Google Cloud SQLのインスタンスをprivate IPで扱う

プライベートIPアドレスを割り当てたGoogle Cloud SQLのインスタンスに，Google Cloud Runなどのサーバーレス環境からアクセスする方法を紹介します．

方法

Terraformのgoogle_sql_database_instance，google_compute_network，google_compute_global_address，google_service_networking_connectionを使います．

resource "google_compute_network" "private_network" {
  name = "private-network"
}

resource "google_compute_global_address" "private_ip_address" {
  name          = "private-ip-address"
  purpose       = "VPC_PEERING"
  address_type  = "INTERNAL"
  prefix_length = 16
  network       = google_compute_network.private_network.id
}

resource "google_service_networking_connection" "private_vpc_connection" {
  network                 = google_compute_network.private_network.id
  service                 = "servicenetworking.googleapis.com"
  reserved_peering_ranges = [google_compute_global_address.private_ip_address.name]
}

resource "google_sql_database_instance" "instance" {
  name   = "private-instance"
  depends_on = [google_service_networking_connection.private_vpc_connection]

  settings {
    tier = "db-f1-micro"
    ip_configuration {
      ipv4_enabled    = false
      private_network = google_compute_network.private_network.id
    }
  }
}

depends_onを明記しないとエラーになります．

https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/sql_database_instance#private-ip-instance

Cloud Runからアクセスするには以下のようにgoogle_vpc_access_connector*1を追加した上で，run.googleapis.com/vpc-access-connectorを設定します．

resource "google_vpc_access_connector" "vpc_connector" {
  name          = "vpc-connector"
  ip_cidr_range = "10.14.0.0/28"
  network       = google_compute_network.private_network.name
}

resource "google_cloud_run_service" "service" {
  name     = "service"
  template {
  }
  metadata {
      annotations = {
        "run.googleapis.com/vpc-access-connector" = google_vpc_access_connector.sql_connector.name
        "run.googleapis.com/vpc-access-egress"    = "private-ranges-only"
      }
    }
}

トラブルシューティング

Google Cloud PlatformのWebページでSQL > Connections > Networking > Private IP に，Private service connection required というエラーが出て，Cloud Runからデータベースにアクセスできないことがあります．

f:id:atsuhiro-me:20210331224401p:plain

これはgoogle_service_networking_connectionが正しく設定されていないことが原因ですので，上記の如くTerraformで作成するか，VPC netoworks > VPC network details > PRIVATE SERVICE CONNECTION tab > PRIVATE CONNECTIONS TO SERVICES tab > Create Connection より作成します．

f:id:atsuhiro-me:20210331224810p:plain