gcp.compute.GlobalForwardingRule

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";
import * as tls from "@pulumi/tls";

// External SSL proxy load balancer with managed instance group backend
// VPC
const _default = new gcp.compute.Network("default", {
    name: "ssl-proxy-xlb-network",
    autoCreateSubnetworks: false,
});
// backend subnet
const defaultSubnetwork = new gcp.compute.Subnetwork("default", {
    name: "ssl-proxy-xlb-subnet",
    ipCidrRange: "10.0.1.0/24",
    region: "us-central1",
    network: _default.id,
});
// reserved IP address
const defaultGlobalAddress = new gcp.compute.GlobalAddress("default", {name: "ssl-proxy-xlb-ip"});
// Self-signed regional SSL certificate for testing
const defaultPrivateKey = new tls.PrivateKey("default", {
    algorithm: "RSA",
    rsaBits: 2048,
});
const defaultSelfSignedCert = new tls.SelfSignedCert("default", {
    keyAlgorithm: defaultPrivateKey.algorithm,
    privateKeyPem: defaultPrivateKey.privateKeyPem,
    validityPeriodHours: 12,
    earlyRenewalHours: 3,
    allowedUses: [
        "key_encipherment",
        "digital_signature",
        "server_auth",
    ],
    dnsNames: ["example.com"],
    subject: {
        commonName: "example.com",
        organization: "ACME Examples, Inc",
    },
});
const defaultSSLCertificate = new gcp.compute.SSLCertificate("default", {
    name: "default-cert",
    privateKey: defaultPrivateKey.privateKeyPem,
    certificate: defaultSelfSignedCert.certPem,
});
const defaultHealthCheck = new gcp.compute.HealthCheck("default", {
    name: "ssl-proxy-health-check",
    timeoutSec: 1,
    checkIntervalSec: 1,
    tcpHealthCheck: {
        port: 443,
    },
});
// instance template
const defaultInstanceTemplate = new gcp.compute.InstanceTemplate("default", {
    networkInterfaces: [{
        accessConfigs: [{}],
        network: _default.id,
        subnetwork: defaultSubnetwork.id,
    }],
    name: "ssl-proxy-xlb-mig-template",
    machineType: "e2-small",
    tags: ["allow-health-check"],
    disks: [{
        sourceImage: "debian-cloud/debian-10",
        autoDelete: true,
        boot: true,
    }],
    metadata: {
        "startup-script": `#! /bin/bash
set -euo pipefail
export DEBIAN_FRONTEND=noninteractive
sudo apt-get update
sudo apt-get install  -y apache2 jq
sudo a2ensite default-ssl
sudo a2enmod ssl
sudo service apache2 restart
NAME=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/hostname")
IP=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip")
METADATA=$(curl -f -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/attributes/?recursive=True" | jq 'del(.["startup-script"])')
cat <<EOF > /var/www/html/index.html
<h1>SSL Load Balancer</h1>
<pre>
Name: $NAME
IP: $IP
Metadata: $METADATA
</pre>
EOF
`,
    },
});
// MIG
const defaultInstanceGroupManager = new gcp.compute.InstanceGroupManager("default", {
    name: "ssl-proxy-xlb-mig1",
    zone: "us-central1-c",
    namedPorts: [{
        name: "tcp",
        port: 443,
    }],
    versions: [{
        instanceTemplate: defaultInstanceTemplate.id,
        name: "primary",
    }],
    baseInstanceName: "vm",
    targetSize: 2,
});
// backend service
const defaultBackendService = new gcp.compute.BackendService("default", {
    name: "ssl-proxy-xlb-backend-service",
    protocol: "SSL",
    portName: "tcp",
    loadBalancingScheme: "EXTERNAL",
    timeoutSec: 10,
    healthChecks: defaultHealthCheck.id,
    backends: [{
        group: defaultInstanceGroupManager.instanceGroup,
        balancingMode: "UTILIZATION",
        maxUtilization: 1,
        capacityScaler: 1,
    }],
});
const defaultTargetSSLProxy = new gcp.compute.TargetSSLProxy("default", {
    name: "test-proxy",
    backendService: defaultBackendService.id,
    sslCertificates: [defaultSSLCertificate.id],
});
// forwarding rule
const defaultGlobalForwardingRule = new gcp.compute.GlobalForwardingRule("default", {
    name: "ssl-proxy-xlb-forwarding-rule",
    ipProtocol: "TCP",
    loadBalancingScheme: "EXTERNAL",
    portRange: "443",
    target: defaultTargetSSLProxy.id,
    ipAddress: defaultGlobalAddress.id,
});
// allow access from health check ranges
const defaultFirewall = new gcp.compute.Firewall("default", {
    name: "ssl-proxy-xlb-fw-allow-hc",
    direction: "INGRESS",
    network: _default.id,
    sourceRanges: [
        "130.211.0.0/22",
        "35.191.0.0/16",
    ],
    allows: [{
        protocol: "tcp",
    }],
    targetTags: ["allow-health-check"],
});

