postgres-proxy.yml

parameters:
  database:
    instance: example:instance

  service_accounts:
    postgres-proxy:
      ref: plain:targets/${target_name}/postgres-proxy-service-account
      secret: ?{plain:targets/${target_name}/postgres-proxy-service-account||randomstr}
      name: postgres-proxy@${google_project}.iam.gserviceaccount.com

  scripts:
    - templates/scripts/generate_sa_secrets.sh

  components:
    postgres-proxy:
      image: gcr.io/cloudsql-docker/gce-proxy:1.16
      command:
        - /cloud_sql_proxy
      args:
        - '-instances=$(CLOUDSQL_INSTANCE_NAME)=tcp:0.0.0.0:5432'
      env:
        CLOUDSQL_INSTANCE_NAME: ${database:instance}
        GOOGLE_APPLICATION_CREDENTIALS: /opt/secrets/service_account_file
      replicas: 3
      pdb_min_available: 2
      vpa: Auto
      healthcheck:
        liveness:
          type: tcp
          port: postgresql
          timeout_seconds: 1
      service:
        type: ClusterIP
      ports:
        postgresql:
          service_port: 5432
      labels:
        tier: db
      enable_prometheus: false
      deployment_progress_deadline_seconds: 600
      min_ready_seconds: 30
      security:
        allow_privilege_escalation: false
        user_id: 2
      secrets:
        secrets:
          mount: /opt/secrets
          items: ['service_account_file']
          data:
            service_account_file:
              value: ${service_accounts:postgres-proxy:secret}