I-Cloud SQL Auth Proxy umaqondana nomzila oqondile we-VPN oya kusizindalwazi
I-Auth Proxy nomzila oqondile we-VPN kuxazulula izingxenye ezimbili ezihlukene zenkinga eyodwa. Qala ngokuqhathanisa ukugunyazwa kwesixhumi, amachweba kanye nokungena kusizindalwazi.
Kunezindlela ezimbili ezinengqondo zokufinyelela isimo se-Cloud SQL esiyimfihlo kusuka kukhompyutha ephathekayo eseku-VPN. Enye iwukuxhumana okuqondile ekhelini eliyimfihlo lesimo ngomzila osewunayo kakade. Enye i-Cloud SQL Auth Proxy, elalela ku-loopback futhi yona ngokwayo ivule ukuxhumana ne-Cloud SQL. Lezi akuzona izinto zomkhiqizo ezincintisanayo kodwa izimpendulo ezimbili ezihlukene embuzweni wokuthi ubani ophethe ubufakazi nokuthi ubani ophethe umzila. Ukukhetha okungalungile kuvame ukuvela njengephutha lokugunyazwa elifundwa njengephutha lenethiwekhi.
Naku ukuqhathanisa engingakubeka phambi kweqembu, kulandele izivivinyo ezinquma ngempela.
Izindlela ezimbili eziya kusimo esisodwa
Umzila oqondile usebenzisa umzila we-private-services-access osuka kunethiwekhi yakho uya ku-VPC yephrojekthi. Iklayenti lakho likhuluma i-PostgreSQL nekheli eliyimfihlo lesimo, futhi ukuxhumana kuphila noma kufe ekuhambiseni, emithethweni ye-firewall kanye nobufakazi besizindalwazi.
Umzila we-proxy usebenzisa umzila ofanayo kodwa wengeza inqubo yasendaweni. I-proxy iziqinisekisa ku-Google API ngobufakazi obuzenzakalelayo bohlelo lwakho, ivule ukuxhumana nesimo ngokusebenzisa isixhumi, futhi iveze ichweba le-loopback elithathwa yiklayenti lakho njenge-PostgreSQL. Ukugxuma okubili kuba kuthathu, futhi okumaphakathi kwethwala ukugunyazwa kwe-IAM. Umzila we-VPN usengowakho ukuwunakekela, futhi i-proxy ayiwuboni njengokungena esikhundleni salokho kuhlolwa.
Yini umzila ngamunye oyigunyazayo ngempela
Umehluko obaluleke kakhulu ukuthi yini inketho ngayinye engayigunyaza esikhundleni sakho:
| Question | Direct private IP | Auth Proxy |
|---|---|---|
| Who proves identity to the network | Your client, through the VPN and a database login | The proxy, through IAM to Google's API |
| IAM role needed for the connector | None | Cloud SQL Client or equivalent |
| Database user authentication | Always required | Still required unless IAM database authentication is enabled |
| Shape of the local leg | Client to instance | Client to loopback, proxy to instance |
Ukuhlolwa kwe-IAM kwe-proxy nokungena kusizindalwazi kuyizikhala ezimbili ezihlukene, futhi ukudlula kwesinye akuvuli esinye. Iqembu elivula i-proxy licabanga ukuthi i-akhawunti yohlelo ayisadingeki lizochitha intambama ngamaphutha ephasiwedi angena ukuxhumana nokuxhumana kwenethiwekhi.
Amachweba nemizila, kuhlangene
I-proxy idinga i-TCP 443 ephumayo ye-API kanye ne-TCP 3307 yokuxhumana nesimo, kokubili kuchazwe ku-umbono jikelele we-Auth Proxy ka-Google. Umzila wakho we-VPN uhlanganisa owesibili; owokuqala uvamise ukuphuma ngomzila ojwayelekile.
Ukuxhumana okuqondile kudinga ukuthi ichweba le-PostgreSQL lesimo lifinyeleleke ngomzila oyimfihlo, okuyingxoxo ehluke ngokuphelele ye-firewall. Uma iqembu lakho lenethiwekhi livumela kuphela i-443 ephumayo kuma-subnet eklayenti, i-proxy iyafaneleka ngaphandle kwenguquko yomthetho futhi umzila oqondile awufaneleki. Lelo qiniso elilodwa linquma ukukhetha kaningi kunanoma yikuphi ukuthanda kwesakhiwo.
Awukho umzila kulezi ezimbili odinga ukuthi isimo sibe nekheli lomphakathi, futhi awukho owethethela ukwengeza elinjalo.
Lapho i-proxy ingasizi khona
I-proxy ayilungisi umzila ongakho. Uma umzila we-private-services-access ungekho, noma i-VPN ingawuthwali, isixhumi siyahluleka kuyilapho isilaleli sasendaweni sisahleli lapho silalele, futhi leyo yingxenye edidayo.
Futhi ayivikeli ingxenye ephakathi kohlelo lwakho ne-proxy. Kukhompyutha eyodwa ephathekayo leyo ngxenye iyi-loopback futhi kulungile. Uma ubopha isilaleli ekhelini le-wildcard ukuze uzakwethu afinyelele kulo, usuke wakha isango lesizindalwazi elingenakho ukuqinisekiswa futhi walibiza ngokuthi lula. Ligcine ku-loopback futhi uvumele uzakwethu azitholele ubufakazi bakhe.
Futhi ayenzi i-Private Service Connect ne-private services access zishintshana. Isimo se-PSC sidinga ukuhlelwa kwayo kwe-DNS kanye nokubiza okuthi --psc esikhundleni sefomu elithi --private-ip.
Khetha, bese uqinisekisa nganoma iyiphi indlela
Khetha i-proxy uma ufuna i-IAM emzileni, ubufakazi besikhathi esifushane futhi kungekho shintsho ku-firewall engenayo.
Khetha umzila oqondile uma iklayenti elisekelwayo selivele linezinkomba eziqinile zesizindalwazi futhi iqembu lenethiwekhi likulungele ukuvula ichweba. Noma kunjalo, qinisekisa ngombuzo wangempela esikhundleni sokuxhumana okuphumelelayo: xhuma, sebenzisa ukufunda okukodwa kuthebula elaziwayo futhi uhlole ukuthi isiphakeli sibona ini ngomkhosi wakho.
Ngemva kokuxhuma kabusha kwe-VPN, thatha ubufakazi obuphelelwe yisikhathi, umzila oyimfihlo ongekho kanye nokwenqatshwa kokungena kusizindalwazi njengezingozi ezintathu ezihlukene. Eyodwa kuphela yazo eyinkinga yenethiwekhi, futhi eyodwa kuphela okufanele ihole ekushintsheni umthetho we-firewall.