import pulumi
import pulumi_gcp as gcp
import pulumi_tls as tls

# External SSL proxy load balancer with managed instance group backend
# VPC
default = gcp.compute.Network("default",
    name="ssl-proxy-xlb-network",
    auto_create_subnetworks=False)
# backend subnet
default_subnetwork = gcp.compute.Subnetwork("default",
    name="ssl-proxy-xlb-subnet",
    ip_cidr_range="10.0.1.0/24",
    region="us-central1",
    network=default.id)
# reserved IP address
default_global_address = gcp.compute.GlobalAddress("default", name="ssl-proxy-xlb-ip")
# Self-signed regional SSL certificate for testing
default_private_key = tls.PrivateKey("default",
    algorithm="RSA",
    rsa_bits=2048)
default_self_signed_cert = tls.SelfSignedCert("default",
    key_algorithm=default_private_key.algorithm,
    private_key_pem=default_private_key.private_key_pem,
    validity_period_hours=12,
    early_renewal_hours=3,
    allowed_uses=[
        "key_encipherment",
        "digital_signature",
        "server_auth",
    ],
    dns_names=["example.com"],
    subject=tls.SelfSignedCertSubjectArgs(
        common_name="example.com",
        organization="ACME Examples, Inc",
    ))
default_ssl_certificate = gcp.compute.SSLCertificate("default",
    name="default-cert",
    private_key=default_private_key.private_key_pem,
    certificate=default_self_signed_cert.cert_pem)
default_health_check = gcp.compute.HealthCheck("default",
    name="ssl-proxy-health-check",
    timeout_sec=1,
    check_interval_sec=1,
    tcp_health_check=gcp.compute.HealthCheckTcpHealthCheckArgs(
        port=443,
    ))
# instance template
default_instance_template = gcp.compute.InstanceTemplate("default",
    network_interfaces=[gcp.compute.InstanceTemplateNetworkInterfaceArgs(
        access_configs=[gcp.compute.InstanceTemplateNetworkInterfaceAccessConfigArgs()],
        network=default.id,
        subnetwork=default_subnetwork.id,
    )],
    name="ssl-proxy-xlb-mig-template",
    machine_type="e2-small",
    tags=["allow-health-check"],
    disks=[gcp.compute.InstanceTemplateDiskArgs(
        source_image="debian-cloud/debian-10",
        auto_delete=True,
        boot=True,
    )],
    metadata={
        "startup-script": """#! /bin/bash
set -euo pipefail
export DEBIAN_FRONTEND=noninteractive
sudo apt-get update
sudo apt-get install  -y apache2 jq
sudo a2ensite default-ssl
sudo a2enmod ssl
sudo service apache2 restart
NAME=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/hostname")
IP=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip")
METADATA=$(curl -f -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/attributes/?recursive=True" | jq 'del(.["startup-script"])')
cat <<EOF > /var/www/html/index.html
<h1>SSL Load Balancer</h1>
<pre>
Name: $NAME
IP: $IP
Metadata: $METADATA
</pre>
EOF
""",
    })
# MIG
default_instance_group_manager = gcp.compute.InstanceGroupManager("default",
    name="ssl-proxy-xlb-mig1",
    zone="us-central1-c",
    named_ports=[gcp.compute.InstanceGroupManagerNamedPortArgs(
        name="tcp",
        port=443,
    )],
    versions=[gcp.compute.InstanceGroupManagerVersionArgs(
        instance_template=default_instance_template.id,
        name="primary",
    )],
    base_instance_name="vm",
    target_size=2)
# backend service
default_backend_service = gcp.compute.BackendService("default",
    name="ssl-proxy-xlb-backend-service",
    protocol="SSL",
    port_name="tcp",
    load_balancing_scheme="EXTERNAL",
    timeout_sec=10,
    health_checks=default_health_check.id,
    backends=[gcp.compute.BackendServiceBackendArgs(
        group=default_instance_group_manager.instance_group,
        balancing_mode="UTILIZATION",
        max_utilization=1,
        capacity_scaler=1,
    )])
default_target_ssl_proxy = gcp.compute.TargetSSLProxy("default",
    name="test-proxy",
    backend_service=default_backend_service.id,
    ssl_certificates=[default_ssl_certificate.id])
# forwarding rule
default_global_forwarding_rule = gcp.compute.GlobalForwardingRule("default",
    name="ssl-proxy-xlb-forwarding-rule",
    ip_protocol="TCP",
    load_balancing_scheme="EXTERNAL",
    port_range="443",
    target=default_target_ssl_proxy.id,
    ip_address=default_global_address.id)
# allow access from health check ranges
default_firewall = gcp.compute.Firewall("default",
    name="ssl-proxy-xlb-fw-allow-hc",
    direction="INGRESS",
    network=default.id,
    source_ranges=[
        "130.211.0.0/22",
        "35.191.0.0/16",
    ],
    allows=[gcp.compute.FirewallAllowArgs(
        protocol="tcp",
    )],
    target_tags=["allow-health-check"])

