Skip to content

Commit 9cb444c

Browse files
jackwotherspoonjackwotherspoon
authored
chore: bump examples to latest Proxy and showcase IAM AuthN (#2335)
1 parent c18e322 commit 9cb444c

3 files changed

Lines changed: 154 additions & 147 deletions

File tree

‎examples/k8s-sidecar/job_with_shutdown_hook.yaml‎

Lines changed: 35 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -40,43 +40,43 @@ spec:
4040
app: busybox
4141
spec:
4242
containers:
43-
- name: my-application
44-
# Run your batch job command.
45-
# Then, send a HTTTP POST request to the proxy sidecar container's
46-
# /quitquitquit api. This will cause the proxy process to exit.
47-
command:
48-
- sh
49-
- -c
50-
- >
51-
my_batch_job --host=127.0.0.1 --port=<DB_PORT> --username=<DB_USER> --dbname=<DB_NAME>
52-
curl http://localhost:9091/quitquitquit
53-
image: busybox
54-
imagePullPolicy: IfNotPresent
55-
resources: {}
56-
terminationMessagePath: /dev/termination-log
57-
terminationMessagePolicy: File
58-
- name: cloud-sql-proxy
59-
# It is recommended to use the latest version of the Cloud SQL Auth Proxy
60-
# Make sure to update on a regular schedule!
61-
image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.11.4
62-
args:
63-
# Enable the admin api server on port 9091
64-
- "--admin-port=9091"
65-
# Enable the /quitquitquit admin api endpoint
66-
- "--quitquitquit"
43+
- name: my-application
44+
# Run your batch job command.
45+
# Then, send a HTTTP POST request to the proxy sidecar container's
46+
# /quitquitquit api. This will cause the proxy process to exit.
47+
command:
48+
- sh
49+
- -c
50+
- >
51+
my_batch_job --host=127.0.0.1 --port=<DB_PORT> --username=<DB_USER> --dbname=<DB_NAME>
52+
curl http://localhost:9091/quitquitquit
53+
image: busybox
54+
imagePullPolicy: IfNotPresent
55+
resources: {}
56+
terminationMessagePath: /dev/termination-log
57+
terminationMessagePolicy: File
58+
- name: cloud-sql-proxy
59+
# It is recommended to use the latest version of the Cloud SQL Auth Proxy
60+
# Make sure to update on a regular schedule!
61+
image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.14.1
62+
args:
63+
# Enable the admin api server on port 9091
64+
- "--admin-port=9091"
65+
# Enable the /quitquitquit admin api endpoint
66+
- "--quitquitquit"
6767

68-
# Tell the proxy to exit gracefully if it receives a SIGTERM
69-
- "--exit-zero-on-sigterm"
68+
# Tell the proxy to exit gracefully if it receives a SIGTERM
69+
- "--exit-zero-on-sigterm"
7070

71-
# Replace DB_PORT with the port the proxy should listen on
72-
- "--port=<DB_PORT>"
73-
- "<INSTANCE_CONNECTION_NAME>"
71+
# Replace DB_PORT with the port the proxy should listen on
72+
- "--port=<DB_PORT>"
73+
- "<INSTANCE_CONNECTION_NAME>"
7474

75-
securityContext:
76-
runAsNonRoot: true
77-
resources:
78-
requests:
79-
memory: "2Gi"
80-
cpu: "1"
75+
securityContext:
76+
runAsNonRoot: true
77+
resources:
78+
requests:
79+
memory: "2Gi"
80+
cpu: "1"
8181
restartPolicy: Never
8282
terminationGracePeriodSeconds: 30

