@glamorous-printer-14057 Per https://cloud.google.com/sql/docs/mysql/private-ip, it seems that is the way private access is implemented by GCP...

Private services access is implemented as a VPC peering connection between your VPC network and the Google services VPC network where your Cloud SQL instance resides.

thanks - yeah, I’ve mostly used AWS in the past for this kind of stuff so I’m not familiar w/ best practices here. It just seemed surprising to me that getting a Hello, world container talking to a database and not going over the public internet requires VPC peering right out of the box, and has me questioning whether I’m doing this right 🙂

You can also deploy cloud sql proxy into your k8s cluster and then access cloud sql through that (i.e. in your app you use then cluster internal dns name of the proxy to connect to the db). Note that afaik the cloud sql proxy connects to cloud SQL via it’s public IP and hence your gke nodes need outbound access to the internet. Since you apparently setup a private cluster you need to first setup Cloud NAT or some other NAT gateway for your nodes to have outbound internet access. I doubt using cloud sql proxy makes your life any easier than the VPC peering route, but it used to be the only way up until a few months ago and I thought it’s worth mentioning. I’m pasting some code here which might help.