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v7/go/gcp/compute"
	"github.com/pulumi/pulumi-tls/sdk/v4/go/tls"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// External SSL proxy load balancer with managed instance group backend
		// VPC
		_, err := compute.NewNetwork(ctx, "default", &compute.NetworkArgs{
			Name:                  pulumi.String("ssl-proxy-xlb-network"),
			AutoCreateSubnetworks: pulumi.Bool(false),
		})
		if err != nil {
			return err
		}
		// backend subnet
		defaultSubnetwork, err := compute.NewSubnetwork(ctx, "default", &compute.SubnetworkArgs{
			Name:        pulumi.String("ssl-proxy-xlb-subnet"),
			IpCidrRange: pulumi.String("10.0.1.0/24"),
			Region:      pulumi.String("us-central1"),
			Network:     _default.ID(),
		})
		if err != nil {
			return err
		}
		// reserved IP address
		defaultGlobalAddress, err := compute.NewGlobalAddress(ctx, "default", &compute.GlobalAddressArgs{
			Name: pulumi.String("ssl-proxy-xlb-ip"),
		})
		if err != nil {
			return err
		}
		// Self-signed regional SSL certificate for testing
		defaultPrivateKey, err := tls.NewPrivateKey(ctx, "default", &tls.PrivateKeyArgs{
			Algorithm: pulumi.String("RSA"),
			RsaBits:   pulumi.Int(2048),
		})
		if err != nil {
			return err
		}
		defaultSelfSignedCert, err := tls.NewSelfSignedCert(ctx, "default", &tls.SelfSignedCertArgs{
			KeyAlgorithm:        defaultPrivateKey.Algorithm,
			PrivateKeyPem:       defaultPrivateKey.PrivateKeyPem,
			ValidityPeriodHours: pulumi.Int(12),
			EarlyRenewalHours:   pulumi.Int(3),
			AllowedUses: pulumi.StringArray{
				pulumi.String("key_encipherment"),
				pulumi.String("digital_signature"),
				pulumi.String("server_auth"),
			},
			DnsNames: pulumi.StringArray{
				pulumi.String("example.com"),
			},
			Subject: &tls.SelfSignedCertSubjectArgs{
				CommonName:   pulumi.String("example.com"),
				Organization: pulumi.String("ACME Examples, Inc"),
			},
		})
		if err != nil {
			return err
		}
		defaultSSLCertificate, err := compute.NewSSLCertificate(ctx, "default", &compute.SSLCertificateArgs{
			Name:        pulumi.String("default-cert"),
			PrivateKey:  defaultPrivateKey.PrivateKeyPem,
			Certificate: defaultSelfSignedCert.CertPem,
		})
		if err != nil {
			return err
		}
		defaultHealthCheck, err := compute.NewHealthCheck(ctx, "default", &compute.HealthCheckArgs{
			Name:             pulumi.String("ssl-proxy-health-check"),
			TimeoutSec:       pulumi.Int(1),
			CheckIntervalSec: pulumi.Int(1),
			TcpHealthCheck: &compute.HealthCheckTcpHealthCheckArgs{
				Port: pulumi.Int(443),
			},
		})
		if err != nil {
			return err
		}
		// instance template
		defaultInstanceTemplate, err := compute.NewInstanceTemplate(ctx, "default", &compute.InstanceTemplateArgs{
			NetworkInterfaces: compute.InstanceTemplateNetworkInterfaceArray{
				&compute.InstanceTemplateNetworkInterfaceArgs{
					AccessConfigs: compute.InstanceTemplateNetworkInterfaceAccessConfigArray{
						nil,
					},
					Network:    _default.ID(),
					Subnetwork: defaultSubnetwork.ID(),
				},
			},
			Name:        pulumi.String("ssl-proxy-xlb-mig-template"),
			MachineType: pulumi.String("e2-small"),
			Tags: pulumi.StringArray{
				pulumi.String("allow-health-check"),
			},
			Disks: compute.InstanceTemplateDiskArray{
				&compute.InstanceTemplateDiskArgs{
					SourceImage: pulumi.String("debian-cloud/debian-10"),
					AutoDelete:  pulumi.Bool(true),
					Boot:        pulumi.Bool(true),
				},
			},
			Metadata: pulumi.Map{
				"startup-script": pulumi.Any(`#! /bin/bash
set -euo pipefail
export DEBIAN_FRONTEND=noninteractive
sudo apt-get update
sudo apt-get install  -y apache2 jq
sudo a2ensite default-ssl
sudo a2enmod ssl
sudo service apache2 restart
NAME=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/hostname")
IP=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip")
METADATA=$(curl -f -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/attributes/?recursive=True" | jq 'del(.["startup-script"])')
cat <<EOF > /var/www/html/index.html
<h1>SSL Load Balancer</h1>
<pre>
Name: $NAME
IP: $IP
Metadata: $METADATA
</pre>
EOF
`),
			},
		})
		if err != nil {
			return err
		}
		// MIG
		defaultInstanceGroupManager, err := compute.NewInstanceGroupManager(ctx, "default", &compute.InstanceGroupManagerArgs{
			Name: pulumi.String("ssl-proxy-xlb-mig1"),
			Zone: pulumi.String("us-central1-c"),
			NamedPorts: compute.InstanceGroupManagerNamedPortArray{
				&compute.InstanceGroupManagerNamedPortArgs{
					Name: pulumi.String("tcp"),
					Port: pulumi.Int(443),
				},
			},
			Versions: compute.InstanceGroupManagerVersionArray{
				&compute.InstanceGroupManagerVersionArgs{
					InstanceTemplate: defaultInstanceTemplate.ID(),
					Name:             pulumi.String("primary"),
				},
			},
			BaseInstanceName: pulumi.String("vm"),
			TargetSize:       pulumi.Int(2),
		})
		if err != nil {
			return err
		}
		// backend service
		defaultBackendService, err := compute.NewBackendService(ctx, "default", &compute.BackendServiceArgs{
			Name:                pulumi.String("ssl-proxy-xlb-backend-service"),
			Protocol:            pulumi.String("SSL"),
			PortName:            pulumi.String("tcp"),
			LoadBalancingScheme: pulumi.String("EXTERNAL"),
			TimeoutSec:          pulumi.Int(10),
			HealthChecks:        defaultHealthCheck.ID(),
			Backends: compute.BackendServiceBackendArray{
				&compute.BackendServiceBackendArgs{
					Group:          defaultInstanceGroupManager.InstanceGroup,
					BalancingMode:  pulumi.String("UTILIZATION"),
					MaxUtilization: pulumi.Float64(1),
					CapacityScaler: pulumi.Float64(1),
				},
			},
		})
		if err != nil {
			return err
		}
		defaultTargetSSLProxy, err := compute.NewTargetSSLProxy(ctx, "default", &compute.TargetSSLProxyArgs{
			Name:           pulumi.String("test-proxy"),
			BackendService: defaultBackendService.ID(),
			SslCertificates: pulumi.StringArray{
				defaultSSLCertificate.ID(),
			},
		})
		if err != nil {
			return err
		}
		// forwarding rule
		_, err = compute.NewGlobalForwardingRule(ctx, "default", &compute.GlobalForwardingRuleArgs{
			Name:                pulumi.String("ssl-proxy-xlb-forwarding-rule"),
			IpProtocol:          pulumi.String("TCP"),
			LoadBalancingScheme: pulumi.String("EXTERNAL"),
			PortRange:           pulumi.String("443"),
			Target:              defaultTargetSSLProxy.ID(),
			IpAddress:           defaultGlobalAddress.ID(),
		})
		if err != nil {
			return err
		}
		// allow access from health check ranges
		_, err = compute.NewFirewall(ctx, "default", &compute.FirewallArgs{
			Name:      pulumi.String("ssl-proxy-xlb-fw-allow-hc"),
			Direction: pulumi.String("INGRESS"),
			Network:   _default.ID(),
			SourceRanges: pulumi.StringArray{
				pulumi.String("130.211.0.0/22"),
				pulumi.String("35.191.0.0/16"),
			},
			Allows: compute.FirewallAllowArray{
				&compute.FirewallAllowArgs{
					Protocol: pulumi.String("tcp"),
				},
			},
			TargetTags: pulumi.StringArray{
				pulumi.String("allow-health-check"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;
using Tls = Pulumi.Tls;

