CODEWITHSUNDEEP
network-programminggoogle-cloud-platformvpnvpcgoogle-cloud-vpn
Claudio
Claudio

Reputation: 496

Setting up VPN between GCP Projects to access SQL Engine subnetwork

Please bear with me as my background is development and not sysadmin. Networking is something I'm learning as I go and thus why I'm writing here :)

A couple of months ago I started the process of designing the network structure of our cloud. After a couple of exchange here, I settled for having a project that will host a VPN Tunnel to the on-premise resources and some other projects that will host our products once they are moved from the on-premises servers.

All is good and I managed to set things up.

Now, one of the projects is dedicated to "storage": that means, for us, databases, buckets for statis data to be accessed around , etc.

I created a first mySQL database (2nd gen) to start testing and noticed that the only option available to access the SQL databases from Internal IPs was with the "parent project" subnetwork.

I realised that SQL Engine create a subnetwork dedicated for just that. It's written in the documentation as well, silly me. No problem, I tear it down, enable Private Service Connection, create an allocated IP range in the VPC management and set it to export routes.

Then I went back to the SQL Engine a created a new database. As expected the new one had the IP assigned to the allocated IP range set up previously.

Now, I expected every peered network to be able to see the SQL subnetwork as well but apparently not. Again, RDFM you silly goose. It was written there as well.

I activated a bronze support subscription with GCP to have some guidance but what I got was a repeated "create a vpn tunnel between the two projects" which left me a little disappointed as the concept of Peered VPC is so good.

But anyway, let's do that then.

I created a tunnel pointing to a gateway on the project that will have K8s clusters and vice-versa. The dashboard tells me that the tunnel are established but apparently there is a problem with the bgp settings because they are hanging on "Waiting for peer" on both side, since forever.

At this point I'm looking for anything related to BGP but all I can find is how it works in theory, what it is used for, which are the ASM numbers reserved etc etc.

I really need someone to point out the obvious and tell me what I fucked up here, so:

This is the VPN tunnel on the projects that hosts the databases: enter image description here

And this is the VPN tunnel on the project where the products will be deployed, that need to access the databases. enter image description here

Any help is greatly appreciated!

Upvotes: 0

Views: 3054

Answers (3)

KenLy.LDK
KenLy.LDK

Reputation: 1

The original setup in the OP question should work, i.e.

Network 1 <--- (VPN) ---> Network 2 <--- (Peered) ---> CloudSQL network

(the network and the peering is created by GCP)

Then resource in Network 1 is able to access a MySQL instance created in the CloudSQLz network.

Upvotes: 0

guillaume blaquiere
guillaume blaquiere

Reputation: 75715

You can't achieve what you want by VPN or by VPC Peering. In fact there is a rule in VPC which avoid peering transitivity described in the restriction part

Only directly peered networks can communicate. Transitive peering is not supported. In other words, if VPC network N1 is peered with N2 and N3, but N2 and N3 are not directly connected, VPC network N2 cannot communicate with VPC network N3 over VPC Network Peering.

Now, take what you want to achieve. When you use a Cloud SQL private IP, you create a peering between your VPC and the VPC of the Cloud SQL. And you have another peering (or VPN tunnel) for the SQL engine.

SQL Engine -> Peering -> Project -> Peering -> Cloud SQL

Like this you can't.

But you can use the shared VPC. Create a shared VPC, add your 2 projects in it, create a common subnet for SQL Engine and the Cloud SQL peering. That should work.

But, be careful. All VPC features aren't available with shared VPC. For example, serverless VPC connector aren't yet compliant with it.

Hope this help!

Upvotes: 1

Marcel P
Marcel P

Reputation: 101

Regarding the BGP status "Waiting for peer" in your VPN tunnel, I believe this is due to the configured Cloud Router BGP IP and BGP peer IP. When configuring, the Cloud Router BGP IP address of tunnel1 is going to be the BGP Peer IP address for tunnel2, and the BGP Peer IP address for tunnel1 is going to be the Router BGP IP address of tunnel2.

Referring to your scenario, the IP address for stage-tunnel-to-cerberus should be: Router BGP IP address: 169.254.1.2 and, BGP Peer IP address: 169.254.1.1

This should put your VPN tunnels BGP session status in "BGP established".

Upvotes: 3

Related Questions