Cloud SQL Auth Proxy da hanyar VPN kai tsaye zuwa rumbun adana bayanai

Akwai hanyoyi biyu masu ma'ana don isa ga wani keɓaɓɓen Cloud SQL instance daga kwamfutar tafi-da-gida a kan VPN. Ɗaya shine haɗi kai tsaye zuwa adireshin keɓaɓɓen instance ta hanyar da kake da ita. Ɗayan kuma shine Cloud SQL Auth Proxy, wanda yake saurare a kan loopback kuma shi da kansa yake buɗe haɗin zuwa Cloud SQL. Ba gasa suke da juna ba sosai kamar amsoshi biyu daban-daban ga tambayar wanene ke riƙe da takardar shaida kuma wanene ke riƙe da hanya. Zaɓi mara kyau yawanci yana bayyana a matsayin kuskuren izini wanda ake karantawa a matsayin kuskuren cibiyar sadarwa.

Ga kwatancen da zan sa a gaban ƙungiya, sannan dubawa waɗanda suke yanke hukunci a zahiri.

Hanyoyi biyu zuwa instance ɗaya

Hanyar kai tsaye tana amfani da hanyar private-services-access daga cibiyar sadarwarka zuwa VPC na aikin. Abokin cinikinka yana magana da PostgreSQL da adireshin keɓaɓɓen instance, kuma haɗin yana raye ko ya mutu bisa ga tuƙin hanya, dokokin firewall da takardun shaidar rumbun adana bayanai.

Hanyar proxy tana amfani da wannan hanyar amma tana ƙara wani tsari na gida. Proxy ɗin yana tabbatar da kansa ga Google API da default credentials na aikinka, yana buɗe haɗi zuwa instance ta hanyar connector, kuma yana bayar da tashar loopback da abokin cinikinka ke ɗauka a matsayin PostgreSQL. Tsalle biyu sun zama uku, kuma na tsakiya yana ɗauke da izinin IAM. Hanyar VPN har yanzu naka ne don kiyayewa, kuma proxy ba ya taɓa ɗaukar ta a matsayin madadin wannan dubawa.

Abin da kowace hanya take ba da izini a zahiri

Bambanci mafi muhimmanci shine abin da kowace zaɓi zai iya ba da izini a madadinka:

Dubawar IAM na proxy da shiga rumbun adana bayanai ƙofofi ne daban-daban, kuma wucewa ta ɗaya ba ya buɗe ɗayan. Ƙungiyar da ta kunna proxy kuma ta ɗauka cewa asusun aikace-aikacen ba ya bukata yanzu za ta shafe tsakar rana a kan gazawar kalmar sirri da ba ta da wata alaƙa da cibiyar sadarwa.

Tashoshi da hanyoyi, gefe da gefe

Proxy yana buƙatar TCP 443 mai fita don API da TCP 3307 don haɗin instance, dukansu an bayyana su a cikin taƙaitaccen bayanin Auth Proxy. Hanyar VPN naka tana rufe na biyu; na farko yawanci yana fita ta hanyar da aka saba.

Haɗi kai tsaye yana buƙatar tashar PostgreSQL ta instance ta kasance mai isa ta hanyar keɓaɓɓiyar hanya, wanda wata magana ce ta firewall daban. Idan ƙungiyar sadarwarka tana ba da izinin fita 443 kawai daga subnet ɗin abokan ciniki, proxy yana dacewa ba tare da canza wata doka ba kuma hanyar kai tsaye ba ta dacewa. Wannan gaskiya ɗaya tana yanke zaɓi fiye da kowane fifikon gine-gine.

Babu ɗaya daga cikin hanyoyin da ke buƙatar instance ɗin ya kasance da adireshin jama'a, kuma babu wanda ke ba da hujjar ƙara ɗaya.

Inda proxy ba ya taimakawa

Proxy ba ya gyara hanyar da ta ɓace. Idan hanyar private-services-access ba ta nan, ko VPN ba ya ɗauke ta, connector yana gazawa yayin da mai saurare na gida har yanzu yana zaune a can yana saurare, kuma wannan shine ɓangaren da ke da ruɗani.

Haka kuma ba ya kare sashin da ke tsakanin aikinka da proxy. A kan kwamfuta ɗaya wannan sashin loopback ne kuma yana da kyau. Idan ka ɗaure mai saurare ga adireshin wildcard domin abokin aiki ya isa gare shi, ka gina ƙofar rumbun adana bayanai marar tabbaci kuma ka kira ta da sauƙi. Ka ajiye ta a kan loopback kuma ka bar abokin aikin ya sami takardar shaidarsa.

Kuma ba ya sa Private Service Connect da private services access su zama masu musanya. PSC instance yana buƙatar tsarin DNS nasa da kiran --psc maimakon siffar --private-ip.

Zaɓi, sannan ka tabbatar ta kowace hanya

Zaɓi proxy idan kana son IAM a cikin hanya, takardun shaida na ɗan lokaci kaɗan da babu canjin firewall mai shigowa.

Zaɓi hanyar kai tsaye idan abokin ciniki mai tallafi yana da ƙaƙƙarfan takardun shaidar rumbun adana bayanai kuma ƙungiyar sadarwa tana jin daɗin buɗe tashar. Ta kowace hanya, ka tabbatar da ainihin tambaya maimakon haɗi mai nasara: ka haɗa, ka gudanar da karatu ɗaya a kan tebur da aka sani, kuma ka duba abin da uwar garken ke gani game da zamanka.

Bayan sake haɗa VPN, ka ɗauki takardar shaidar da ta ƙare, hanyar keɓaɓɓiya da ta ɓace da kin shiga rumbun adana bayanai a matsayin gazawa uku daban-daban. Ɗaya ne kawai daga cikinsu matsalar cibiyar sadarwa, kuma ɗaya ne kawai ya kamata ya taɓa kai ga canza dokar firewall.