<p>I'm trying to connect my node.js backend to a Cloud SQL on the same project, following many tutorials and documentation, but without success.</p>

<p>Here my service and endpoint config:</p>

<pre><code>kind: Service
apiVersion: v1
metadata:
  name: mysql-service
spec:
  type: ClusterIP
  ports:
  - protocol: TCP
    port: 3306
    targetPort: 3306
---
kind: Endpoints
apiVersion: v1
metadata:
  name: mysql-service
subsets:
  - addresses:
    - ip: 10.78.176.3
    ports:
    - port: 3306
</code></pre>

<p>I got on my node.js side:</p>

<pre><code>process.DB_HOST 10.78.176.3
process.DB_DATABASE marketplace_test
MySQL Connection pool error
connect ETIMEDOUT
</code></pre>

<p>I already tried to connect over the public and the private IP, over the 'mysql-service' name, but nothing worked.</p>

<p>Could it be some relation I'm missing, like a <code>matchLabels</code>? Should I match the service+endpoint+deployment? How?
Must I use a proxy for that?</p>

<p>What I'm missing?</p>

<p>Thanks for all help!</p>

Tiago Gouvêa
<p>If you are connecting via Private IP, you need to make sure you meet the <a href="https://cloud.google.com/sql/docs/mysql/private-ip#environment_requirements" rel="nofollow noreferrer">environment requirements</a> on your GKE cluster. This means that it needs to be a <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/alias-ips" rel="nofollow noreferrer">VPC-native cluster</a>. If it's not, you'll need to use public IP.</p>

<p>If you are using a Public IP, you need to authenticate your connection. There are 3 main ways to do this:</p>

<ul>
<li><a href="https://cloud.google.com/sql/docs/mysql/connect-kubernetes-engine" rel="nofollow noreferrer">Via the Cloud SQL proxy</a> - this will use IAM roles to authenticate the connections</li>
<li><a href="https://cloud.google.com/sql/docs/mysql/configure-ssl-instance" rel="nofollow noreferrer">Via an SSL/TLS certificate</a> - you can create one on the instance and share with the client</li>
<li><a href="https://cloud.google.com/sql/docs/mysql/configure-ip" rel="nofollow noreferrer">Via IP whitelisting</a> - This is the most convenient, but the least secure. </li>
</ul>
