Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Using automatic PSC endpoint creation with Auth Proxy, backup recovery considerations

Aperta
  • Qualcosa non va?
#2,418 2 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@hessjcg ci sta già lavorando.

Dal 31/3/2025.

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

priority: p1 type: feature request
Question

Hi,

I am trying to use the CloudSQL Auth Proxy to connect to an existing private database instance that is in a different project to my consumer VPC. It is not possible to use Private Service Access (PSA) in this case (for the reasons described by @jackwotherspoon here) and I must use Private Service Connect (PSC).

Background

I have successfully used Private Service Connect (PSC) in my dev environment using the new "Create the endpoint automatically" approach, however I have some concerns about the implications this has on database backup restore operations. I'd like your advice on how to architect this.

My knowledge of CloudSQL backup restores is that it is bad practice to restore to the same instance you're running in production. The console warns not to do this in production:
Image

Based on this, my database disaster recovery playbooks involve creating a new database instance. However, when using PSC to connect to the database, this introduces operational complexities which are not fully alleviated by using the new "Create the endpoint automatically" approach.

PSA-only DB restores

If I were connecting to the database only via PSA, backup restores are trivial. I simply create a new instance, restore the backup, and change my CloudSQL Auth Proxy config to point to the new instance connection name.

PSC DB restores

It is not as simple as above when using PSC. I think it's best to explain with some architecture diagrams.

To start, here's how my architecture looks when using PSC with CloudSQL Auth Proxy:

Image

Suppose I need to do a database backup restore due to some data corruption in production. The way I would do this is by creating a new database instance and restoring the backup. The PSC Endpoint will be automatically created in my consumer project, as per my service connection policy.

Image

To complete the database backup restore, I need to:

  1. Create a new DNS A record from "recommended instance PSC DNS name" to the auto-created PSC endpoint's IP Address
  2. Switch the CloudSQL Auth Proxy instance connection name to new DB and deploy

This looks like this:

Image

Problem

The main problem is that this turns a database restore into a much more operationally complex procedure. Imagine being the on-call engineer that needs to do all of this at 2am, imagine if you didn't know anything about Private Service Connect. Additionally, this makes the potential downtime in this disaster much longer than necessary, which increases the likelihood we will miss our SLAs.

Really, what we need is a way to automate this DNS record creation following the automatic PSC creation. If this were the case, switching to the new instance would be as simple as before, as it just requires changing the instance connection name on the CloudSQL Auth Proxy.

Please can you check the following:

  1. Is there an alternative architecture where I do not have these challenges?
  2. Is there a way to automatically provision the DNS records too?
  3. Are there any planned features or feature requests to allow this?

This functionality means a lot to my company, and will give us tremendous value, but I am struggling with the practicalities right now.

Thank you in advance!

Lingua principale
Go
Stelle
1.4k
Fork
356
Merge medio
14h 48m
PR unite (30g)
8

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di GoogleCloudPlatform/cloud-sql-proxy

Tutte le issue di GoogleCloudPlatform/cloud-sql-proxy

Issue simili

Altre issue su Go

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.