return await Deployment.RunAsync(() => 
{
    // External SSL proxy load balancer with managed instance group backend
    // VPC
    var @default = new Gcp.Compute.Network("default", new()
    {
        Name = "ssl-proxy-xlb-network",
        AutoCreateSubnetworks = false,
    });

    // backend subnet
    var defaultSubnetwork = new Gcp.Compute.Subnetwork("default", new()
    {
        Name = "ssl-proxy-xlb-subnet",
        IpCidrRange = "10.0.1.0/24",
        Region = "us-central1",
        Network = @default.Id,
    });

    // reserved IP address
    var defaultGlobalAddress = new Gcp.Compute.GlobalAddress("default", new()
    {
        Name = "ssl-proxy-xlb-ip",
    });

    // Self-signed regional SSL certificate for testing
    var defaultPrivateKey = new Tls.PrivateKey("default", new()
    {
        Algorithm = "RSA",
        RsaBits = 2048,
    });

    var defaultSelfSignedCert = new Tls.SelfSignedCert("default", new()
    {
        KeyAlgorithm = defaultPrivateKey.Algorithm,
        PrivateKeyPem = defaultPrivateKey.PrivateKeyPem,
        ValidityPeriodHours = 12,
        EarlyRenewalHours = 3,
        AllowedUses = new[]
        {
            "key_encipherment",
            "digital_signature",
            "server_auth",
        },
        DnsNames = new[]
        {
            "example.com",
        },
        Subject = new Tls.Inputs.SelfSignedCertSubjectArgs
        {
            CommonName = "example.com",
            Organization = "ACME Examples, Inc",
        },
    });

    var defaultSSLCertificate = new Gcp.Compute.SSLCertificate("default", new()
    {
        Name = "default-cert",
        PrivateKey = defaultPrivateKey.PrivateKeyPem,
        Certificate = defaultSelfSignedCert.CertPem,
    });

    var defaultHealthCheck = new Gcp.Compute.HealthCheck("default", new()
    {
        Name = "ssl-proxy-health-check",
        TimeoutSec = 1,
        CheckIntervalSec = 1,
        TcpHealthCheck = new Gcp.Compute.Inputs.HealthCheckTcpHealthCheckArgs
        {
            Port = 443,
        },
    });

    // instance template
    var defaultInstanceTemplate = new Gcp.Compute.InstanceTemplate("default", new()
    {
        NetworkInterfaces = new[]
        {
            new Gcp.Compute.Inputs.InstanceTemplateNetworkInterfaceArgs
            {
                AccessConfigs = new[]
                {
                    null,
                },
                Network = @default.Id,
                Subnetwork = defaultSubnetwork.Id,
            },
        },
        Name = "ssl-proxy-xlb-mig-template",
        MachineType = "e2-small",
        Tags = new[]
        {
            "allow-health-check",
        },
        Disks = new[]
        {
            new Gcp.Compute.Inputs.InstanceTemplateDiskArgs
            {
                SourceImage = "debian-cloud/debian-10",
                AutoDelete = true,
                Boot = true,
            },
        },
        Metadata = 
        {
            { "startup-script", @"#! /bin/bash
set -euo pipefail
export DEBIAN_FRONTEND=noninteractive
sudo apt-get update
sudo apt-get install  -y apache2 jq
sudo a2ensite default-ssl
sudo a2enmod ssl
sudo service apache2 restart
NAME=$(curl -H ""Metadata-Flavor: Google"" ""http://metadata.google.internal/computeMetadata/v1/instance/hostname"")
IP=$(curl -H ""Metadata-Flavor: Google"" ""http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip"")
METADATA=$(curl -f -H ""Metadata-Flavor: Google"" ""http://metadata.google.internal/computeMetadata/v1/instance/attributes/?recursive=True"" | jq 'del(.[""startup-script""])')
cat <<EOF > /var/www/html/index.html
<h1>SSL Load Balancer</h1>
<pre>
Name: $NAME
IP: $IP
Metadata: $METADATA
</pre>
EOF
" },
        },
    });

    // MIG
    var defaultInstanceGroupManager = new Gcp.Compute.InstanceGroupManager("default", new()
    {
        Name = "ssl-proxy-xlb-mig1",
        Zone = "us-central1-c",
        NamedPorts = new[]
        {
            new Gcp.Compute.Inputs.InstanceGroupManagerNamedPortArgs
            {
                Name = "tcp",
                Port = 443,
            },
        },
        Versions = new[]
        {
            new Gcp.Compute.Inputs.InstanceGroupManagerVersionArgs
            {
                InstanceTemplate = defaultInstanceTemplate.Id,
                Name = "primary",
            },
        },
        BaseInstanceName = "vm",
        TargetSize = 2,
    });

