terraform apply
. If the authorizing service account belongs to a different project than the one containing the Cloud SQL instance, do the following:
5432
.After you configure Cloud Run, you can connect to your Cloud SQL instance.
For public IP paths, Cloud Run provides encryption and connects using the Cloud SQL Auth Proxy in two ways:
Google recommends that you use Secret Manager to store sensitive information such as SQL credentials. You can pass secrets as environment variables or mount as a volume with Cloud Run.
After creating a secret in Secret Manager, update an existing service, with the following command:
gcloudrunservicesupdateSERVICE_NAME\--add-cloudsql-instances=INSTANCE_CONNECTION_NAME--update-env-vars=INSTANCE_CONNECTION_NAME=INSTANCE_CONNECTION_NAME_SECRET\--update-secrets=DB_USER=DB_USER_SECRET:latest\--update-secrets=DB_PASS=DB_PASS_SECRET:latest\--update-secrets=DB_NAME=DB_NAME_SECRET:latest
The following creates secret resources to securely hold the database user, password, and name values using google_secret_manager_secret
and google_secret_manager_secret_version
. Note that you must update the project compute service account to have access to each secret.
Update the main Cloud Run resource to include the new secrets.
Apply the changes by entering terraform apply
.
The example command uses the secret version, latest; however, Google recommends pinning the secret to a specific version, SECRET_NAME:v1.
For private IP paths, your application connects directly to your instance through a VPC network. This method uses TCP to connect directly to the Cloud SQL instance without using the Cloud SQL Auth Proxy.
Connect using the private IP address of your Cloud SQL instance as the host and port 5432
.
To see this snippet in the context of a web application, view the README on GitHub.
To see this snippet in the context of a web application, view the README on GitHub.
Note:
To see this snippet in the context of a web application, view the README on GitHub.
To see this snippet in the context of a web application, view the README on GitHub.
To see this snippet in the context of a web application, view the README on GitHub.
To see this snippet in the context of a web application, view the README on GitHub.
To see this snippet in the context of a web application, view the README on GitHub.
You can use the Cloud SQL Auth Proxy when testing your application locally. See the quickstart for using the Cloud SQL Auth Proxy for detailed instructions.
You can also test using the Cloud SQL Proxy via a docker container.
Cloud Run container instances are limited to 100 connections to a Cloud SQL database. Each instance of a Cloud Run service or job can have 100 connections to the database, and as this service or job scales, the total number of connections per deployment can grow.
You can limit the maximum number of connections used per instance by using a connection pool. For more detailed examples on how to limit the number of connections, see the Managing database connections page.
Except as otherwise noted, the content of this page is licensed under the Creative Commons Attribution 4.0 License, and code samples are licensed under the Apache 2.0 License. For details, see the Google Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.
Last updated 2025-04-17 UTC.