Cloud SQL high availability: is paying 2x worth it?

On 20 October, Google’s status page reported that a power event caused an outage in one zone of its London region, europe-west2-b, with Cloud SQL among the affected products. Zone outages like that are exactly what Cloud SQL’s high availability option is for. It also doubles the price of the instance. Here is what you get for the money, at list prices, and how to decide.

01What is Cloud SQL high availability?

A Cloud SQL instance is either zonal (the default: one instance in one zone) or regional, which is Google’s name for high availability. A regional instance is a primary and a standby in two different zones of the same region. Writes are replicated synchronously to the disks in both zones before a transaction is reported as committed.

Cloud SQL checks the primary’s heartbeat every second. If several heartbeats are missed, it fails over: the standby becomes the primary and serves from the second zone, behind the same IP address. Google says to expect about sixty seconds of unavailability, and existing connections are closed, so your application needs to reconnect.

02What does high availability cost?

Google’s own words: an HA instance “costs twice as much as a standalone instance. This price includes CPU, RAM, and storage.” The billing catalog shows it as separate Regional SKUs at double the Zonal ones. Here is an Enterprise edition instance with 4 vCPUs, 16 GiB of memory and 100 GiB of SSD storage in us-central1:

That is $219.35 a month more, about $2,632 a year, for one database. A smaller 2 vCPU, 8 GiB instance with 20 GiB of SSD goes from $104.58 to $209.16. In London (europe-west2) the rates are higher, $0.0496 per vCPU-hour zonal and $0.0991 regional, so the 4 vCPU example costs $263.34 zonal and $526.40 regional.

Two things are not doubled. Backups bill at one rate, $0.08 per GiB-month in us-central1, whichever type you run, and an idle IPv4 address is $0.01 an hour either way. Google does require automated backups and point-in-time recovery on an HA instance, so budget for those if you had them off.

03What happens to each kind of instance in a zone outage?

Regional: if the primary’s zone goes down, Cloud SQL fails over to the standby on its own, provided the standby and its zone are healthy. You lose about a minute and your open connections. When the failed zone recovers, Google rebuilds the old primary as the new standby.

Zonal: Google’s docs say plainly that Cloud SQL doesn’t recover a standalone instance from a zonal outage automatically. You either wait for the zone to come back, or recover by hand: point-in-time recovery to a new instance (only if you turned it on beforehand, and you may lose the last few minutes of transactions), or promoting a read replica in another zone. Either way the new instance has a new IP address and connection name, so every client has to be repointed.

04When is Cloud SQL HA worth paying for?

There is no rule from Google here, only trade-offs. These are our rules of thumb:

• Pay for it: production databases your customers depend on, where an hour offline costs more than the extra month of instance charges. Payments, logins, orders.
• Skip it: development, test and staging databases, and analytics or reporting copies you could rebuild. If nobody is paged when it’s down, zonal is enough.
• Look at the gap: a zonal production database with point-in-time recovery on and a tested restore runbook is a reasonable middle ground for internal tools, if a slower manual recovery is acceptable.

HA is not a substitute for backups. It copies every write to the standby, including a bad migration or an accidental DELETE.

05How do you check and change it?

In the console, an HA instance shows Highly available (regional) in the Configuration section of its Overview page. With the gcloud CLI:

# One instance: prints REGIONAL or ZONAL
gcloud sql instances describe my-instance \
  --format="value(settings.availabilityType)"

# Every instance in the project
gcloud sql instances list \
  --format="table(name,region,settings.tier,settings.availabilityType)"

# Turn HA on, or off
gcloud sql instances patch my-instance --availability-type=REGIONAL
gcloud sql instances patch my-instance --availability-type=ZONAL

Either change restarts the instance. Google says it usually takes a few minutes, but with a large disk or heavy load it can take up to an hour, and once you start enabling HA you can’t stop it. Schedule it like a maintenance window.

06What bill can you cut instead?

If HA on production feels expensive, the cheaper win is usually elsewhere: databases nobody uses. A stopped Cloud SQL instance stops the instance charge, but Google keeps billing its storage and IP address, and a regional instance’s storage still bills at the doubled rate. The same thing happens with stopped VMs, covered in what a stopped Google Cloud VM still costs, and with the other resources in five Google Cloud resources that bill you while doing nothing.