Untuk mengaktifkan koneksi ke cluster database dari alamat IP di luar organisasi
GDC Anda, lihat Mengaktifkan koneksi eksternal.
Login ke konsol GDC dengan akun yang terikat ke peran
project-db-admin untuk menemukan informasi berikut guna terhubung ke cluster
database Anda. Informasi ini ada di bagian Connectivity di halaman
Database Service.
Langkah-langkah ini mencakup contoh untuk menghubungkan ke database menggunakan psql. Langkah-langkah
persisnya akan bervariasi bergantung pada software klien yang Anda pilih.
Konsol
Buka bagian Konektivitas di halaman Database Service untuk cluster database. Halaman ini mencakup:
Sandi akun administrator (nama penggunanya adalah dbsadmin)
Nama host dan nomor port endpoint utama cluster database
Jika cluster database mengizinkan koneksi eksternal dari luar
organisasi.
Perintah psql untuk menghubungkan ke cluster (untuk cluster database PostgreSQL dan AlloyDB Omni)
String untuk terhubung ke cluster dengan Java Database Connectivity
(JDBC) (untuk cluster database Oracle)
Link untuk mendownload sertifikat certificate authority (CA) cluster database
Download sertifikat CA dari konsol GDC di bagian
Connectivity pada halaman Database Service untuk
cluster database Anda.
Konfigurasi klien Anda untuk menggunakan sertifikat CA guna memverifikasi database. Untuk klien
psql, tetapkan variabel lingkungan PGSSLROOTCERT ke jalur file
sertifikat dan variabel lingkungan PGSSLMODE ke preferensi Anda:
Konfigurasi klien Anda untuk menggunakan sertifikat CA guna memverifikasi database. Untuk klien
psql, Anda dapat menetapkan variabel lingkungan PGSSLROOTCERT ke jalur
file sertifikat dan variabel lingkungan PGSSLMODE ke preferensi Anda:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[],[],null,["# Connect to a database cluster\n\nBy default, a database cluster only allows connection from within the\n[user cluster](/distributed-cloud/hosted/docs/latest/gdch/resources/resource-hierarchy#cluster) and the same project.\n\nTo enable connections to all database clusters in your project from another\nproject, see [Enable cross-project connections](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/db-cross-project-connect).\n\nTo enable connections to a database cluster from IP addresses outside your\nGDC organization, see [Enable external connections](/distributed-cloud/hosted/docs/latest/gdch/application/ao-user/db-external-project-connect).\n\nSign in to the GDC console with an account bound to the\n`project-db-admin` role to find the following information for connecting to your\ndatabase cluster. This information is in the **Connectivity** section of the\n**Database Service** page.\n\nThese steps include an example for connecting to the database using `psql`. The\nexact steps will vary depending on the client software you choose. \n\n### Console\n\n1. Navigate to the **Connectivity** section of the **Database Service** page\n for the database cluster. This page includes:\n\n - The password of the administrator account (the username is `dbsadmin`)\n - Hostname and port number of the database cluster's primary endpoint\n - If the database cluster allows external connection from outside of the organization.\n - A `psql` command for connecting to the cluster (for PostgreSQL and AlloyDB Omni database clusters)\n - A string for connecting to the cluster with Java Database Connectivity (JDBC) (for Oracle database clusters)\n - A link to download the certificate authority (CA) certificate of the database cluster\n2. Download the CA certificate from the GDC console in the\n **Connectivity** section of the **Database Service** page for your\n database cluster.