Enable cross-project connections

By default, a database cluster only allows connections from within the user cluster and the same project. To allow connections from workloads in another project to all database clusters in your project:

Console

  1. Sign in to the GDC console with an account bound to the project-networkpolicy-admin role to create firewall rules.
  2. From the main menu of the GDC console, choose Firewall.
  3. In the User created rules section, click Create.
  4. In Firewall rule details, create a name for your firewall rule.
  5. In the Direction of traffic dialog, choose INGRESS.
  6. In the Target dialog, choose Service and then select dbs.
  7. In the From dialog, choose Another project and select the project ID from which you would like to allow connectivity.
  8. Click Create.
  9. Wait for the Status column of the new rule to show Ready.

API

Create a ProjectNetworkPolicy resource to allow connections from a client project.

apiVersion: networking.gdc.goog/v1 kind: ProjectNetworkPolicy metadata:  name: dbs-allow-from-CLIENT_PROJECT  namespace: USER_PROJECT spec:  subject:  managedServices:  matchTypes:  - dbs  subjectType: ManagedService  ingress:  - from:  - projects:  matchNames:  - CLIENT_PROJECT  policyType: Ingress

Replace the following:

  • CLIENT_PROJECT: the name of the project from which you would like to allow connectivity.
  • USER_PROJECT: the name of the user project where the database cluster was created.