Reading Connection Options for External Applications | Cloud SQL for MySQL | Google Cloud it is clear there are several options for making a secure connection to a Cloud SQL database and whilst using SSL on the MySQL connection is an option using the Cloud SQL Proxy is the better, more flexible choice.
The Cloud SQL Proxy, or CSP is documented at About the Cloud SQL Proxy. Personally I have used it in two ways, firstly as a separate utility running on my server (Connecting mysql Client Using the Cloud SQL Proxy), which of course needs to be automatically started. Secondly we have used the Docker version (Connecting MySQL Client Using the Cloud SQL Proxy Docker Image), within a Kubernetes pod, which also worked well. The option I have yet to try is the Java (Connecting to Cloud SQL from External Applications) approach, which looks rather interesting.