    // backend service
    var defaultBackendService = new Gcp.Compute.BackendService("default", new()
    {
        Name = "ssl-proxy-xlb-backend-service",
        Protocol = "SSL",
        PortName = "tcp",
        LoadBalancingScheme = "EXTERNAL",
        TimeoutSec = 10,
        HealthChecks = defaultHealthCheck.Id,
        Backends = new[]
        {
            new Gcp.Compute.Inputs.BackendServiceBackendArgs
            {
                Group = defaultInstanceGroupManager.InstanceGroup,
                BalancingMode = "UTILIZATION",
                MaxUtilization = 1,
                CapacityScaler = 1,
            },
        },
    });

    var defaultTargetSSLProxy = new Gcp.Compute.TargetSSLProxy("default", new()
    {
        Name = "test-proxy",
        BackendService = defaultBackendService.Id,
        SslCertificates = new[]
        {
            defaultSSLCertificate.Id,
        },
    });

    // forwarding rule
    var defaultGlobalForwardingRule = new Gcp.Compute.GlobalForwardingRule("default", new()
    {
        Name = "ssl-proxy-xlb-forwarding-rule",
        IpProtocol = "TCP",
        LoadBalancingScheme = "EXTERNAL",
        PortRange = "443",
        Target = defaultTargetSSLProxy.Id,
        IpAddress = defaultGlobalAddress.Id,
    });

    // allow access from health check ranges
    var defaultFirewall = new Gcp.Compute.Firewall("default", new()
    {
        Name = "ssl-proxy-xlb-fw-allow-hc",
        Direction = "INGRESS",
        Network = @default.Id,
        SourceRanges = new[]
        {
            "130.211.0.0/22",
            "35.191.0.0/16",
        },
        Allows = new[]
        {
            new Gcp.Compute.Inputs.FirewallAllowArgs
            {
                Protocol = "tcp",
            },
        },
        TargetTags = new[]
        {
            "allow-health-check",
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.compute.Network;
import com.pulumi.gcp.compute.NetworkArgs;
import com.pulumi.gcp.compute.Subnetwork;
import com.pulumi.gcp.compute.SubnetworkArgs;
import com.pulumi.gcp.compute.GlobalAddress;
import com.pulumi.gcp.compute.GlobalAddressArgs;
import com.pulumi.tls.PrivateKey;
import com.pulumi.tls.PrivateKeyArgs;
import com.pulumi.tls.SelfSignedCert;
import com.pulumi.tls.SelfSignedCertArgs;
import com.pulumi.tls.inputs.SelfSignedCertSubjectArgs;
import com.pulumi.gcp.compute.SSLCertificate;
import com.pulumi.gcp.compute.SSLCertificateArgs;
import com.pulumi.gcp.compute.HealthCheck;
import com.pulumi.gcp.compute.HealthCheckArgs;
import com.pulumi.gcp.compute.inputs.HealthCheckTcpHealthCheckArgs;
import com.pulumi.gcp.compute.InstanceTemplate;
import com.pulumi.gcp.compute.InstanceTemplateArgs;
import com.pulumi.gcp.compute.inputs.InstanceTemplateNetworkInterfaceArgs;
import com.pulumi.gcp.compute.inputs.InstanceTemplateDiskArgs;
import com.pulumi.gcp.compute.InstanceGroupManager;
import com.pulumi.gcp.compute.InstanceGroupManagerArgs;
import com.pulumi.gcp.compute.inputs.InstanceGroupManagerNamedPortArgs;
import com.pulumi.gcp.compute.inputs.InstanceGroupManagerVersionArgs;
import com.pulumi.gcp.compute.BackendService;
import com.pulumi.gcp.compute.BackendServiceArgs;
import com.pulumi.gcp.compute.inputs.BackendServiceBackendArgs;
import com.pulumi.gcp.compute.TargetSSLProxy;
import com.pulumi.gcp.compute.TargetSSLProxyArgs;
import com.pulumi.gcp.compute.GlobalForwardingRule;
import com.pulumi.gcp.compute.GlobalForwardingRuleArgs;
import com.pulumi.gcp.compute.Firewall;
import com.pulumi.gcp.compute.FirewallArgs;
import com.pulumi.gcp.compute.inputs.FirewallAllowArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // External SSL proxy load balancer with managed instance group backend
        // VPC
        var default_ = new Network("default", NetworkArgs.builder()        
            .name("ssl-proxy-xlb-network")
            .autoCreateSubnetworks(false)
            .build());

        // backend subnet
        var defaultSubnetwork = new Subnetwork("defaultSubnetwork", SubnetworkArgs.builder()        
            .name("ssl-proxy-xlb-subnet")
            .ipCidrRange("10.0.1.0/24")
            .region("us-central1")
            .network(default_.id())
            .build());

        // reserved IP address
        var defaultGlobalAddress = new GlobalAddress("defaultGlobalAddress", GlobalAddressArgs.builder()        
            .name("ssl-proxy-xlb-ip")
            .build());

        // Self-signed regional SSL certificate for testing
        var defaultPrivateKey = new PrivateKey("defaultPrivateKey", PrivateKeyArgs.builder()        
            .algorithm("RSA")
            .rsaBits(2048)
            .build());

        var defaultSelfSignedCert = new SelfSignedCert("defaultSelfSignedCert", SelfSignedCertArgs.builder()        
            .keyAlgorithm(defaultPrivateKey.algorithm())
            .privateKeyPem(defaultPrivateKey.privateKeyPem())
            .validityPeriodHours(12)
            .earlyRenewalHours(3)
            .allowedUses(            
                "key_encipherment",
                "digital_signature",
                "server_auth")
            .dnsNames("example.com")
            .subject(SelfSignedCertSubjectArgs.builder()
                .commonName("example.com")
                .organization("ACME Examples, Inc")
                .build())
            .build());

        var defaultSSLCertificate = new SSLCertificate("defaultSSLCertificate", SSLCertificateArgs.builder()        
            .name("default-cert")
            .privateKey(defaultPrivateKey.privateKeyPem())
            .certificate(defaultSelfSignedCert.certPem())
            .build());

        var defaultHealthCheck = new HealthCheck("defaultHealthCheck", HealthCheckArgs.builder()        
            .name("ssl-proxy-health-check")
            .timeoutSec(1)
            .checkIntervalSec(1)
            .tcpHealthCheck(HealthCheckTcpHealthCheckArgs.builder()
                .port("443")
                .build())
            .build());

