GKE with Cloud SQl

• Overview
  
• Steps
  • Create a cloud sql instance with postgres db.
  • Ensure the cloud sql admin api is enabled
    gcloud services enable sqladmin.googleapis.com
  • Create a GKE autopilot cluster
    gcloud container clusters create-auto my-gke-cluster --network=default --region=us-central1
  • Grant permissions to connect to cloud sql: Create a k8s service account and bind it to GKE workloads, granting it permissions to access Cloud SQL. Grant the roles/cloudsql.client
    gcloud projects add-iam-policy-binding [PROJECT_ID] \
--member=serviceaccount:[KSA_EMAIL] \
--role=roles/cloudsql.client
  • Connect GKE Autopilot to Cloud SQL
    • Create a k8s secret for DB credentials
      kubectl create secret generic lib-db-credentials \
--from-literal=DATABASE_URL=postgresql://user:password@<cloudsql>:5432/library
    • Install the cloud sql auth proxy
      “`yaml

    </ul>
    <hr />
    apiVersion: apps/v1
    kind: Deployment
    metadata:
    name: myapp
    spec:
    selector:
    matchLabels:
    app: myapp
    template:
    metadata:
    labels:
    app: myapp
    spec:
    containers:
    – name: myapp
    image: shaikkhajaibrahim/libapp:1
    resources:
    limits:
    memory: "256Mi"
    cpu: "500m"
    env:
    – name: DATABASE_URL
    valueFrom:
    secretKeyRef:
    name: lib-db-credentials
    key: DATABASE_URL
    ports:
    – containerPort: 8000
    – name: cloud-sql-proxy
    image: gcr.io/cloudsql-docker/gce-proxy:1.29.0
    command: ["/cloud_sql_proxy", "–dir=/cloudsql",
    "-instances=<PROJECT_ID>:<REGION>:<INSTANCE_NAME>=tcp:5432",
    "-credential_file=/secrets/cloudsql/credentials.json"]
    “`
    * Deploy the app

  ---

  Managing Sensitive Information in Secrets Manager

  • Create a Secret
    • Navigate to secrets manager
    • Create a secret i.e. name your secret (DATABSE Password) and add secret value
  • Ensure GKE Service account has right permission (roles/secretmanager.secretAccessor) to access the secret

  gcloud projects add-iam-policy-binding [PROJECT_ID] \
      --member="serviceaccount:[GKE_SERVICE_ACCOUNT]" \
      --role=roles/secretmanager.secretAccessor
  

  • Enable Workload identity on GKE

  gcloud cluster update [CLUSTER_NAME] \
    --workload-pool=[PROJECT_ID].svc.id.goog
  

  • Create a k8s service account

  kubectl create serviceaccount [KSA_NAME]
  

  • Grant the KSA access to the GCP service

  gcloud iam service-accounts add-iam-policy-binding \
      [GSA_NAME]@{PROJECT_ID}.iam.gserviceaccount.com \
      --role roles/iam.workloadIdentityUser \
      --member "serviceAccount:${PROJECT_ID}.svc.id.goog[default/${KSA_NAME}]
  

  • Annotate the KSA with the GSA

  kubectl annotate serviceaccount [KSA_NAME] \
    iam.gke.io/gcp-service-acount=[GSA]
  

  • Now to get secrets we have two options
    • FROM gcloud-sideecar
    • Sync secrets with k8s secrets using CSI Driver

  Share this:

  • X
  • Facebook
  • WhatsApp

  Like this:

  Like Loading...