Hacker News Reader

Comment by simonmorley | Hacker News Reader

And still no private IPs?

Hey, I'm a software engineer on Cloud SQL.

We hear you. We know this is a problem. Unfortunately, there are non-trivial infrastructure changes that need to happen before we can make progress, but it's high on our list of priorities. Once we can make it happen, we will.

Right now, the proxy linked below is a good solution, particularity for Managed VMs.

It's also a shame you can't use their own firewall rules with CloudSQL, or even specify instance tags to allow traffic inbound to CloudSQL. You have to specify IP ranges (CIDR) for each of your hosts. Makes it near impossible to allow an auto-scaling group to access CloudSQL since you have no control over the public IP that will be assigned to a new host being spun up in the ASG.

It seems they approached the problem with a new solution: https://cloud.google.com/sql/docs/sql-proxy

,,The Cloud SQL Proxy provides secure access to your Cloud SQL Second Generation instances. ... It is especially useful when connecting from clients with dynamic IP address, such as Managed VM and Google Container Engine applications."

The proxy solution looks OK, shame it wasn't mentioned in the blog unless I'm blind.

Lack of private IPs has been the single reason why we've not moved our current dbs over. I'm sure it's hard but you're Google after all o_0

Pretty much the same situation for us, too.

I was really excited about the possibility of using Cloud SQL. Unfortunately, the lack of private IP whitelisting forces you to make some tradeoffs that don't make sense from the security perspective.

Reply on news.ycombinator.com