proxy_with_http_health_check.yaml

# Copyright 2021 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# You must configure probes in your deployment to use health checks in Kubernetes.
# This sample configuration for HTTP probes is adapted from proxy_with_workload_identity.yaml.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: <YOUR-DEPLOYMENT-NAME>
spec:
  selector:
    matchLabels:
      app: <YOUR-APPLICATION-NAME>
  template:
    metadata:
      labels:
        app: <YOUR-APPLICATION-NAME>
    spec:
      containers:
      - name: <YOUR-APPLICATION-NAME>
        # ... other container configuration
        env:
        - name: DB_USER
          valueFrom:
            secretKeyRef:
              name: <YOUR-DB-SECRET>
              key: username
        - name: DB_PASS
          valueFrom:
            secretKeyRef:
              name: <YOUR-DB-SECRET>
              key: password
        - name: DB_NAME
          valueFrom:
            secretKeyRef:
              name: <YOUR-DB-SECRET>
              key: database
      # The proxy should be run as a native sidecar container, available in
      # Kubernetes 1.29 and higher. This will ensure that the proxy container
      # is ready before the main application container is started, and
      # that the proxy container's exit status will not impact the pod's exit
      # status. See the Kubernetes documentation:
      # https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/
      initContainers:
      - name: cloud-sql-proxy
        restartPolicy: Always
        # It is recommended to use the latest version of the Cloud SQL Auth Proxy
        # Make sure to update on a regular schedule!
        image: gcr.io/cloud-sql-connectors/cloud-sql-proxy:2.11.4
        imagePullPolicy: IfNotPresent

        args:
        # Replace <INSTANCE_CONNECTION_NAME> with the instance connection
        # name in the format: "project_name:region:instance_name"
        - <INSTANCE_CONNECTION_NAME>

        env:
        # Using environment variables instead of CLI arguments to configure the
        # proxy k8s configuration can make it easier to read your
        # k8s configuration files.
        #
        # This is the recommended configuration for your proxy pod template.
        # It is used by the cloud-sql-proxy-operator when configuring the
        # proxy container.

        # Replace <DB_PORT> with the port that the proxy should open
        # to listen for database connections from the application
        - name: CSQL_PROXY_PORT
          value: <DB_PORT>

        # If connecting from a VPC-native GKE cluster, you can use the
        # following flag to have the proxy connect over private IP
        # - name: CSQL_PROXY_PRIVATE_IP
        #   value: "true"

        # Enable HTTP healthchecks on port 9801. This enables /liveness,
        # /readiness and /startup health check endpoints. Allow connections
        # listen for connections on any interface (0.0.0.0) so that the
        # k8s management components can reach these endpoints.
        - name: CSQL_PROXY_HEALTH_CHECK
          value: "true"
        - name: CSQL_PROXY_HTTP_PORT
          value: "9801"
        - name: CSQL_PROXY_HTTP_ADDRESS
          value: 0.0.0.0

        # Configure the proxy to exit gracefully when sent a k8s configuration
        # file.
        - name: CSQL_PROXY_EXIT_ZERO_ON_SIGTERM
          value: "true"

        # Enable the admin api server (which only listens for local connections)
        # and enable the /quitquitquit endpoint. This allows other pods
        # to shut down the proxy gracefully when they are ready to exit.
        - name: CSQL_PROXY_QUITQUITQUIT
          value: "true"
        - name: CSQL_PROXY_ADMIN_PORT
          value: "9092"

        # Enable structured logging with LogEntry format
        - name: CSQL_PROXY_STRUCTURED_LOGS
          value: "true"

        # Configure kubernetes to call run the cloud-sql-proxy shutdown command
        # before sending SIGTERM to the proxy when stopping the pod. This will
        # give the proxy more time to gracefully exit.
        lifecycle:
          preStop:
            exec:
              command: ["/cloud-sql-proxy","shutdown", "--admin-port","9092"]

        # The /startup probe returns OK when the proxy is ready to receive
        # connections from the application. In this example, k8s will check
        # once a second for 60 seconds.
        #
        # We strongly recommend adding a startup probe to the proxy sidecar
        # container. This will ensure that service traffic will be routed to
        # the pod only after the proxy has successfully started.
        startupProbe:
          failureThreshold: 60
          httpGet:
            path: /startup
            port: 9801
            scheme: HTTP
          periodSeconds: 1
          successThreshold: 1
          timeoutSeconds: 10
        # The /liveness probe returns OK as soon as the proxy application has
        # begun its startup process and continues to return OK until the
        # process stops.
        #
        # We recommend adding a liveness probe to the proxy sidecar container.
        livenessProbe:
          failureThreshold: 3
          httpGet:
            path: /liveness
            port: 9801
            scheme: HTTP
          # The probe will be checked every 10 seconds.
          periodSeconds: 10
          # Number of times the probe is allowed to fail before the transition
          # from healthy to failure state.
          #
          # If periodSeconds = 60, 5 tries will result in five minutes of
          # checks. The proxy starts to refresh a certificate five minutes
          # before its expiration. If those five minutes lapse without a
          # successful refresh, the liveness probe will fail and the pod will be
          # restarted.
          successThreshold: 1
          # The probe will fail if it does not respond in 10 seconds
          timeoutSeconds: 10
        readinessProbe:
          # The /readiness probe returns OK when the proxy can establish
          # a new connections to its databases.
          #
          # Please use the readiness probe to the proxy sidecar with caution.
          # An improperly configured readiness probe can cause unnecessary
          # interruption to the application. See README.md for more detail.
          httpGet:
            path: /readiness
            port: 9801
          initialDelaySeconds: 10
          periodSeconds: 10
          timeoutSeconds: 10
          # Number of times the probe must report success to transition from failure to healthy state.
          # Defaults to 1 for readiness probe.
          successThreshold: 1
          failureThreshold: 6

        # Declare the HTTP Port so that k8s components can reach the
        # metrics and health check endpoints.
        ports:
        - containerPort: 9801
          protocol: TCP
        # You should use resource requests/limits as a best practice to prevent
        # pods from consuming too many resources and affecting the execution of
        # other pods. You should adjust the following values based on what your
        # application needs. For details, see
        # https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
        resources:
          requests:
            # The proxy's memory use scales linearly with the number of active
            # connections. Fewer open connections will use less memory. Adjust
            # this value based on your application's requirements.
            memory: "2Gi"
            # The proxy's CPU use scales linearly with the amount of IO between
            # the database and the application. Adjust this value based on your
            # application's requirements.
            cpu:    "1"
        securityContext:
          # The default Cloud SQL Auth Proxy image runs as the
          # "nonroot" user and group (uid: 65532) by default.
          runAsNonRoot: true
          # Use a read-only filesystem
          readOnlyRootFilesystem: true
          # Do not allow privilege escalation
          allowPrivilegeEscalation : false
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      volumes:
      - name: <YOUR-SA-SECRET-VOLUME>
        secret:
          secretName: <YOUR-SA-SECRET>