        // instance template
        var defaultInstanceTemplate = new InstanceTemplate("defaultInstanceTemplate", InstanceTemplateArgs.builder()        
            .networkInterfaces(InstanceTemplateNetworkInterfaceArgs.builder()
                .accessConfigs()
                .network(default_.id())
                .subnetwork(defaultSubnetwork.id())
                .build())
            .name("ssl-proxy-xlb-mig-template")
            .machineType("e2-small")
            .tags("allow-health-check")
            .disks(InstanceTemplateDiskArgs.builder()
                .sourceImage("debian-cloud/debian-10")
                .autoDelete(true)
                .boot(true)
                .build())
            .metadata(Map.of("startup-script", """
#! /bin/bash
set -euo pipefail
export DEBIAN_FRONTEND=noninteractive
sudo apt-get update
sudo apt-get install  -y apache2 jq
sudo a2ensite default-ssl
sudo a2enmod ssl
sudo service apache2 restart
NAME=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/hostname")
IP=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip")
METADATA=$(curl -f -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/attributes/?recursive=True" | jq 'del(.["startup-script"])')
cat <<EOF > /var/www/html/index.html
<h1>SSL Load Balancer</h1>
<pre>
Name: $NAME
IP: $IP
Metadata: $METADATA
</pre>
EOF
            """))
            .build());

        // MIG
        var defaultInstanceGroupManager = new InstanceGroupManager("defaultInstanceGroupManager", InstanceGroupManagerArgs.builder()        
            .name("ssl-proxy-xlb-mig1")
            .zone("us-central1-c")
            .namedPorts(InstanceGroupManagerNamedPortArgs.builder()
                .name("tcp")
                .port(443)
                .build())
            .versions(InstanceGroupManagerVersionArgs.builder()
                .instanceTemplate(defaultInstanceTemplate.id())
                .name("primary")
                .build())
            .baseInstanceName("vm")
            .targetSize(2)
            .build());

        // backend service
        var defaultBackendService = new BackendService("defaultBackendService", BackendServiceArgs.builder()        
            .name("ssl-proxy-xlb-backend-service")
            .protocol("SSL")
            .portName("tcp")
            .loadBalancingScheme("EXTERNAL")
            .timeoutSec(10)
            .healthChecks(defaultHealthCheck.id())
            .backends(BackendServiceBackendArgs.builder()
                .group(defaultInstanceGroupManager.instanceGroup())
                .balancingMode("UTILIZATION")
                .maxUtilization(1)
                .capacityScaler(1)
                .build())
            .build());

        var defaultTargetSSLProxy = new TargetSSLProxy("defaultTargetSSLProxy", TargetSSLProxyArgs.builder()        
            .name("test-proxy")
            .backendService(defaultBackendService.id())
            .sslCertificates(defaultSSLCertificate.id())
            .build());

        // forwarding rule
        var defaultGlobalForwardingRule = new GlobalForwardingRule("defaultGlobalForwardingRule", GlobalForwardingRuleArgs.builder()        
            .name("ssl-proxy-xlb-forwarding-rule")
            .ipProtocol("TCP")
            .loadBalancingScheme("EXTERNAL")
            .portRange("443")
            .target(defaultTargetSSLProxy.id())
            .ipAddress(defaultGlobalAddress.id())
            .build());

        // allow access from health check ranges
        var defaultFirewall = new Firewall("defaultFirewall", FirewallArgs.builder()        
            .name("ssl-proxy-xlb-fw-allow-hc")
            .direction("INGRESS")
            .network(default_.id())
            .sourceRanges(            
                "130.211.0.0/22",
                "35.191.0.0/16")
            .allows(FirewallAllowArgs.builder()
                .protocol("tcp")
                .build())
            .targetTags("allow-health-check")
            .build());

    }
}

resources:
  # External SSL proxy load balancer with managed instance group backend

