Bayanan sirri na IP na Cloud SQL ta VPN: hanyar da babu wanda ke fitarwa

Ƙungiyoyi da yawa suna gaskata cewa bayanan sirri na IP na Cloud SQL yana aiki ne kawai daga cikin VPC, kuma wannan imani yana dawwama saboda gazawar tana kama da matsalar rumbun adana bayanai. Google ya rubuta hanyar shiga daga cibiyoyin da aka haɗa ta Cloud VPN ko Cloud Interconnect. Abin da waɗannan cibiyoyin suke buƙata ba fasalin rumbun adana bayanai na musamman ba ne, amma musanyar hanya biyu waɗanda ke da sauƙin barin rabin kafa. Tunnel ɗin yana tashi, ɓangarorin lissafin suna amsawa, kuma haɗin rumbun adana bayanai yana ƙarewa — daidai haɗin da ke tura mutane zuwa kuskuren console.

Tatsuniya: bayanan sirri na IP yana nufin sirri ga VPC

Samun sabis na sirri shine VPC peering tsakanin cibiyarka da cibiyar mai samarwa mallakar Google. Kewayon da aka ware don sabis ɗin yana gefen mai samarwa, kuma adireshin ɓangaren yana cikinsa. Wannan peering shine dalilin da yasa rumbun adana bayanai a cikin aikinka zai iya zama akan adireshin da VPC ɗinka ke bi, ba tare da wani ƙaramin cibiyar da ka bayyana ya ƙunshi shi ba.

Domin peering ne, yana da halin peering, ciki har da ɓangaren da hanyoyin da aka keɓance ba sa wucewa kai tsaye.

Tatsuniya: tunnel mai aiki yana ɗaukar hanyar rumbun adana bayanai tare da shi

Kewayuka biyu dole su tsira daga tafiyar. Na farko shine prefix ɗin abokin ciniki: dole cibiyarka ta gida ta san Cloud Router da takamaiman prefixes, domin hanyar da aka saba ba za ta iya samar da shigo da cibiyar mai samarwa ke buƙata don hanyar dawowa ba. Na biyu shine kewayon sabis ɗin da aka ware, wanda dole gefen waje ya koya domin fakitinsa na rumbun adana bayanai su sami inda za su je. Hanyoyi daban-daban ne da ake kiyayewa a iyakoki daban-daban, kuma gyara ɗaya yana barin ɗayan a karye.

A gefen Google wannan yana nufin kunna Export custom routes akan haɗin peering ɗin da abin ya shafa da ƙara kewayon sabis ɗin da aka ware cikin hanyoyin da Cloud Router ya sanar don tunnel ɗin.

Riƙe sanarwar da suke can tun farko. Ƙara kewayon sabis ɓai kamata ya cire hanyoyin VPC da wannan zaman BGP ɗin ke ɗauka don wani zirga-zirga ba, kuma saitin sanarwa da aka maye gurbinsa gaba ɗaya wani katsewa ne na biyu da ke ɓoye bayan na farko. Duba hanyoyin da suke aiki akan na'urar waje kuma, domin isa ƙofar VPN ko wata ƙaramin cibiya yana tabbatar da wucewar bayanai kawai.

Tatsuniya: Cloud SQL Auth Proxy yana magance cibiyar

The Auth Proxy yana samar da ingantaccen tabbaci da jigilar rufaffiyar tsakanin manhajarka da ɓangaren. Ba ya ƙirƙirar hanya. Proxy da aka fara akan mai masauki marar hanya zuwa cibiyar sirri zai gaza daidai kamar yadda haɗi kai tsaye zai gaza, kuma bayanansa ba za su taimaka sosai game da dalilin ba. Motsa proxy ɗin zuwa mai masaukin da ke da haɗi yana canza wane ɓangare na hanyar dole ya yi aiki, kuma wannan ainihin shawarar ƙira ce ba hanyar wucewa ba.

Abin da ba ya yi shine barin kwamfutar tafi-da-gidanka da ba ta da haɗi ta isa ɓangaren sirri kawai.

Tatsuniya: Private Service Connect yana bin ƙa'idodi ɗaya

Private Service Connect yana amfani da endpoint a cikin ƙaramin cibiyarka da tsarin DNS da kake sarrafawa, don haka hanyar zuwa gare shi ita ce ta yau da kullum zuwa adireshin da ka mallaka. Saitunan fitar da peering ba su shafi wannan ƙira ba, kuma kwafin canje-canjen peering cikin tura PSC yana ƙara haɗari ba tare da ƙara isa ba.

Dukansu suna ba ka adireshin sirri; kamancin yana ƙarewa a nan.

Gwada hanyar cikin tsari daidai

Daga abokin ciniki na waje, gwada TCP endpoint na rumbun adana bayanai da farko. Kammala musafaha na TCP yana nufin turawa, bangon wuta da mai sauraro duk suna wurin, kuma gwajin na gaba aiki ne da aka yarda da shi kuma aka tabbatar. Kin amincewa da tabbaci a wannan lokacin asalin labari ne mai kyau, domin yana tabbatar da cewa mai sauraron rumbun adana bayanai ya amsa. Ƙarewar ICMP ba ta faɗi kusan komai game da shiga rumbun adana bayanai ba, domin hanyoyi da yawa suna watsar da shi yayin da suke tura TCP cikin sauƙi.

Idan kewayon abokin cinikinka suna wajen RFC 1918, duba ƙarin buƙatun fitar da hanya da izinin cibiyar kafin ka yanke shawarar cewa ba a tallafa wa ƙirar ba.

Yi rikodin abubuwa huɗu tare da haɗin: prefix ɗin waje, kewayon sabis ɗin da aka ware, haɗin peering ɗin da abin ya shafa da router ɗin da ke sanarwa. Waɗannan huɗu suna bayyana dukan hanyar sirri, kuma suna maye gurbin tatsuniyar cewa Cloud SQL ko dai kullum yana buƙatar proxy ko kuma ba za a iya isa gare shi ta VPN ba kwata-kwata.