Cloud Run and Cloud SQL: a complete assessment walkthrough

The run in figures

Assessed by StackToIT on 4 November 2026, offline, on an estate written for this page. All numbers are from the run’s console output and assessment.json.

The run finished with 12 of 12 global invariants passing, three of which checked nothing for this estate.

The database: Cloud SQL to PostgreSQL Flex

Left: the regional PostgreSQL 16 instance of the input, with private IP and point-in-time recovery. Right: the blocks of the STACKIT Terraform the run wrote; the review comments above each block in the file are left out here.

resource "google_sql_database_instance" "orders" {
  name             = "orders-pg"
  region           = "europe-west3"
  database_version = "POSTGRES_16"
  depends_on       = [google_service_networking_connection.sql]

  settings {
    tier              = "db-custom-2-8192"
    availability_type = "REGIONAL"
    disk_size         = 100
    disk_type         = "PD_SSD"

    ip_configuration {
      ipv4_enabled    = false
      private_network = google_compute_network.shop.id
    }

    backup_configuration {
      enabled                        = true
      point_in_time_recovery_enabled = true
    }
  }
}

resource "google_sql_database" "orders" {
  name     = "orders"
  instance = google_sql_database_instance.orders.name
}

resource "stackit_postgresflex_instance" "orders" {
  project_id = var.project_id
  name       = "orders-pg"
  version    = "16"
  flavor_id  = "2.16-replica"
  storage = {
    class = var.postgresflex_storage_class
    size  = 100
  }
  backup_schedule = "0 2 * * *"
  network = {
    acl = var.orders_allowed_cidrs
  }
  retention_days = 32
}

resource "stackit_postgresflex_database" "orders_orders" {
  project_id  = var.project_id
  instance_id = stackit_postgresflex_instance.orders.instance_id
  name        = "orders"
  owner       = var.orders_orders_owner
}

• Version, storage and database carry over

  PostgreSQL 16, 100 GB and the database name are in the draft. The regional tier db-custom-2-8192 becomes flavor 2.16-replica, which the run's comment describes as 2 vCPU and 16 GiB: the smallest replica flavor in eu01 that covers 2 vCPU and 8 GB.

• Private IP has no counterpart

  The instance is reached at the endpoint STACKIT assigns, limited by an ACL. The list of allowed addresses is a variable you fill.

• Point-in-time recovery is not a setting

  STACKIT’s backup-and-clone how-to confirms it: restoring a backup, including to a point in time, creates a new instance in the same project, and there is no in-place restore. The input sets no retention, so Cloud SQL keeps its default of seven automated backups; the run records that as 7 days, and the draft sets retention_days = 32. The 02:00 daily backup schedule is a default the run says you should confirm.

The service: Cloud Run to a workload on SKE

Left: the Cloud Run service with its secret reference, bucket variable and VPC access. Right: the cluster the run drafted to host it as a Deployment.

resource "google_cloud_run_v2_service" "orders" {
  name     = "orders-api"
  location = "europe-west3"
  ingress  = "INGRESS_TRAFFIC_ALL"

  template {
    service_account = google_service_account.api.email

    scaling {
      min_instance_count = 1
      max_instance_count = 10
    }

    vpc_access {
      egress = "PRIVATE_RANGES_ONLY"
      network_interfaces {
        network    = google_compute_network.shop.id
        subnetwork = google_compute_subnetwork.apps.id
      }
    }

    containers {
      image = "europe-west3-docker.pkg.dev/shop-prod/images/orders-api:2.4.0"

      resources {
        limits = {
          cpu    = "1"
          memory = "512Mi"
        }
      }

      env {
        name  = "RECEIPTS_BUCKET"
        value = google_storage_bucket.receipts.name
      }

      env {
        name = "DB_PASSWORD"
        value_source {
          secret_key_ref {
            secret  = google_secret_manager_secret.db_password.secret_id
            version = "latest"
          }
        }
      }
    }
  }
}

resource "stackit_ske_cluster" "containers" {
  project_id = var.project_id
  name       = "containers"
  node_pools = [{
    name               = "workloads"
    machine_type       = var.containers_machine_type
    minimum            = var.containers_nodes_min
    maximum            = var.containers_nodes_max
    availability_zones = var.availability_zones
  }]
}

• The image moves, the manifest is yours

  The run writes the cluster. The Deployment and Service manifests are not generated; name, environment, resources, service account and network settings are listed as not carried.

• Public access is flagged

  The allUsers invoker binding raises a warning: anyone may call the service today, and your ingress on SKE must decide who may in future.

• Scaling bounds go into your manifest

  The source keeps 1 to 10 instances. The cluster has no workload yet, so set replicas and an autoscaler (for example a HorizontalPodAutoscaler) yourself. The run also warns that scale-to-zero needs KEDA or Knative on SKE; with a minimum of one instance this service does not rely on it.

Every unit, its wave and its target

From migration/technical-sequencing.md. A unit moves only after the units it depends on.

The interesting decisions

Each comes from a warning or a not-carried line the run wrote next to the block.

• How clients reach the database

  The source database has no public address. On STACKIT it has an endpoint with an ACL. Decide the allowed ranges, and whether the new workload reaches it through the cluster’s egress addresses.

• Recovery and retention

  Point-in-time recovery restores into a new instance on PostgreSQL Flex, and the draft keeps backups 32 days, where the source relies on Cloud SQL’s default of seven automated backups. Check both against your recovery point objective and update the recovery runbook, including where clients connect after a restore.

• Instance size

  The run picks 2.16-replica because the source is regional (a standby in a second zone). The run itself notes that no STACKIT page states the zone of each replica node or how a failover works, so confirm the flavor and the availability you need before you apply.

• Protection against deletion

  Terraform’s deletion protection on the Cloud SQL instance guards only the Terraform workflow, and the draft does not add a counterpart. Add lifecycle { prevent_destroy = true } as the run advises; the PostgreSQL Flex documentation also recommends instance protection for critical instances.

• Who may call the API

  The source allows anyone. Decide whether the new ingress stays public, sits behind a gateway or requires a token.

• Secret and its readers

  The secret is recreated as a key by hand; the value is never copied into the draft, and the accessor binding is not carried.

• Bucket versioning

  The source bucket is versioned. The run notes that STACKIT Object Storage supports versioning through the S3 API, but the bucket resource has no versioning attribute, so the draft block sets only name and project. Turn versioning on after the bucket exists; once on, it can only be suspended.

• Data movement

  migration/data-movement.md lists the database and the bucket as decisions with no mechanism chosen, because the source states neither data size nor tolerated downtime. The unit reasons name pg_dump with pg_restore or logical replication for the database and rclone for the bucket.

Where to read each answer

index.html

The summary and the decision pages, offline

assessment.json

Every unit with class, target, reason and findings

terraform/

The STACKIT draft, one file per area

migration/technical-sequencing.md

The waves above

migration/data-movement.md

Database and bucket with the open data decisions

execution/manual/actions.md

The 16 work packages of manual steps, each with an owner

engineering/architect-report.md

Findings, validation matrix and what is not proven

Questions architects ask about this run

Sources

• Google Cloud: What is Cloud Run
• Google Cloud: Cloud SQL for PostgreSQL overview
• STACKIT docs: PostgreSQL Flex
• STACKIT docs: Kubernetes Engine (SKE)
• Google Cloud: Create and manage on-demand and automatic backups
• STACKIT docs: Backup and clone PostgreSQL Flex