Currently if an environment defines Cloud SQL and GKE cluster, the communication between them is restricted by setting the authorizedNetwork attribute of the Cloud SQL instance to the IP address of the GKE cluster node.
An alternative pattern is to use a sidecar proxy container that will proxy connection to the Cloud SQL instance as shown here:
https://github.com/GoogleCloudPlatform/kubernetes-engine-samples/tree/master/cloudsql
We should consider how to support this pattern.