‎examples/k8s-sidecar/proxy_with_sa_key.yaml‎

Lines changed: 62 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -26,69 +26,72 @@ spec:
2626
app: <YOUR-APPLICATION-NAME>
2727
spec:
2828
containers:
29-
- name: <YOUR-APPLICATION-NAME>
30-
# ... other container configuration
31-
env:
32-
- name: DB_USER
33-
valueFrom:
34-
secretKeyRef:
35-
name: <YOUR-DB-SECRET>
36-
key: username
37-
- name: DB_PASS
38-
valueFrom:
39-
secretKeyRef:
40-
name: <YOUR-DB-SECRET>
41-
key: password
42-
- name: DB_NAME
43-
valueFrom:
44-
secretKeyRef:
45-
name: <YOUR-DB-SECRET>
46-
key: database
47-
- name: cloud-sql-proxy
48-
# It is recommended to use the latest version of the Cloud SQL Auth Proxy
49-
# Make sure to update on a regular schedule!
50-
image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.11.4
51-
args:
52-
# If connecting from a VPC-native GKE cluster, you can use the
53-
# following flag to have the proxy connect over private IP
54-
# - "--private-ip"
29+
- name: <YOUR-APPLICATION-NAME>
30+
# ... other container configuration
31+
env:
32+
- name: DB_USER
33+
valueFrom:
34+
secretKeyRef:
35+
name: <YOUR-DB-SECRET>
36+
key: username
37+
- name: DB_PASS
38+
valueFrom:
39+
secretKeyRef:
40+
name: <YOUR-DB-SECRET>
41+
key: password
42+
- name: DB_NAME
43+
valueFrom:
44+
secretKeyRef:
45+
name: <YOUR-DB-SECRET>
46+
key: database
47+
- name: cloud-sql-proxy
48+
# It is recommended to use the latest version of the Cloud SQL Auth Proxy
49+
# Make sure to update on a regular schedule!
50+
image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.14.1
51+
args:
52+
# If connecting from a VPC-native GKE cluster, you can use the
53+
# following flag to have the proxy connect over private IP
54+
# - "--private-ip"
5555

56-
# Enable structured logging with LogEntry format:
57-
- "--structured-logs"
56+
# If you are not connecting with Automatic IAM AuthN, you can delete
57+
# the following flag.
58+
- "--auto-iam-authn"
5859

60+
# Enable structured logging with LogEntry format:
61+
- "--structured-logs"
5962

60-
# Replace DB_PORT with the port the proxy should listen on
61-
- "--port=<DB_PORT>"
62-
- "<INSTANCE_CONNECTION_NAME>"
63+
# Replace DB_PORT with the port the proxy should listen on
64+
- "--port=<DB_PORT>"
65+
- "<INSTANCE_CONNECTION_NAME>"
6366

64-
# [START cloud_sql_proxy_k8s_volume_mount]
65-
# This flag specifies where the service account key can be found
66-
- "--credentials-file=/secrets/service_account.json"
67-
securityContext:
68-
# The default Cloud SQL Auth Proxy image runs as the
69-
# "nonroot" user and group (uid: 65532) by default.
70-
runAsNonRoot: true
71-
volumeMounts:
72-
- name: <YOUR-SA-SECRET-VOLUME>
73-
mountPath: /secrets/
74-
readOnly: true
75-
# [END cloud_sql_proxy_k8s_volume_mount]
76-
# Resource configuration depends on an application's requirements. You
77-
# should adjust the following values based on what your application
78-
# needs. For details, see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
79-
resources:
80-
requests:
81-
# The proxy's memory use scales linearly with the number of active
82-
# connections. Fewer open connections will use less memory. Adjust
83-
# this value based on your application's requirements.
84-
memory: "2Gi"
85-
# The proxy's CPU use scales linearly with the amount of IO between
86-
# the database and the application. Adjust this value based on your
87-
# application's requirements.
88-
cpu: "1"
67+
# [START cloud_sql_proxy_k8s_volume_mount]
68+
# This flag specifies where the service account key can be found
69+
- "--credentials-file=/secrets/service_account.json"
70+
securityContext:
71+
# The default Cloud SQL Auth Proxy image runs as the
72+
# "nonroot" user and group (uid: 65532) by default.
73+
runAsNonRoot: true
74+
volumeMounts:
75+
- name: <YOUR-SA-SECRET-VOLUME>
76+
mountPath: /secrets/
77+
readOnly: true
78+
# [END cloud_sql_proxy_k8s_volume_mount]
79+
# Resource configuration depends on an application's requirements. You
80+
# should adjust the following values based on what your application
81+
# needs. For details, see https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
82+
resources:
83+
requests:
84+
# The proxy's memory use scales linearly with the number of active
85+
# connections. Fewer open connections will use less memory. Adjust
86+
# this value based on your application's requirements.
87+
memory: "2Gi"
88+
# The proxy's CPU use scales linearly with the amount of IO between
89+
# the database and the application. Adjust this value based on your
90+
# application's requirements.
91+
cpu: "1"
8992
# [START cloud_sql_proxy_k8s_volume_secret]
9093
volumes:
91-
- name: <YOUR-SA-SECRET-VOLUME>
92-
secret:
93-
secretName: <YOUR-SA-SECRET>
94+
- name: <YOUR-SA-SECRET-VOLUME>
95+
secret:
96+
secretName: <YOUR-SA-SECRET>
9497
# [END cloud_sql_proxy_k8s_volume_secret]

