Learning Cloud: Configuring an HTTP Load Balancer with Cloud Armor-I
Task 1. Configure a health check firewall rule
Health checks determine which instances of a load balancer can receive new connections. For HTTP load balancing, the health check probes to your load-balanced instances come from addresses in the ranges 130.211.0.0/22 and 35.191.0.0/16. Your firewall rules must allow these connections.
Create the health check rule
Create a firewall rule to allow health checks.
In the Cloud Console, on the Navigation menu (Navigation menu), click VPC network -- Firewall. Notice the existing ICMP, internal, RDP, and SSH firewall rules.
Each Google Cloud project starts with the default network and these firewall rules.
Click Create Firewall Rule.
Specify the following, and leave the remaining settings as their defaults:
Property Value (type value or select option as specified)
Name fw-allow-health-checks
Network default
Targets Specified target tags
Target tags allow-health-checks
Source filter IP Ranges
Source IP ranges 130.211.0.0/22 and 35.191.0.0/16
Protocols and ports Specified protocols and ports
Make sure to include the /22 and /16 in the Source IP ranges.
Select tcp and specify port 80.
Click Create.
Task 2: Create two NAT configurations using Cloud Router
The Google Cloud VM backend instances that you setup in Task 3 will not be configured with external IP addresses.
Instead, you will setup the Cloud NAT service to allow these VM instances to receive incoming traffic only through the Cloud NAT, and return traffic from the outbound NAT through the load balancer. You create a Cloud Router for each managed instance group, one in us-central1 and one in the europe-west1 region, which you configure in the next task.
Create the Cloud Router instance
In the Cloud Console, on the Navigation menu (Navigation menu), click Network services -- Cloud NAT.
Click Get started.
Specify the following, and leave the remaining settings as their defaults:
Property Value (type value or select option as specified)
Gateway name nat-usa
Network default
Region us-central1
Click Cloud Router, and select Create new router.
For Name, type nat-router-us-central1.
Click Create.
In Create a NAT gateway, click Create.
Wait until the NAT Gateway Status changes to Running before moving onto the next task.
Repeat the same procedure for nat-europe.
Click Create NAT Gateway.
Specify the following, and leave the remaining settings as their defaults:
Property Value (type value or select option as specified)
Gateway name nat-europe
Network default
Region europe-west1
Cloud Router -- Create new router Specify the name nat-router-europe-west1
Click Create.
In Create a NAT gateway, click Create.
Task 3. Configure an instance template and create instance groups
A managed instance group uses an instance template to create a group of identical instances. Use these to create the backends of the HTTP load balancer.
Configure the instance template
An instance template is an API resource that you can use to create VM instances and managed instance groups. Instance templates define the machine type, boot disk image, subnet, labels, and other instance properties.
In the Cloud Console, on the Navigation menu (Navigation menu), click Compute Engine -- Instance templates.
Click Create instance template.
For Name, type us-central1-template.
Click Management, security, disks, networking, sole tenancy.
Click Management.
Under Metadata, specify the following:
Key Value
startup-script-url gs://cloud-training/gcpnet/httplb/startup.sh
The startup-script-url specifies a script that will be executed when instances are started. This script installs Apache and changes the welcome page to include the client IP and the name, region, and zone of the VM instance. You can explore this script here.
Click Networking.
Specify the following, and leave the remaining settings as their defaults:
Property Value (type value or select option as specified)
Network default
Subnet default (us-central1)
Network tags allow-health-checks
External IP None
The network tag allow-health-checks ensures that the Health Check firewall rule applies to these instances.
Click Create. Wait for the instance template to be created.