Examkin

Question

Difficulty: HardDeploying and Configuring Managed Database Instances

An infrastructure team is setting up a production Cloud SQL PostgreSQL instance that must communicate exclusively via Private IP inside an existing custom Virtual Private Cloud network named `prod-vpc`. Arrange the following administrative commands and procedures in the correct sequential order to establish Private Service Access and deploy the database instance.

  1. 1Allocate an internal IP address range in `prod-vpc` reserved for service networking peering using `gcloud compute addresses create`.
  2. 2Establish a private connection between `prod-vpc` and Google services using `gcloud services peered-connections create`.
  3. 3Provision the Cloud SQL instance attached to `prod-vpc` with public IP disabled using `gcloud sql instances create --network=prod-vpc --no-assign-ip`.
  4. 4Create application database users on the database instance using `gcloud sql users create`.

Answer

The correct operational sequence is: 1) Allocate an internal IP range using gcloud compute addresses create, 2) Create the private service peering connection using gcloud services peered-connections create, 3) Create the Cloud SQL instance with gcloud sql instances create --network=prod-vpc --no-assign-ip, and 4) Provision database users using gcloud sql users create.
To deploy a Cloud SQL instance with Private IP connectivity, Google Cloud requires an established Private Service Access connection. The mandatory sequence begins with reserving an internal IP block (`gcloud compute addresses create`), followed by peering the VPC to Google managed services (`gcloud services peered-connections create`), then creating the instance attached to the VPC without a public IP (`gcloud sql instances create --network=prod-vpc --no-assign-ip`), and finally configuring database user credentials (`gcloud sql users create`).

Step-by-Step Solution

1
Reserve an internal IP address block in the VPC network.
An IP address range with purpose VPC_PEERING is allocated in prod-vpc.
Private Service Access requires a dedicated IP address range to be allocated in the user VPC prior to peering.
2
Create the VPC Network Peering connection to servicenetworking.googleapis.com.
The VPC network is peered with the service producer network managed by Google.
Cloud SQL private instances reside inside a Google-managed tenant VPC, requiring network peering to route traffic.
3
Provision the Cloud SQL instance with --network and --no-assign-ip parameters.
Cloud SQL instance is deployed and assigned a private IP from the peered service range.
Attempting to create a Cloud SQL instance with --network before creating the peered connection results in execution failure.
4
Configure database user credentials.
Application user account is created on the deployed database instance.
User management commands require an active database instance target.

Key Concept

Sequential provisioning of GCP Private Service Access and Private IP Cloud SQL instances
Rate this question

Topics

Deploying and Configuring Managed Database Instances