This page describes how to connect to your Cloud SQL instance using the
Cloud SQL Proxy Operator. For more information about how the Cloud SQL Proxy Operator works, see
[About the Cloud SQL Proxy Operator](https://docs.cloud.google.com/sql/docs/mysql/sql-proxy.md.txt#proxy-operator).

## Overview

The Cloud SQL Proxy Operator configures applications deployed on Google Kubernetes Engine
(GKE) to connect to Cloud SQL database instances
using the Cloud SQL Auth Proxy. Using the
[Cloud SQL Auth Proxy](https://docs.cloud.google.com/sql/docs/mysql/sql-proxy.md.txt) is the recommended
method for connecting to a Cloud SQL instance. To learn more about
the Cloud SQL Auth Proxy, see [About the Cloud SQL Auth Proxy](https://docs.cloud.google.com/sql/docs/mysql/sql-proxy.md.txt).

Applications running in [GKE](https://docs.cloud.google.com/sql/docs/mysql/connect-kubernetes-engine.md.txt#proxy) can connect using the Cloud SQL Auth Proxy.

## Before you begin

Before you can connect to a Cloud SQL instance, do the following:

1. For a user or service account, make sure the account has the
   Cloud SQL Client role. This role contains the
   `cloudsql.instances.connect` permission,
   which authorizes a principal to connect to all Cloud SQL instances
   in a project.

   [Go to the IAM page](https://console.cloud.google.com/iam-admin/iam)

   You can optionally include an
   [IAM condition](https://docs.cloud.google.com/sql/docs/mysql/project-access-control#allow_users_to_connect_to_specific_instances)
   in the IAM policy binding that grants the account permission
   to connect only to one specific Cloud SQL instance.
2.


   Enable the Cloud SQL Admin API, if it is not already enabled.


   **Roles required to enable APIs**


   To enable APIs, you need the `serviceusage.services.enable` permission. If you
   created the project, then you likely already have this permission through the
   Owner role (`roles/owner`). Otherwise, you can get this permission through the
   Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`).
   [Learn how to grant roles](https://docs.cloud.google.com/iam/docs/granting-changing-revoking-access.md.txt).

   [Enable the API](https://console.cloud.google.com/apis/enableflow?apiid=sqladmin)
3. Install and initialize the [gcloud CLI](https://docs.cloud.google.com/sdk/docs/install).

## Install the Cloud SQL Proxy Operator

Use the following steps to install the Cloud SQL Proxy Operator.

1. Confirm that `kubectl` can connect to your GKE cluster.

   ```bash
   kubectl cluster-info
   ```
   For more information about connecting Google Kubernetes Engine to Cloud SQL, see [Connect from Google Kubernetes Engine](https://docs.cloud.google.com/sql/docs/mysql/connect-kubernetes-engine.md.txt).
2. Install `cert-manager` using helm. You will need to use the version and cli arguments specified here to use `cert-manager` on your GKE cluster.

   ```bash
         helm repo add jetstack https://charts.jetstack.io
         helm repo update
         helm install \
           cert-manager jetstack/cert-manager \
           --namespace cert-manager \
           --version "v1.9.1" \
           --create-namespace \
           --set global.leaderElection.namespace=cert-manager \
           --set installCRDs=true
       
   ```
3. Install the Cloud SQL Proxy Operator to your kubernetes cluster:

   ```bash
   kubectl apply -f https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy-operator/v1.8.4/cloud-sql-proxy-operator.yaml
       
   ```
4. Wait for the Cloud SQL Proxy Operator to start.

   ```bash
   kubectl rollout status deployment -n cloud-sql-proxy-operator-system cloud-sql-proxy-operator-controller-manager --timeout=90s
       
   ```
5. Confirm that the Cloud SQL Proxy Operator is installed and running:

   ```bash
   kubectl get pods -n cloud-sql-proxy-operator-system
     
   ```

## What's next

<br />

- Learn more about the [Cloud SQL Auth Proxy](https://docs.cloud.google.com/sql/docs/mysql/sql-proxy.md.txt).
- Learn more about [Identity and Access Management (IAM)](https://docs.cloud.google.com/iam/docs/overview.md.txt).
- Learn more about [Service Accounts](https://docs.cloud.google.com/iam/docs/understanding-service-accounts).
- Learn about the [two levels of access control](https://docs.cloud.google.com/sql/docs/mysql/instance-access-control.md.txt) for Cloud SQL instances.
- Create [users](https://docs.cloud.google.com/sql/docs/mysql/create-manage-users.md.txt) and [databases](https://docs.cloud.google.com/sql/docs/mysql/create-manage-databases.md.txt).
- Learn about [connecting to your instance from your application](https://docs.cloud.google.com/sql/docs/mysql/instance-access-control.md.txt#instanceaccess).
- Learn about [MySQL Client](https://dev.mysql.com/doc/refman/8.4/en/mysql.html).
- Learn about [options for support](https://docs.cloud.google.com/sql/docs/support).

<br />