Cloud SQL

Cloud SQL is Google’s managed MySQL and PostgreSQL service. ZopDay creates the instance on a private IP inside your VPC and stores its admin login in Secret Manager. Databases for each application come later, through a separate database job.

What does a Cloud SQL job create

The job creates the network (only when you did not pick an existing VPC), then the firewall rule, then the instance. It waits for the instance to be ready and then stores the login. The examples below use a job called shop.

• A new network when you choose Create new VPC: shop-network, with a private subnet, a firewall rule for internal traffic, a Cloud Router and Cloud NAT. See GCP VPC networks built for cluster, VM and datastore jobs.
• Private services access on the VPC, if it is not there yet. This is a reserved /16 range named after the network (google-managed-services-shop-network) plus a service networking connection.
• A firewall rule, shop-datastore-allow, allowing TCP 3306, 5432 and 6379 from 10.0.0.0/8. That is the whole 10.x private block, wider than the default 10.0.0.0/16 VPC range.
• The Cloud SQL instance, always with a private IP on the VPC.
• A request for a default database named after the instance, with hyphens turned into underscores. ZopDay sends this request right after it asks Google to create the instance, and ignores a failure. Check that the database exists before you rely on it.
• A Secret Manager secret, zop-ds-shop, holding the endpoint (the private IP), port, username, password and database name.

The admin user is the engine’s built-in one: root on MySQL, postgres on PostgreSQL. ZopDay generates a 24-character password and sets it as the instance’s root password. ZopDay creates no read replicas, SSL certificates or extra users.

Which Cloud SQL editions, tiers and versions can you pick

Engine version       MYSQL_8_0 or MYSQL_5_7; POSTGRES_16, POSTGRES_15 or POSTGRES_14
Instance type        fixed list from db-f1-micro and db-g1-small (shared core, dev and test only)
                     to db-n1-standard-96, db-n1-highmem-96 and db-custom shapes; first entry preselected
Storage (GB)         20 by default, at least 32 for PostgreSQL; disk type PD_SSD
Edition              Enterprise (default) or Enterprise Plus
High Availability    off by default; on makes the instance REGIONAL instead of ZONAL
Public Access        off by default; on adds a public IPv4 address next to the private one
Deletion Protection  off by default
Automated Backups    shown on by default

The Provision screen does not send the backups setting today. Instances created from the screen always have backups on. The screen preselects db-f1-micro. If you create the instance through the ZopDay API and leave the instance type out, ZopDay uses db-custom-2-8192.

With backups on, PostgreSQL also gets point-in-time recovery, and MySQL gets binary logging. MySQL also gets binary logging when High Availability is on. Transaction logs are kept for 7 days on Enterprise and 35 days on Enterprise Plus.

How do clusters connect to a new Cloud SQL instance

ZopDay records the instance’s private IP as its address. To use the instance from a cluster, connect the instance to that cluster in ZopDay. The connection writes a Kubernetes secret in zop-system with DB_HOST, DB_PORT, DB_USER, DB_PASSWORD, DB_NAME, DB_DIALECT and DATABASE_URL.

A cluster on a different VPC gets a Private Service Connect endpoint in its own network instead of a peering. To add databases and users for each application, run a database job. See Adding Cloud SQL databases and scoped users.

What does deleting a Cloud SQL job remove

Deleting the job removes, in order:

• the Secret Manager secret;
• the instance;
• every firewall rule on the network whose name ends in -datastore-allow, including rules that belong to other databases or caches;
• the network, if ZopDay created it for this instance.

If deletion protection is on, the delete stops until you confirm its removal in the delete dialog. ZopDay takes no final backup, so export the data first if you need it.

Which Cloud SQL settings ZopDay leaves alone

ZopDay never changes the instance’s tier, storage or backup settings on its own after creation. Changes run only as update jobs you request. ZopDay does not create read replicas, set maintenance windows or database flags, or turn on IAM database authentication.