft.com/Forums/azure/en-US/fd53afb7-14b8-41ca-bfcb-305bdeea413e/maintenance-notice-upcoming-changes-to-increase-capacity-for-outbound-network-calls?forum=windowsazurewebsitespreview
Choose those IP addresses which are associated with your website.