‎examples/k8s-sidecar/proxy_with_workload_identity.yaml‎

Lines changed: 57 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -30,59 +30,63 @@ spec:
3030
# [END cloud_sql_proxy_k8s_sa]
3131
# [START cloud_sql_proxy_k8s_secrets]
3232
containers:
33-
- name: <YOUR-APPLICATION-NAME>
34-
# ... other container configuration
35-
env:
36-
- name: DB_USER
37-
valueFrom:
38-
secretKeyRef:
39-
name: <YOUR-DB-SECRET>
40-
key: username
41-
- name: DB_PASS
42-
valueFrom:
43-
secretKeyRef:
44-
name: <YOUR-DB-SECRET>
45-
key: password
46-
- name: DB_NAME
47-
valueFrom:
48-
secretKeyRef:
49-
name: <YOUR-DB-SECRET>
50-
key: database
51-
# [END cloud_sql_proxy_k8s_secrets]
52-
# [START cloud_sql_proxy_k8s_container]
53-
- name: cloud-sql-proxy
54-
# It is recommended to use the latest version of the Cloud SQL Auth Proxy
55-
# Make sure to update on a regular schedule!
56-
image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.11.4
57-
args:
58-
# If connecting from a VPC-native GKE cluster, you can use the
59-
# following flag to have the proxy connect over private IP
60-
# - "--private-ip"
33+
- name: <YOUR-APPLICATION-NAME>
34+
# ... other container configuration
35+
env:
36+
- name: DB_USER
37+
valueFrom:
38+
secretKeyRef:
39+
name: <YOUR-DB-SECRET>
40+
key: username
41+
- name: DB_PASS
42+
valueFrom:
43+
secretKeyRef:
44+
name: <YOUR-DB-SECRET>
45+
key: password
46+
- name: DB_NAME
47+
valueFrom:
48+
secretKeyRef:
49+
name: <YOUR-DB-SECRET>
50+
key: database
51+
# [END cloud_sql_proxy_k8s_secrets]
52+
# [START cloud_sql_proxy_k8s_container]
53+
- name: cloud-sql-proxy
54+
# It is recommended to use the latest version of the Cloud SQL Auth Proxy
55+
# Make sure to update on a regular schedule!
56+
image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.14.1
57+
args:
58+
# If connecting from a VPC-native GKE cluster, you can use the
59+
# following flag to have the proxy connect over private IP
60+
# - "--private-ip"
6161

62-
# Enable structured logging with LogEntry format:
63-
- "--structured-logs"
62+
# If you are not connecting with Automatic IAM, you can delete
63+
# the following flag.
64+
- "--auto-iam-authn"
6465

65-
# Replace DB_PORT with the port the proxy should listen on
66-
- "--port=<DB_PORT>"
67-
- "<INSTANCE_CONNECTION_NAME>"
68-
69-
securityContext:
70-
# The default Cloud SQL Auth Proxy image runs as the
71-
# "nonroot" user and group (uid: 65532) by default.
72-
runAsNonRoot: true
73-
# You should use resource requests/limits as a best practice to prevent
74-
# pods from consuming too many resources and affecting the execution of
75-
# other pods. You should adjust the following values based on what your
76-
# application needs. For details, see
77-
# https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
78-
resources:
79-
requests:
80-
# The proxy's memory use scales linearly with the number of active
81-
# connections. Fewer open connections will use less memory. Adjust
82-
# this value based on your application's requirements.
83-
memory: "2Gi"
84-
# The proxy's CPU use scales linearly with the amount of IO between
85-
# the database and the application. Adjust this value based on your
86-
# application's requirements.
87-
cpu: "1"
66+
# Enable structured logging with LogEntry format:
67+
- "--structured-logs"
68+
69+
# Replace DB_PORT with the port the proxy should listen on
70+
- "--port=<DB_PORT>"
71+
- "<INSTANCE_CONNECTION_NAME>"
72+
73+
securityContext:
74+
# The default Cloud SQL Auth Proxy image runs as the
75+
# "nonroot" user and group (uid: 65532) by default.
76+
runAsNonRoot: true
77+
# You should use resource requests/limits as a best practice to prevent
78+
# pods from consuming too many resources and affecting the execution of
79+
# other pods. You should adjust the following values based on what your
80+
# application needs. For details, see
81+
# https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
82+
resources:
83+
requests:
84+
# The proxy's memory use scales linearly with the number of active
85+
# connections. Fewer open connections will use less memory. Adjust
86+
# this value based on your application's requirements.
87+
memory: "2Gi"
88+
# The proxy's CPU use scales linearly with the amount of IO between
89+
# the database and the application. Adjust this value based on your
90+
# application's requirements.
91+
cpu: "1"
8892
# [END cloud_sql_proxy_k8s_container]

0 commit comments

Comments
 (0)