<p>I am new to Terraform and Google Cloud.</p>
<p>I am trying to create a K8 cluster where pods inside the cluster could communicate with a Postgres server I have within the same VPC.</p>
<p>However, when I try to connect to the server using a <code>psql</code> client within a ubuntu pod inside the cluster using <code>psql -h &lt;PRIVATE_IP_OF_POSTGRES_SERVER&gt; -U postgresadmin</code>, it waits for a long time and throws the following timeout error.</p>
<pre class="lang-sh prettyprint-override"><code>psql: could not connect to server: Connection timed out
        Is the server running on host &quot;&lt;PRIVATE_IP_OF_POSTGRES_SERVER&gt;&quot; and accepting
        TCP/IP connections on port 5432?
</code></pre>
<p>I even tried to <code>telnet &lt;PRIVATE_IP_OF_POSTGRES_SERVER&gt;</code> and that is also not working. (PING is not working as well)</p>
<p>Here is my terraform script for creating the VPC and the K8 cluster:</p>
<pre class="lang-yaml prettyprint-override"><code>variable &quot;project_id&quot; {
  description = &quot;project id&quot;
}

variable &quot;region&quot; {
  description = &quot;region&quot;
}

variable &quot;gke_username&quot; {
  default     = &quot;&quot;
  description = &quot;gke username&quot;
}

variable &quot;gke_password&quot; {
  default     = &quot;&quot;
  description = &quot;gke password&quot;
}

variable &quot;gke_num_nodes&quot; {
  default     = 1
  description = &quot;number of gke nodes&quot;
}

provider &quot;google&quot; {
  project = var.project_id
  region  = var.region
}

# VPC
resource &quot;google_compute_network&quot; &quot;vpc&quot; {
  name                    = &quot;${var.project_id}-vpc&quot;
  auto_create_subnetworks = &quot;false&quot;
}

# Subnet
resource &quot;google_compute_subnetwork&quot; &quot;subnet&quot; {
  name          = &quot;${var.project_id}-subnet&quot;
  region        = var.region
  network       = google_compute_network.vpc.name
  ip_cidr_range = &quot;10.10.0.0/24&quot;
}

# GKE cluster
resource &quot;google_container_cluster&quot; &quot;primary&quot; {
  name     = &quot;${var.project_id}-gke&quot;
  location = var.region

  remove_default_node_pool = true
  initial_node_count       = 1

  network    = google_compute_network.vpc.name
  subnetwork = google_compute_subnetwork.subnet.name

  # Create a VPC-native cluster by configuring `ip_allocation_policy` 
  ip_allocation_policy {
    cluster_ipv4_cidr_block  = &quot;/16&quot;
    services_ipv4_cidr_block = &quot;/22&quot;
  }

  master_auth {
    username = var.gke_username
    password = var.gke_password

    client_certificate_config {
      issue_client_certificate = false
    }
  }
}

# Separately Managed Node Pool
resource &quot;google_container_node_pool&quot; &quot;primary_nodes&quot; {
  name       = &quot;${google_container_cluster.primary.name}-node-pool&quot;
  location   = var.region
  cluster    = google_container_cluster.primary.name
  node_count = var.gke_num_nodes

  node_config {
    oauth_scopes = [
      &quot;https://www.googleapis.com/auth/logging.write&quot;,
      &quot;https://www.googleapis.com/auth/monitoring&quot;,
    ]

    labels = {
      env = var.project_id
    }

    # preemptible  = true
    machine_type = &quot;n1-standard-1&quot;
    tags         = [&quot;gke-node&quot;, &quot;${var.project_id}-gke&quot;]
    metadata = {
      disable-legacy-endpoints = &quot;true&quot;
    }
  }
}
</code></pre>
<p>Here is my terraform script file for creating the Postgres server:</p>
<pre class="lang-yaml prettyprint-override"><code>variable &quot;project_id&quot; {
  description = &quot;project id&quot;
}

variable &quot;region&quot; {
  description = &quot;region&quot;
}

terraform {
  required_providers {
    google = {
      source = &quot;hashicorp/google&quot;
      version = &quot;3.61.0&quot;
    }
  }
}

data &quot;google_compute_network&quot; &quot;my_network&quot; {
  name = &quot;novade-lite-vpc&quot;
}

provider &quot;google&quot; {
  project = var.project_id
  region  = var.region
}

resource &quot;random_id&quot; &quot;db_name_suffix&quot; {
  byte_length = 4
}

resource &quot;google_compute_global_address&quot; &quot;private_ip_address&quot; {
  name          = &quot;private-ip-address&quot;
  purpose       = &quot;VPC_PEERING&quot;
  address_type  = &quot;INTERNAL&quot;
  prefix_length = 16
  network       = data.google_compute_network.my_network.self_link
}

resource &quot;google_service_networking_connection&quot; &quot;private_vpc_connection&quot; {
  network                 = data.google_compute_network.my_network.self_link
  service                 = &quot;servicenetworking.googleapis.com&quot;
  reserved_peering_ranges = [google_compute_global_address.private_ip_address.name]
}

resource &quot;google_sql_database_instance&quot; &quot;postgres&quot; {
  name             = &quot;postgres-instance-${random_id.db_name_suffix.hex}&quot;
  database_version = &quot;POSTGRES_11&quot;
  depends_on = [google_service_networking_connection.private_vpc_connection]

  settings {
    tier = &quot;db-f1-micro&quot;

    ip_configuration {
      ipv4_enabled    = false
      private_network = data.google_compute_network.my_network.self_link
    }
  }
}

resource &quot;google_sql_database&quot; &quot;default&quot; {
  name       = &quot;default&quot;
  project    = var.project_id
  instance   = google_sql_database_instance.postgres.name
  collation  = &quot;en_US.UTF8&quot;
  depends_on = [google_sql_database_instance.postgres]
}

resource &quot;google_sql_user&quot; &quot;users&quot; {
  name     = &quot;postgresadmin&quot;
  instance = google_sql_database_instance.postgres.name
  password = &quot;password&quot;
  depends_on = [google_sql_database_instance.postgres]
}
</code></pre>
<p>Here is my variables file (Same for both the above scripts):</p>
<pre class="lang-yaml prettyprint-override"><code>project_id = &quot;test-project&quot;
region     = &quot;europe-west2&quot;
</code></pre>
<p>Any help is much appreciated! 🙏</p>

Eranga Heshan
<p>I am not aware of how GKE setup works but I can give u some pointers based on my understanding of similar setup in AWS.</p>
<p>Your cluster pod will be one on of the NODES, this node will be part of some subnet and also will have some security group (type of firewall) attached to it.</p>
<p>Similarly postgres DB is created in some subnet and security group attached to it.</p>
<p>Now make sure that the DB security group all inbound traffic on 5432 port from pods subnet range or from security group.</p>
