How to Use Cloud SQL Skills for MySQL: Complete Setup and Connection Guide

Use the Cloud SQL Basics skill in the google/skills repository to provision a managed MySQL instance through gcloud commands and connect securely via the Cloud SQL Auth Proxy.

The Cloud SQL Basics skill provides a production-ready workflow for deploying Google Cloud SQL with MySQL. This open-source skill, maintained in the google/skills repository, includes reference files with tested commands for instance creation, IAM configuration, and secure client connectivity. This guide walks through the complete implementation based on the official skill source files.

Enable Required APIs and IAM Permissions

Before creating any resources, you must enable the Cloud SQL Admin API and ensure your identity has appropriate permissions.

Enable the Cloud SQL Admin API

gcloud services enable sqladmin.googleapis.com --quiet

This command activates the sqladmin.googleapis.com service, which powers all gcloud sql operations. As noted in SKILL.md (lines 34-36), this is the mandatory first step before instance provisioning.

Required IAM Role

The skill documentation specifies that you need Cloud SQL Admin (roles/cloudsql.admin) to create and manage instances. For production environments, consider Cloud SQL Client (roles/cloudsql.client) for applications that only need to connect to existing instances. These permissions are detailed in references/iam-security.md.

Create a MySQL Instance with gcloud

The references/cli-usage.md file contains the definitive command structure for MySQL instance creation. Here's the recommended configuration:

gcloud sql instances create my-mysql-instance \
  --database-version=MYSQL_8_0 \
  --tier=db-f1-micro \
  --region=us-central1 \
  --storage-size=10GB \
  --no-assign-ip

Key parameters explained:

• --database-version=MYSQL_8_0 – Specifies MySQL 8.0; also supports MYSQL_5_7 for legacy compatibility
• --tier=db-f1-micro – Shared-core machine type suitable for development; upgrade to db-n1-standard-2 or higher for production workloads
• --no-assign-ip – Creates a private-IP-only instance, forcing connections through the Auth Proxy or VPC peering

Configure Users and Databases

Set the Root Password

gcloud sql users set-password root \
  --instance=my-mysql-instance \
  --password=MyStrongPassword123 \
  --quiet

This command, sourced from cli-usage.md, establishes authentication credentials for the initial administrative access.

Create Your Application Database

gcloud sql databases create my_database \
  --instance=my-mysql-instance \
  --charset=utf8mb4 \
  --collation=utf8mb4_general_ci \
  --quiet

The utf8mb4 character set ensures full Unicode support, including emoji and mathematical symbols, as recommended in the skill's reference documentation.

Connect Securely with Cloud SQL Auth Proxy

The Cloud SQL Auth Proxy eliminates the need to expose your database to the public internet or manage SSL certificates manually. The skill implementation in SKILL.md (lines 71-95) provides this two-step process:

1. Capture the Instance Connection Name

INSTANCE_CONNECTION_NAME=$(gcloud sql instances describe my-mysql-instance \
  --format="value(connectionName)" --quiet)

echo $INSTANCE_CONNECTION_NAME

# Output: your-project:us-central1:my-mysql-instance

2. Download and Start the Proxy

# Download the current stable release

wget https://storage.googleapis.com/cloud-sql-connectors/cloud-sql-proxy/v2.9.0/cloud-sql-proxy.linux.amd64 -O cloud-sql-proxy
chmod +x cloud-sql-proxy

# Start proxy (listens on local port 3306)

./cloud-sql-proxy $INSTANCE_CONNECTION_NAME

The proxy authenticates using your local gcloud credentials and establishes an encrypted tunnel to your instance.

3. Connect with Standard MySQL Client

mysql -u root -pMyStrongPassword123 \
  -h 127.0.0.1 \
  -P 3306 \
  my_database

Your application or CLI tools now connect to 127.0.0.1:3306 as if MySQL were running locally, with all traffic encrypted through Google's infrastructure.

Production Deployment: Cloud Run with IAM Authentication

For serverless deployments, the skill's iam-security.md reference demonstrates passwordless authentication using IAM service accounts. Mount the Auth Proxy as a sidecar container and configure your application to connect through the Unix socket:

# Connection string format in your application

socketPath: "/cloudsql/${INSTANCE_CONNECTION_NAME}"

The proxy automatically handles IAM token exchange, eliminating credential rotation and secret management complexity.

Infrastructure as Code Alternative

The skill includes Terraform configurations in references/iac-usage.md for teams preferring declarative infrastructure. This enables version-controlled, reproducible MySQL deployments integrated with your CI/CD pipeline.

Reference File Structure

File	Purpose	Location in Repository
SKILL.md	Architecture overview and quick-start workflow	skills/cloud/cloud-sql-basics/SKILL.md
references/cli-usage.md	Complete gcloud sql command reference	skills/cloud/cloud-sql-basics/references/cli-usage.md
references/iam-security.md	IAM roles, SSL/TLS, and Auth Proxy patterns	skills/cloud/cloud-sql-basics/references/iam-security.md
references/client-library-usage.md	Python, Java, Node.js, Go connection examples	skills/cloud/cloud-sql-basics/references/client-library-usage.md
references/iac-usage.md	Terraform modules for Cloud SQL provisioning	skills/cloud/cloud-sql-basics/references/iac-usage.md

Summary

• Cloud SQL Basics skill in google/skills provides authoritative, tested commands for MySQL deployment
• Enable sqladmin.googleapis.com and obtain roles/cloudsql.admin before creating resources
• Use --no-assign-ip with the Auth Proxy for production-grade security without public internet exposure
• Reference cli-usage.md for user management, database creation, and backup operations
• Implement IAM authentication for passwordless connections from Cloud Run and other Google Cloud services

Frequently Asked Questions

What MySQL versions does Cloud SQL support?

Cloud SQL supports MySQL 5.7 and MySQL 8.0. Specify your version with --database-version=MYSQL_8_0 or MYSQL_5_7 when creating instances. The skill's cli-usage.md reference includes version-specific considerations for upgrade paths.

Do I need the Auth Proxy if my instance has a public IP?

No, but it's strongly discouraged to use public IPs without the proxy. The skill documentation emphasizes that the Cloud SQL Auth Proxy provides automatic IAM authentication and encrypted tunnels even for public IP instances, eliminating the need to configure authorized networks or manage client SSL certificates.

How do I connect from a local development machine to a private-IP-only instance?

Use the Cloud SQL Auth Proxy as shown in this guide. The proxy authenticates using your local gcloud credentials and tunnels traffic through Google's internal network, so your machine does not need VPC connectivity. This is the primary local development pattern documented in SKILL.md lines 84-95.

Where are the client library examples for Python and other languages?

The skill includes a dedicated reference file at references/client-library-usage.md with connection examples for Python (SQLAlchemy), Java (JDBC), Node.js (mysql2), and Go (database/sql). These examples demonstrate both direct TCP connections with SSL certificates and proxy-based Unix socket connections.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}