Set up a managed instance group backend

Cloud CDN leverages Google Cloud global external Application Load Balancers to provide routing, health checking, and Anycast IP support. Global external Application Load Balancers can have multiple backend instance types, and you can choose which backends (or origins) to enable Cloud CDN for.

This setup guide shows you how to create a global external Application Load Balancer with a Compute Engine managed instance group backend with Cloud CDN enabled.

For general concepts, see the External Application Load Balancer overview.

If you are an existing user of the classic Application Load Balancer, make sure that you review Migration overview when you plan a new deployment with the global external Application Load Balancer.

Load balancer topologies

For an HTTPS load balancer, you create the configuration shown in the following diagram.

External Application Load Balancer with a managed instance group (MIG) backend.
Figure 1. External Application Load Balancer with a managed instance group (MIG) backend (click to enlarge).

For an HTTP load balancer, you create the configuration shown in the following diagram.

External Application Load Balancer with a managed instance group (MIG) backend.
Figure 2. External Application Load Balancer with a managed instance group (MIG) backend (click to enlarge).

The sequence of events in the diagrams are as follows:

  1. A client sends a content request to the external IPv4 address defined in the forwarding rule.

  2. The load balancer checks whether the request can be served from cache. If so, the load balancer serves the requested content out of cache. If not, processing continues.

  3. For an HTTPS load balancer, the forwarding rule directs the request to the target HTTPS proxy.

    For an HTTP load balancer, the forwarding rule directs the request to the target HTTP proxy.

  4. The target proxy uses the rule in the URL map to determine that the single backend service receives all requests.

  5. The load balancer determines that the backend service has only one instance group and directs the request to a virtual machine (VM) instance in that group.

  6. The VM serves the content requested by the user.

External Application Load Balancer with a managed instance group (MIG) backend and Cloud CDN enabled.
External Application Load Balancer with a managed instance group (MIG) backend and Cloud CDN enabled (click to enlarge).

Before you begin

Complete the following steps before you create the load balancer.

Set up an SSL certificate resource

To create the load balancer, you must have an SSL certificate resource that can be attached to the target proxy. The SSL certificate resource can be either a certificate map or a Compute Engine SSL certificate (classic certificate).

Certificate map

You can create a certificate map as described in one of the following documents:

Compute Engine SSL certificate

For an HTTPS load balancer, create a Compute Engine SSL certificate resource as described in one of the following documents:

We recommend using a Google-managed certificate.

Set up permissions

To complete the steps in this guide, you must have permission to create Compute Engine instances, firewall rules, and reserved IP addresses in a project. You must have either a project owner or editor role, or you must have the following Compute Engine IAM roles.

Task Required role
Create instances Instance Admin
Add and remove firewall rules Security Admin
Create load balancer components Network Admin
Create a project (optional) Project Creator

For more information, see the following guides:

Optional: Use BYOIP addresses

With bring your own IP (BYOIP), you can import your own public addresses to Google Cloud to use the addresses with Google Cloud resources. For example, if you import your own IPv4 addresses, you can assign one to the forwarding rule when you configure your load balancer. When you follow the instructions in this document to set up the load balancer, provide the BYOIP address as the IP address.

For more information about using BYOIP, see Bring your own IP addresses.

Configure the network and subnets

To create the example network and subnet, follow these steps.

Console

  1. In the Google Cloud console, go to the VPC networks page.

    Go to VPC networks

  2. Click Create VPC network.

  3. Enter a Name for the network.

  4. For the Subnet creation mode, choose Custom.

  5. In the New subnet section, configure the following fields:

    1. Provide a Name for the subnet.
    2. Select a Region.
    3. For IP stack type, select IPv4 (single-stack).
    4. Enter an IP address range. This is the primary IPv4 range for the subnet.

  6. Click Done.

  7. To add a subnet in a different region, click Add subnet and repeat the previous steps.

  8. Click Create.

gcloud

  1. Create the custom mode VPC network:

    gcloud compute networks create NETWORK \
    --subnet-mode=custom

  2. Within the network, create a subnet for backends:

    gcloud compute networks subnets create SUBNET \
    --network=NETWORK \
    --stack-type=IPV4_ONLY \
    --range=10.1.2.0/24 \
    --region=REGION

    Replace the following:

    • NETWORK: a name for the VPC network.

    • SUBNET: a name for the subnet.

    • REGION: the name of the region.

Create a managed instance group

To set up a load balancer with a Compute Engine backend, your VMs need to be in an instance group. This guide describes how to create a managed instance group with Linux VMs that have Apache running, and then set up load balancing. A managed instance group creates each of its managed instances based on the instance templates that you specify.

The managed instance group provides VMs running the backend servers of an external HTTP(S) load balancer. For demonstration purposes, backends serve their own hostnames.

Before you create a managed instance group, create an instance template.

Console

To support IPv4 traffic, use the following steps:

  1. In the Google Cloud console, go to the Instance templates page.

    Go to Instance templates

  2. Click Create instance template.

  3. For Name, enter lb-backend-template.

  4. Ensure that the Boot disk is set to a Debian image, such as Debian GNU/Linux 10 (buster). These instructions use commands that are only available on Debian, such as apt-get.

  5. Expand Advanced options.

  6. Expand Networking and configure the following fields:

    1. For Network tags, enter allow-health-check.
    2. In the Network interfaces section, click Edit and make the following changes:
      • Network: NETWORK
      • Subnet: SUBNET
      • IPv4 traffic: IPv4 (single-stack)
    3. Click Done.

  7. Expand Management. In the Startup script field, enter the following script:

    #! /bin/bash
apt-get update
apt-get install apache2 -y
a2ensite default-ssl
a2enmod ssl
vm_hostname="$(curl -H "Metadata-Flavor:Google" \
http://metadata.google.internal/computeMetadata/v1/instance/name)"
echo "Page served from: $vm_hostname" | \
tee /var/www/html/index.html
systemctl restart apache2

  8. Click Create.

gcloud

To support IPv4 traffic, run the following command:

gcloud compute instance-templates create TEMPLATE_NAME \
  --region=REGION \
  --network=NETWORK \
  --subnet=SUBNET \
  --stack-type=IPV4_ONLY \
  --tags=allow-health-check \
  --image-family=debian-10 \
  --image-project=debian-cloud \
  --metadata=startup-script='#! /bin/bash
    apt-get update
    apt-get install apache2 -y
    a2ensite default-ssl
    a2enmod ssl
    vm_hostname="$(curl -H "Metadata-Flavor:Google" \
    http://metadata.google.internal/computeMetadata/v1/instance/name)"
    echo "Page served from: $vm_hostname" | \
    tee /var/www/html/index.html
    systemctl restart apache2'

Terraform

To create the instance template, use the google_compute_instance_template resource.