  # VPC
  default:
    type: gcp:compute:Network
    properties:
      name: ssl-proxy-xlb-network
      autoCreateSubnetworks: false
  # backend subnet
  defaultSubnetwork:
    type: gcp:compute:Subnetwork
    name: default
    properties:
      name: ssl-proxy-xlb-subnet
      ipCidrRange: 10.0.1.0/24
      region: us-central1
      network: ${default.id}
  # reserved IP address
  defaultGlobalAddress:
    type: gcp:compute:GlobalAddress
    name: default
    properties:
      name: ssl-proxy-xlb-ip
  # Self-signed regional SSL certificate for testing
  defaultPrivateKey:
    type: tls:PrivateKey
    name: default
    properties:
      algorithm: RSA
      rsaBits: 2048
  defaultSelfSignedCert:
    type: tls:SelfSignedCert
    name: default
    properties:
      keyAlgorithm: ${defaultPrivateKey.algorithm}
      privateKeyPem: ${defaultPrivateKey.privateKeyPem}
      validityPeriodHours: 12 # Generate a new certificate if Terraform is run within three
      #   # hours of the certificate's expiration time.
      earlyRenewalHours: 3 # Reasonable set of uses for a server SSL certificate.
      allowedUses:
        - key_encipherment
        - digital_signature
        - server_auth
      dnsNames:
        - example.com
      subject:
        commonName: example.com
        organization: ACME Examples, Inc
  defaultSSLCertificate:
    type: gcp:compute:SSLCertificate
    name: default
    properties:
      name: default-cert
      privateKey: ${defaultPrivateKey.privateKeyPem}
      certificate: ${defaultSelfSignedCert.certPem}
  defaultTargetSSLProxy:
    type: gcp:compute:TargetSSLProxy
    name: default
    properties:
      name: test-proxy
      backendService: ${defaultBackendService.id}
      sslCertificates:
        - ${defaultSSLCertificate.id}
  # forwarding rule
  defaultGlobalForwardingRule:
    type: gcp:compute:GlobalForwardingRule
    name: default
    properties:
      name: ssl-proxy-xlb-forwarding-rule
      ipProtocol: TCP
      loadBalancingScheme: EXTERNAL
      portRange: '443'
      target: ${defaultTargetSSLProxy.id}
      ipAddress: ${defaultGlobalAddress.id}
  # backend service
  defaultBackendService:
    type: gcp:compute:BackendService
    name: default
    properties:
      name: ssl-proxy-xlb-backend-service
      protocol: SSL
      portName: tcp
      loadBalancingScheme: EXTERNAL
      timeoutSec: 10
      healthChecks: ${defaultHealthCheck.id}
      backends:
        - group: ${defaultInstanceGroupManager.instanceGroup}
          balancingMode: UTILIZATION
          maxUtilization: 1
          capacityScaler: 1
  defaultHealthCheck:
    type: gcp:compute:HealthCheck
    name: default
    properties:
      name: ssl-proxy-health-check
      timeoutSec: 1
      checkIntervalSec: 1
      tcpHealthCheck:
        port: '443'
  # instance template
  defaultInstanceTemplate:
    type: gcp:compute:InstanceTemplate
    name: default
    properties:
      networkInterfaces:
        - accessConfigs:
            - {}
          network: ${default.id}
          subnetwork: ${defaultSubnetwork.id}
      name: ssl-proxy-xlb-mig-template
      machineType: e2-small
      tags:
        - allow-health-check
      disks:
        - sourceImage: debian-cloud/debian-10
          autoDelete: true
          boot: true
      metadata:
        startup-script: |
          #! /bin/bash
          set -euo pipefail
          export DEBIAN_FRONTEND=noninteractive
          sudo apt-get update
          sudo apt-get install  -y apache2 jq
          sudo a2ensite default-ssl
          sudo a2enmod ssl
          sudo service apache2 restart
          NAME=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/hostname")
          IP=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip")
          METADATA=$(curl -f -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/attributes/?recursive=True" | jq 'del(.["startup-script"])')
          cat <<EOF > /var/www/html/index.html
          <h1>SSL Load Balancer</h1>
          <pre>
          Name: $NAME
          IP: $IP
          Metadata: $METADATA
          </pre>
          EOF          
  # MIG
  defaultInstanceGroupManager:
    type: gcp:compute:InstanceGroupManager
    name: default
    properties:
      name: ssl-proxy-xlb-mig1
      zone: us-central1-c
      namedPorts:
        - name: tcp
          port: 443
      versions:
        - instanceTemplate: ${defaultInstanceTemplate.id}
          name: primary
      baseInstanceName: vm
      targetSize: 2
  # allow access from health check ranges
  defaultFirewall:
    type: gcp:compute:Firewall
    name: default
    properties:
      name: ssl-proxy-xlb-fw-allow-hc
      direction: INGRESS
      network: ${default.id}
      sourceRanges:
        - 130.211.0.0/22
        - 35.191.0.0/16
      allows:
        - protocol: tcp
      targetTags:
        - allow-health-check

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

// External TCP proxy load balancer with managed instance group backend
// VPC
const _default = new gcp.compute.Network("default", {
    name: "tcp-proxy-xlb-network",
    autoCreateSubnetworks: false,
});
// backend subnet
const defaultSubnetwork = new gcp.compute.Subnetwork("default", {
    name: "tcp-proxy-xlb-subnet",
    ipCidrRange: "10.0.1.0/24",
    region: "us-central1",
    network: _default.id,
});
// reserved IP address
const defaultGlobalAddress = new gcp.compute.GlobalAddress("default", {name: "tcp-proxy-xlb-ip"});
const defaultHealthCheck = new gcp.compute.HealthCheck("default", {
    name: "tcp-proxy-health-check",
    timeoutSec: 1,
    checkIntervalSec: 1,
    tcpHealthCheck: {
        port: 80,
    },
});
// instance template
const defaultInstanceTemplate = new gcp.compute.InstanceTemplate("default", {
    networkInterfaces: [{
        accessConfigs: [{}],
        network: _default.id,
        subnetwork: defaultSubnetwork.id,
    }],
    name: "tcp-proxy-xlb-mig-template",
    machineType: "e2-small",
    tags: ["allow-health-check"],
    disks: [{
        sourceImage: "debian-cloud/debian-10",
        autoDelete: true,
        boot: true,
    }],
    metadata: {
        "startup-script": `#! /bin/bash
set -euo pipefail
export DEBIAN_FRONTEND=noninteractive
apt-get update
apt-get install -y nginx-light jq
NAME=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/hostname")
IP=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip")
METADATA=$(curl -f -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/attributes/?recursive=True" | jq 'del(.["startup-script"])')
cat <<EOF > /var/www/html/index.html
<pre>
Name: $NAME
IP: $IP
Metadata: $METADATA
</pre>
EOF
`,
    },
});
// MIG
const defaultInstanceGroupManager = new gcp.compute.InstanceGroupManager("default", {
    name: "tcp-proxy-xlb-mig1",
    zone: "us-central1-c",
    namedPorts: [{
        name: "tcp",
        port: 80,
    }],
    versions: [{
        instanceTemplate: defaultInstanceTemplate.id,
        name: "primary",
    }],
    baseInstanceName: "vm",
    targetSize: 2,
});
// backend service
const defaultBackendService = new gcp.compute.BackendService("default", {
    name: "tcp-proxy-xlb-backend-service",
    protocol: "TCP",
    portName: "tcp",
    loadBalancingScheme: "EXTERNAL",
    timeoutSec: 10,
    healthChecks: defaultHealthCheck.id,
    backends: [{
        group: defaultInstanceGroupManager.instanceGroup,
        balancingMode: "UTILIZATION",
        maxUtilization: 1,
        capacityScaler: 1,
    }],
});
const defaultTargetTCPProxy = new gcp.compute.TargetTCPProxy("default", {
    name: "test-proxy-health-check",
    backendService: defaultBackendService.id,
});
// forwarding rule
const defaultGlobalForwardingRule = new gcp.compute.GlobalForwardingRule("default", {
    name: "tcp-proxy-xlb-forwarding-rule",
    ipProtocol: "TCP",
    loadBalancingScheme: "EXTERNAL",
    portRange: "110",
    target: defaultTargetTCPProxy.id,
    ipAddress: defaultGlobalAddress.id,
});
// allow access from health check ranges
const defaultFirewall = new gcp.compute.Firewall("default", {
    name: "tcp-proxy-xlb-fw-allow-hc",
    direction: "INGRESS",
    network: _default.id,
    sourceRanges: [
        "130.211.0.0/22",
        "35.191.0.0/16",
    ],
    allows: [{
        protocol: "tcp",
    }],
    targetTags: ["allow-health-check"],
});

