The database was fine. The problem was access.
Securing GCP database access from OpenShift is a precise job. A single misstep in identity, networking, or secrets management can open an attack surface you cannot see. The goal is to lock every path except the one you choose.
First, isolate the database in a private VPC. Disallow public IP access. Use Private Service Connect or VPC peering to link your GCP database instance—whether Cloud SQL, Spanner, or AlloyDB—to your OpenShift cluster’s network. This removes internet exposure by design.
Next, control identity. Rely on GCP Service Accounts for database authentication. Instead of static passwords, use short-lived IAM tokens. In OpenShift, mount these credentials through Kubernetes Secrets or link directly with workload identity federation to bypass long-term keys. This reduces the risk of compromised credentials being reused.
Enforce the principle of least privilege with IAM roles scoped tightly to the database. Avoid broad roles/editor or roles/owner grants. Audit all permissions regularly using GCP’s policy analyzer and OpenShift’s RBAC inspection tools.
Enable database-level encryption at rest by default. Configure SSL/TLS for connections in transit. In GCP, issue client certificates and require server verification to block man-in-the-middle attacks. Make SSL enforcement mandatory on the database side to stop plaintext connections.
Monitor continuously. Google Cloud’s Cloud SQL Insights and Cloud Audit Logs track connection sources and authentication attempts. On the OpenShift side, integrate these logs into your central SIEM. Trigger alerts for unusual query rates, off-hours access, or new source IPs.
Automate secret rotation. Use GCP Secret Manager to store credentials. Sync secrets to OpenShift through an operator or pipeline that updates pods without downtime. Rotate keys and tokens on a set schedule, not only when a breach is suspected.
Test disaster recovery. Restrict who can trigger database exports or backups. Lock down storage buckets with IAM conditions so backup files cannot be downloaded from unknown networks.
Every step should eliminate guesswork and manual drift. Done right, you get a system where GCP and OpenShift trust only what you tell them to trust—no more, no less.
Want to see this kind of locked-down GCP database access flow in OpenShift, live, without weeks of setup? Try it in minutes at hoop.dev.