Examkin

Soru

Zorluk: OrtaDeploying and Configuring Managed Database Instances

A cloud engineer needs to deploy a Cloud SQL PostgreSQL instance named 'prod-db' in a custom Virtual Private Cloud (VPC) named 'app-vpc'. Security policies require that the database is accessible strictly using a Private IP address without any public IP assigned. What is the correct sequence of steps required to set up Private Services Access and provision the instance?

  1. 1Reserve an internal IP range in 'app-vpc' using gcloud compute addresses create with the --purpose=VPC_PEERING flag.
  2. 2Establish a private connection using gcloud services peered-connections create to peer 'app-vpc' with Google services.
  3. 3Provision the Cloud SQL instance using gcloud sql instances create with the --network=app-vpc and --no-assign-ip flags.
  4. 4Connect to the internal IP of the Cloud SQL instance from a Virtual Machine inside 'app-vpc' to initialize database schemas.

Cevap

The correct order of steps is: 1) Reserve an internal IP range in the VPC using the VPC_PEERING purpose flag, 2) Establish a private connection to Google services via service peering, 3) Provision the Cloud SQL instance specifying the VPC network and disabling public IP assignment, and 4) Connect from an internal VM within the VPC to initialize database schemas.
To deploy a Cloud SQL instance with Private IP, Google Cloud requires setting up Private Services Access first. This involves reserving an internal IP address block in the VPC network (using purpose=VPC_PEERING), creating a VPC peering connection to the service producer network using gcloud services peered-connections create, provisioning the database instance with the --network and --no-assign-ip flags, and finally accessing the database from internal compute instances within the same VPC.

Adım Adım Çözüm

1
Allocate an IP range for VPC peering.
A dedicated IP range is reserved for Private Services Access in 'app-vpc'.
Google Cloud requires an allocated IP range before a VPC peering connection can be configured for managed services.
2
Create the private services connection.
Peering is established between 'app-vpc' and Google's service producer VPC network.
Cloud SQL Private IP relies on VPC Network Peering established through the Service Networking API.
3
Create the Cloud SQL instance with private IP only.
The Cloud SQL instance is provisioned into the peered service network with an IP from the allocated range.
The --network flag binds the instance to the VPC, while --no-assign-ip prevents public IP exposure.
4
Access and configure the database from an internal compute resource.
Database schemas and users are configured securely over private IP connectivity.
Post-provisioning configuration can only occur once the database instance is fully deployed and accessible on the VPC.

Anahtar Kavram

Configuring Private IP Connectivity for Cloud SQL using Private Services Access
Bu soruyu puanla

Konular

Deploying and Configuring Managed Database Instances