\n\n3. Configure your client to use the CA certificate to verify the database. For\n `psql` clients, set the `PGSSLROOTCERT` env variable to the path of the\n certificate file and the `PGSSLMODE` env variable to your preference:\n\n export PGSSLROOTCERT=\u003cvar translate=\"no\"\u003epath/to/\u003c/var\u003eaccounts_cert.pem\n export PGSSLMODE=\"verify-full\"\n\n4. Connect to the database from your client software. If you're using `psql`,\n run the following command:\n\n PGPASSWORD=\u003cvar translate=\"no\"\u003eDB_PASSWORD\u003c/var\u003e psql -h \u003cvar translate=\"no\"\u003eDB_HOSTNAME\u003c/var\u003e -p \u003cvar translate=\"no\"\u003ePORT\u003c/var\u003e -U \u003cvar translate=\"no\"\u003eUSERNAME\u003c/var\u003e -d postgres\n\nReplace the following variables:\n\n- \u003cvar translate=\"no\"\u003epath/to/\u003c/var\u003e: the path to the `accounts_cert.pem` certificate.\n- \u003cvar translate=\"no\"\u003eDB_PASSWORD\u003c/var\u003e: the password from the console.\n- \u003cvar translate=\"no\"\u003eDB_HOSTNAME\u003c/var\u003e: the database hostname from the console.\n- \u003cvar translate=\"no\"\u003eDB_PORT\u003c/var\u003e: the database port number from the console.\n- \u003cvar translate=\"no\"\u003eDB_USERNAME\u003c/var\u003e: the database username from the console.\n\n### API\n\n1. Retrieve the database endpoint from the database cluster status:\n\n kubectl get dbcluster.\u003cvar translate=\"no\"\u003eDBENGINE_NAME\u003c/var\u003e.dbadmin.gdc.goog \u003cvar translate=\"no\"\u003eDBCLUSTER_NAME\u003c/var\u003e -n \u003cvar translate=\"no\"\u003eUSER_PROJECT\u003c/var\u003e -o=jsonpath='{.status.primary.url}'\n\n2. Download the CA certificate from the Kubernetes secret:\n\n kubectl get secret dbs-certificates -n \u003cvar translate=\"no\"\u003eUSER_PROJECT\u003c/var\u003e -o json | jq -r '.data.\"dbs-\u003cvar translate=\"no\"\u003eDBENGINE_SHORT_NAME\u003c/var\u003e-cert-\u003cvar translate=\"no\"\u003eDBCLUSTER_NAME\u003c/var\u003e\"' | base64 -d \u003e \u003cvar translate=\"no\"\u003epath/to/\u003c/var\u003eca.crt\n\n3. Configure your client to use the CA certificate to verify the database. For\n `psql` clients, you can set the `PGSSLROOTCERT` env variable to the path\n of the certificate file and the `PGSSLMODE` env variable to your preference:\n\n export PGSSLROOTCERT=\u003cvar translate=\"no\"\u003epath/to/\u003c/var\u003eaccounts_cert.pem\n export PGSSLMODE=\"verify-full\"\n\n4. Connect to the database from your client software. If you're using `psql`,\n run the following command:\n\n PGPASSWORD=\u003cvar translate=\"no\"\u003eDB_PASSWORD\u003c/var\u003e psql -h \u003cvar translate=\"no\"\u003eDB_HOSTNAME\u003c/var\u003e -p \u003cvar translate=\"no\"\u003eDB_PORT\u003c/var\u003e -U \u003cvar translate=\"no\"\u003eDB_USERNAME\u003c/var\u003e -d postgres\n\nReplace the following variables:\n\n- \u003cvar translate=\"no\"\u003eDBENGINE_NAME\u003c/var\u003e: the name of the database engine. This is one of `alloydbomni`, `postgresql`, or `oracle`.\n- \u003cvar translate=\"no\"\u003eUSER_PROJECT\u003c/var\u003e: the name of the user project where the database cluster was created.\n- \u003cvar translate=\"no\"\u003eDBENGINE_SHORT_NAME\u003c/var\u003e: the abbreviated name of the database engine. This is one of `al` (AlloyDB Omni), `pg` (PostgreSQL), or `ora` (Oracle).\n- \u003cvar translate=\"no\"\u003eDBCLUSTER_NAME\u003c/var\u003e: the name of the database cluster.\n- \u003cvar translate=\"no\"\u003epath/to/\u003c/var\u003e: the path to the database CA certificate.\n- \u003cvar translate=\"no\"\u003eDB_PASSWORD\u003c/var\u003e: database password for administrator user.\n- \u003cvar translate=\"no\"\u003eDB_HOSTNAME\u003c/var\u003e: the hostname from the database cluster status.\n- \u003cvar translate=\"no\"\u003eDB_PORT\u003c/var\u003e: the database port number from the database cluster status.\n- \u003cvar translate=\"no\"\u003eDB_USERNAME\u003c/var\u003e: with the database username (default is `dbsadmin`)."]]
