#vpcnetwork

Cloud SQL Auth Proxy

In this blog they will explain how to utilise the Cloud SQL Auth Proxy to create safe, encrypted data, and authorised connections to your instances. To connect to Cloud SQL from the App Engine standard environment or App Engine flexible environment, you do not need to configure SSL or use the Cloud SQL Auth Proxy.

The Cloud SQL Auth Proxy’s advantages

Without requiring authorised networks or SSL configuration, the Cloud SQL Auth Proxy is a Cloud SQL connection that offers secure access to your instances.

The following are some advantages of the Cloud SQL Auth Proxy and other Cloud SQL Connectors:

Secure connections:

TLS 1.3 with a 256-bit AES cypher is automatically used by this to encrypt traffic to and from the database. You won’t need to administer SSL certificates because they are used to validate the identities of clients and servers and are not dependent on database protocols.

Simpler authorization of connections:

IAM permissions are used by the Cloud SQL Auth Proxy to restrict who and what can connect to your Cloud SQL instances. Therefore, there is no need to supply static IP addresses because it manages authentication with Cloud SQL.

It depends on the IP connectivity that already exists; it does not offer a new way for connecting. The Cloud SQL Auth Proxy needs to be on a resource that has access to the same VPC network as the Cloud SQL instance in order to connect to it via private IP.

The operation of the Cloud SQL Auth Proxy

A local client that is operating in the local environment is required for the Cloud SQL Auth Proxy to function. Your application uses the common database protocol that your database uses to connect with the Cloud SQL Auth Proxy.

It communicates with its server-side partner process through a secure channel. One connection to the Cloud SQL instance is made for each connection made via the Cloud SQL Auth Proxy.

An application that connects to Cloud SQL Auth Proxy first determines if it can establish a connection to the target Cloud SQL instance. In the event that a connection is not established, it makes use of the Cloud SQL Admin APIs to acquire an ephemeral SSL certificate and connects to Cloud SQL using it. The expiration date of ephemeral SSL certificates is around one hour. These certificates are refreshed by Cloud SQL Auth Proxy prior to their expiration.

The only port on which the Cloud SQL Auth Proxy establishes outgoing or egress connections to your Cloud SQL instance is 3307. All egress TCP connections on port 443 must be permitted since Cloud SQL Auth Proxy uses the domain name sqladmin.googleapis.com to use APIs, which does not have a stable IP address. Make that your client computer’s outbound firewall policy permits outgoing connections to port 3307 on the IP address of your Cloud SQL instance.

Although it doesn’t offer connection pooling, it can be used in conjunction with other connection pools to boost productivity.

The connection between Cloud SQL Auth Proxy and Cloud SQL is depicted in the following diagram:

image credit to Google cloud

Use of the Cloud SQL Auth Proxy Requirements

The following conditions must be fulfilled in order for you to use the Cloud SQL Auth Proxy:

Enabling the Cloud SQL Admin API is necessary.

It is necessary to supply Google Cloud authentication credentials to this.

You need to supply a working database user account and password to this proxy.

The instance needs to be set up to use private IP or have a public IPv4 address.

It is not necessary for the public IP address to be added as an approved network address, nor does it need to be reachable from any external address.

Options for starting Cloud SQL Auth Proxy

You give the following details when you launch it:

Which Cloud SQL instances to connect to so that it can wait to receive data from your application that is sent to Cloud SQL

Where can it locate the login credentials needed to validate your application with Cloud SQL?

Which type of IP address to use, if necessary.

Whether it will listen on a TCP port or a Unix socket depends on the startup parameters you supply. It creates the socket at the specified location, which is often the /cloudsql/ directory, if it is listening on a Unix socket. The Cloud SQL Auth Proxy by default listens on localhost for TCP.

For authentication, use a service account

To authorise your connections to a Cloud SQL instance, you must authenticate as a Cloud SQL IAM identity using this Proxy.

For this purpose, the benefit of using a service account is that you may make a credential file particularly for the Cloud SQL Auth Proxy, and as long as it approach for production instances that aren’t operating on a Compute Engine instance is to use a service account

In the event that you require this to be invoked from several computers, you can replicate the credential file within a system image.

You have to make and maintain the credential file in order to use this method. The service account can only be created by users who possess the resourcemanager.projects.setIamPolicy permission, which includes project owners. You will need to get someone else to create the service account or find another way to authenticate this, if your Google Cloud user does not have this permission.

VPC Management

An examination of the IaC features of the edge VPC using deployable architecture on IBM Cloud. Many organizations now find themselves forced to create a secure and customizable virtual private cloud (VPC) environment within a single region due to the constantly changing nature of cloud infrastructure. This need is met by the VPC landing zone deployable architectures, which provide a collection of initial templates that may be easily customized to meet your unique needs.

