Why should you care?

PostgresVerse on GCP uses Auth Proxy sidecar in GKE so pods connect localhost:5432 to Cloud SQL instance securely.

See it live — copy this example

Run in pgAdmin or psql.

# Start proxy locally (lab)
cloud-sql-proxy PROJECT:REGION:postgresverse-instance

# separate terminal
psql "host=127.0.0.1 port=5432 dbname=PostgresVerse user=postgres"

SELECT current_setting('cloudsql.enable_pg_cron');

Run Example »

This lesson uses terminal or setup steps. Run commands on your computer — the live editor appears on coding lessons.

What happened?

• Proxy tunnels to Cloud SQL with IAM auth.
• Localhost connection avoids opening postgres to internet.
• Some flags exposed as cloudsql.* settings.

Practice next

1. Create Cloud SQL PG instance in GCP console.
2. Run cloud-sql-proxy with service account key or ADC.
3. Connect psql via localhost tunnel.
4. Create read replica; query pg_is_in_recovery on replica IP via proxy.
5. Use IAM database authentication user instead of password.

Remember

Auth Proxy recommended for GKE/Compute apps. HA configuration adds standby in another zone. Point-in-time recovery enabled in backup settings.

PostgresVerse GKE sidecar

Each pod runs cloud-sql-proxy container; app connects 127.0.0.1.

Outcome: No postgres password in K8s secret; IAM rotation automated.