import pulumi
import pulumi_gcp as gcp

# External TCP proxy load balancer with managed instance group backend
# VPC
default = gcp.compute.Network("default",
    name="tcp-proxy-xlb-network",
    auto_create_subnetworks=False)
# backend subnet
default_subnetwork = gcp.compute.Subnetwork("default",
    name="tcp-proxy-xlb-subnet",
    ip_cidr_range="10.0.1.0/24",
    region="us-central1",
    network=default.id)
# reserved IP address
default_global_address = gcp.compute.GlobalAddress("default", name="tcp-proxy-xlb-ip")
default_health_check = gcp.compute.HealthCheck("default",
    name="tcp-proxy-health-check",
    timeout_sec=1,
    check_interval_sec=1,
    tcp_health_check=gcp.compute.HealthCheckTcpHealthCheckArgs(
        port=80,
    ))
# instance template
default_instance_template = gcp.compute.InstanceTemplate("default",
    network_interfaces=[gcp.compute.InstanceTemplateNetworkInterfaceArgs(
        access_configs=[gcp.compute.InstanceTemplateNetworkInterfaceAccessConfigArgs()],
        network=default.id,
        subnetwork=default_subnetwork.id,
    )],
    name="tcp-proxy-xlb-mig-template",
    machine_type="e2-small",
    tags=["allow-health-check"],
    disks=[gcp.compute.InstanceTemplateDiskArgs(
        source_image="debian-cloud/debian-10",
        auto_delete=True,
        boot=True,
    )],
    metadata={
        "startup-script": """#! /bin/bash
set -euo pipefail
export DEBIAN_FRONTEND=noninteractive
apt-get update
apt-get install -y nginx-light jq
NAME=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/hostname")
IP=$(curl -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip")
METADATA=$(curl -f -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/attributes/?recursive=True" | jq 'del(.["startup-script"])')
cat <<EOF > /var/www/html/index.html
<pre>
Name: $NAME
IP: $IP
Metadata: $METADATA
</pre>
EOF
""",
    })
# MIG
default_instance_group_manager = gcp.compute.InstanceGroupManager("default",
    name="tcp-proxy-xlb-mig1",
    zone="us-central1-c",
    named_ports=[gcp.compute.InstanceGroupManagerNamedPortArgs(
        name="tcp",
        port=80,
    )],
    versions=[gcp.compute.InstanceGroupManagerVersionArgs(
        instance_template=default_instance_template.id,
        name="primary",
    )],
    base_instance_name="vm",
    target_size=2)
# backend service
default_backend_service = gcp.compute.BackendService("default",
    name="tcp-proxy-xlb-backend-service",
    protocol="TCP",
    port_name="tcp",
    load_balancing_scheme="EXTERNAL",
    timeout_sec=10,
    health_checks=default_health_check.id,
    backends=[gcp.compute.BackendServiceBackendArgs(
        group=default_instance_group_manager.instance_group,
        balancing_mode="UTILIZATION",
        max_utilization=1,
        capacity_scaler=1,
    )])
default_target_tcp_proxy = gcp.compute.TargetTCPProxy("default",
    name="test-proxy-health-check",
    backend_service=default_backend_service.id)
# forwarding rule
default_global_forwarding_rule = gcp.compute.GlobalForwardingRule("default",
    name="tcp-proxy-xlb-forwarding-rule",
    ip_protocol="TCP",
    load_balancing_scheme="EXTERNAL",
    port_range="110",
    target=default_target_tcp_proxy.id,
    ip_address=default_global_address.id)
# allow access from health check ranges
default_firewall = gcp.compute.Firewall("default",
    name="tcp-proxy-xlb-fw-allow-hc",
    direction="INGRESS",
    network=default.id,
    source_ranges=[
        "130.211.0.0/22",
        "35.191.0.0/16",
    ],
    allows=[gcp.compute.FirewallAllowArgs(
        protocol="tcp",
    )],
    target_tags=["allow-health-check"])