Utilizing Infrastructure as Code (IaC) concepts, the VPC Landing Zone deployable architecture enables you to describe your infrastructure in code and automate its deployment. This method facilitates updating and managing your edge VPC setup while also encouraging uniformity across deployments.

The adaptability of the VPC Landing Zone is one of its main advantages. The starting templates are simply customizable to meet the unique requirements of your organisation. This can entail making changes to security and network setups as well as adding more resources like load balancers or block volumes. You may immediately get started with the following patterns, which are starter templates.

Edge VPC setup

Pattern of landing zone VPCs: Installs a basic IBM Cloud VPC architecture devoid of any computational resources, such as Red Hat OpenShift clusters or VSIs.

QuickStart virtual server instances (VSI) pattern: In the management VPC, a jump server VSI is deployed alongside an edge VPC with one VSI.

QuickStart ROKS pattern: One ROKS cluster with two worker nodes is deployed in a workload VPC using the Quick Start ROKS pattern.

Virtual server (VSI) pattern: In every VPC, deploys the same virtual servers over the VSI subnet layer.

Red Hat Open Shift pattern: Every VPC’s VSI subnet tier has an identical cluster deployed per the Red Hat Open Shift Kubernetes (ROKS) design.

VPC Patterns that adhere to recommended standards

To arrange and oversee cloud services and VPCs, establish a resource group.

Configure Cloud Object Storage instances to hold Activity Tracker data and flow logs.

This makes it possible to store flow logs and Activity Tracker data for a long time and analyze them.

Keep your encryption keys in situations of Key Protect or Hyper Protect Crypto Services. This gives the management of encryption keys a safe, convenient location.

Establish a workload VPC for executing programmes and services, and a management VPC for monitoring and controlling network traffic.

Using a transit gateway, link the workload and management VPCs.

Install flow log collectors in every VPC to gather and examine information about network traffic. This offers visibility and insights on the performance and trends of network traffic.

Put in place the appropriate networking rules to enable VPC, instance, and service connectivity.

Route tables, network ACLs, and security groups are examples of these.

Configure each VPC’s VPEs for Cloud Object Storage.

This allows each VPC to have private and secure access to Cloud Object Storage.

Activate the management VPC VPN gateway.

This allows the management VPC and on-premises networks to communicate securely and encrypted.

Patterns of landing zones

To acquire a thorough grasp of the fundamental ideas and uses of the Landing Zone patterns, let’s investigate them.

First, the VPC Pattern

Being a modular solution that provides a strong base upon which to develop or deploy compute resources as needed, the VPC Pattern architecture stands out. This design gives you the ability to add more compute resources, such as Red Hat OpenShift clusters or virtual private islands (VSIs), to your cloud environment. This method not only makes the deployment process easier, but it also makes sure that your cloud infrastructure is safe and flexible enough to meet the changing demands of your projects.

The VSI pattern QuickStart with edge VPC

Deploying an edge VPC with a load balancer inside and one VSI in each of the three subnets is the Quickstart VSI pattern pattern. It also has a jump server VSI that exposes a public floating IP address in the management VPC. It’s vital to remember that this design, while helpful for getting started quickly, does not ensure high availability or validation within the IBM Cloud for Financial Services framework.

ROKS pattern QuickStart

A security group, an allow-all ACL, and a management VPC with a single subnet make up the Quickstart ROKS pattern pattern. The Workload VPC features a security group, an allow-all ACL, and two subnets located in two distinct availability zones. There is a Transit Gateway that connects the workload and management VPCs.

In the workload VPC, a single ROKS cluster with two worker nodes and an enabled public endpoint is also present. The cluster keys are encrypted using Key Protect for further protection, and a Cloud Object Storage instance is configured as a prerequisite for the ROKS cluster.

Pattern of virtual servers

Within the IBM Cloud environment, the VSI pattern architecture in question facilitates the establishment of a VSI on a VPC landing zone. One essential part of IBM Cloud’s secure infrastructure services is the VPC landing zone, which is made to offer a safe platform for workload deployment and management. For the purpose of building a secure infrastructure with virtual servers to perform workloads on a VPC network, the VSI on VPC landing zone architecture was created expressly.

Pattern of Red Hat OpenShift

The architecture of the ROKS pattern facilitates the establishment and implementation of a Red Hat OpenShift Container Platform in a single-region configuration inside a VPC landing zone on IBM Cloud.

This makes it possible to administer and run container apps in a safe, isolated environment that offers the tools and services required to maintain their functionality.

Because all components are located inside the same geographic region, a single-region architecture lowers latency and boosts performance for applications deployed within this environment.

It also makes the OpenShift platform easier to set up and operate.

Organizations can rapidly and effectively deploy and manage their container apps in a safe and scalable environment by utilizing IBM Cloud’s VPC landing zone to set up and manage their container infrastructure.