google-cloud-sql - 如何从 Cloud Run 安全地连接到 Cloud SQL？

Question

如何连接到 Cloud SQL 上的数据库，而无需在容器中添加我的凭据文件？

Answer 1

使用 UNIX 域套接字 (Java) 从云运行(完全托管)连接到云 SQL

At this time Cloud Run (fully managed) does not support connecting to the Cloud SQL instance using TCP. Your code should not try to access the instance using an IP address such as 127.0.0.1 or 172.17.0.1. link

1. Install and initialize the Cloud SDK

2.更新组件:

gcloud components update

3.新建项目

gcloud projects create run-to-sql
gcloud config set project run-to-sql
gcloud projects describe run-to-sql

4.启用计费

gcloud alpha billing projects link  run-to-sql --billing-account  XXXXXX-XXXXXX-XXXX

5.设置计算项目信息元数据:

gcloud compute project-info describe --project run-to-sql
gcloud compute project-info add-metadata --metadata google-compute-default-region=europe-west2,google-compute-default-zone=europe-west2-b

6.启用 Cloud SQL Admin API:

 gcloud services enable sqladmin.googleapis.com

7.创建一个公网IP的Cloud SQL实例

#Create the sql instance in the same region as App Engine Application
gcloud --project=run-to-sql beta sql instances create database-external --region=europe-west2
#Set the password for the "root@%" MySQL user:
gcloud sql users set-password root --host=% --instance database-external --password root 
#Create a user
gcloud sql users create user_name --host=% --instance=database-external  --password=user_password
#Create a database
gcloud sql databases create user_database --instance=database-external
gcloud sql databases list --instance=database-external
gcloud sql instances list

Cloud Run (fully managed) uses a service account to authorize your connections to Cloud SQL. This service account must have the correct IAM permissions to successfully connect. Unless otherwise configured, the default service account is in the format PROJECT_NUMBER-compute@developer.gserviceaccount.com.

8.确保您的服务的服务帐户具有以下 IAM 角色之一:Cloud SQL 客户端(首选)

gcloud iam service-accounts list
gcloud projects add-iam-policy-binding run-to-sql --member serviceAccount:PROJECT_NUMBER-compute@developer.gserviceaccount.com. --role roles/cloudsql.client

9.克隆 java-docs-repository

git clone https://github.com/GoogleCloudPlatform/java-docs-samples.git
cd java-docs-samples/cloud-sql/mysql/servlet/
ls
#Dockerfile  pom.xml  README.md  src

10.检查处理与 Cloud SQL 的连接的文件

 cat src/main/java/com/example/cloudsql/ConnectionPoolContextListener.java

11.将应用容器化并上传到 Container Registry

gcloud builds submit --tag gcr.io/run-to-sql/run-mysql

12.将服务部署到 Cloud Run

gcloud run deploy run-mysql --image gcr.io/run-to-sql/run-mysql

13.配置服务以与 Cloud Run 一起使用

gcloud run services update run-mysql --add-cloudsql-instances run-to-sql:europe-west2:database-external --set-env-vars CLOUD_SQL_CONNECTION_NAME=run-to-sql:europe-west2:database-external  DB_USER=user_name,DB_PASS=user_password,DB_NAME=user_database

14.测试一下

 curl -H "Authorization: Bearer $(gcloud auth print-identity-token)"   https://run-mysql-xxxxxxxx-xx.x.run.app

成功!