Skip to main content
Dial configuration controls how the Connector establishes the upstream connection for a Resource. It is optional. When absent, the Connector dials direct TCP using the Resource’s hostname and port. This is the default and matches the behavior of every Resource before this feature.

​
Dial methods

​
tcp (default)

The Connector dials hostname:port directly. This fits self-managed databases, Amazon RDS and Aurora, and any other endpoint reachable over plain TCP from the Connector.

​
gcp_cloudsql

The Connector dials Google Cloud SQL natively, similarly to what Google’s cloud-sql-proxy does. Ephemeral mTLS certificates are minted and rotated automatically, and the connection is encrypted end-to-end by Cloud SQL. gcp_cloudsql requires dial_target to be the Cloud SQL instance connection name in project:region:instance form. Supported only for postgres, mysql, and mariadb Resources. Connector prerequisites:
  • The Connector runs in the Cloud SQL instance’s VPC, or in a peered / PSC-connected VPC. The dial targets the instance’s private IP.
  • Application Default Credentials configured: the GOOGLE_APPLICATION_CREDENTIALS environment variable points at a service account JSON key, or the Connector runs on a GCP workload with a bound identity.
  • The credentials grant roles/cloudsql.client on the project that owns the Cloud SQL instance.
With gcp_cloudsql, the Resource’s TLS configuration is ignored.

​
gcp_connectgateway

The Connector reaches a Kubernetes cluster through GKE Connect Gateway instead of the cluster’s own API server endpoint. This works for GKE clusters and for other fleet clusters, such as GKE on bare metal or attached clusters. The Resource’s hostname is the gateway endpoint, connectgateway.googleapis.com for global memberships or <location>-connectgateway.googleapis.com for regional ones, and its port is 443. gcp_connectgateway requires dial_target to be the cluster’s fleet membership name in projects/<project-number>/locations/<location>/memberships/<membership> form. Connect Gateway only accepts the project number, not the project ID; gcloud projects describe <project> --format='value(projectNumber)' returns it. Supported only for kubernetes Resources. The Connector reads the fleet membership to know whether the cluster is a GKE cluster, since the gateway serves the two kinds under different paths. The gateway roles below already include the permission this needs. Connector prerequisites:
  • The cluster is registered to a fleet, and the Connect Gateway API (connectgateway.googleapis.com) and the GKE Hub API (gkehub.googleapis.com) are enabled on the fleet host project.
  • The Resource’s native users use GCP IAM authentication, so the Connector sends an access token from its Application Default Credentials.
  • The credentials grant roles/gkehub.gatewayReader for read-only access or roles/gkehub.gatewayEditor for read and write access on the fleet host project. kubectl exec, attach, cp, and port-forward need roles/gkehub.gatewayAdmin.
  • Kubernetes RBAC in the cluster binds the service account email of those credentials.
  • exec, attach, and cp need the cluster on Kubernetes 1.30 or later, and port-forward needs 1.31 or later.

​
Configure dial configuration

1

Open the Resource

Navigate to Resources and open the target Resource.
2

Open the Connectivity tab

Select the Connectivity tab. The Dial Configuration section is where the dial method and target are set.
3

Pick a dial method

Selecting TCP keeps the default. Selecting Google Cloud SQL routes upstream connections natively. Selecting GKE Connect Gateway routes Kubernetes requests through the gateway.
4

Set the dial target

For Cloud SQL, enter the instance connection name in project:region:instance form (for example my-project:us-central1:pg-prod). For GKE Connect Gateway, enter the fleet membership name (for example projects/1234567/locations/global/memberships/prod). Then click Save.
A Resource has at most one dial configuration. Deleting it restores the default tcp behavior.

​
Verify

After applying the configuration, run the standard connectivity check:
  1. From the Resource Details page, click Test Connection (or Test Connectors for a specific Connector).
  2. The check should report success for the TCP, TLS, Authentication, and Data Access stages.
See Testing Resource Connectivity for what each stage validates.
For Cloud SQL, the first dial against a new instance adds roughly one second of latency while the ephemeral certificate is minted. Subsequent dials within the hour reuse the cached certificate.