<p>I have a GKE cluster and I would like to connect some, but not all (!), pods and services to a managed Postgresql Cloud DB running in the same VPC.</p>
<p>Of course, I could just go for it (<a href="https://cloud.google.com/sql/docs/postgres/connect-kubernetes-engine" rel="nofollow noreferrer">https://cloud.google.com/sql/docs/postgres/connect-kubernetes-engine</a>), but I would like to make sure that only those pods and services can connect to the Postgresql DB, that should do so.</p>
<p>I thought of creating a separate node pool in my GKE cluster (<a href="https://cloud.google.com/kubernetes-engine/docs/concepts/node-pools" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/concepts/node-pools</a>), where only those pods services do run, that should be able to connect to the Postgresql DB, and allow only those pods and services to connect to the DB by telling the DB which IPs to accept. However, it seems that I cannot set dedicated IPs on the node pool level, only on the cluster level.</p>
<p>Do you have an idea how I can make such a restriction?</p>

tobias
<p>When you create your node pool, create it with a service account that haven't the permission to access to Cloud SQL instances.</p>
<p>Then, leverage <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity" rel="nofollow noreferrer">Workload identity</a> to load a specific service account with some of your pods, and grant the service account the permission to access to Cloud SQL instance</p>
<hr />
<p>You asked &quot;how to know the IP to restrict them to a access to Cloud SQL&quot;. It's a wrong (or legacy) assumption. Google always says &quot;Don't trust the network (and so, the IPs)&quot;. Base your security on the identity (the service account of the node pool and of the pod through workload identity) is a far better option.</p>
