Cloud CDN & Load Balancing

# Step 1: Create a health check
gcloud compute health-checks create http web-health-check \
  --port=80 \
  --request-path=/health \
  --check-interval=10s \
  --timeout=5s \
  --healthy-threshold=2 \
  --unhealthy-threshold=3

# Step 2: Create a backend service
gcloud compute backend-services create web-backend \
  --protocol=HTTP \
  --port-name=http \
  --health-checks=web-health-check \
  --global \
  --enable-cdn \
  --connection-draining-timeout=30 \
  --load-balancing-scheme=EXTERNAL_MANAGED \
  --locality-lb-policy=ROUND_ROBIN \
  --enable-logging \
  --logging-sample-rate=1.0

# Step 3: Add backends to the backend service
# (Using a managed instance group)
gcloud compute backend-services add-backend web-backend \
  --instance-group=web-instances \
  --instance-group-zone=us-central1-a \
  --balancing-mode=UTILIZATION \
  --max-utilization=0.8 \
  --capacity-scaler=1.0 \
  --global

# Add a Cloud Run NEG as a backend
gcloud compute network-endpoint-groups create web-serverless-neg \
  --region=us-central1 \
  --network-endpoint-type=serverless \
  --cloud-run-service=my-web-app

gcloud compute backend-services add-backend web-backend \
  --network-endpoint-group=web-serverless-neg \
  --network-endpoint-group-region=us-central1 \
  --global

# Step 4: Create a URL map
gcloud compute url-maps create web-url-map \
  --default-service=web-backend

# Add path-based routing rules
gcloud compute url-maps add-path-matcher web-url-map \
  --path-matcher-name=api-matcher \
  --default-service=web-backend \
  --new-hosts=api.example.com \
  --path-rules="/v1/*=api-v1-backend,/v2/*=api-v2-backend"

# Step 5: Reserve a global static IP address
gcloud compute addresses create web-lb-ip \
  --ip-version=IPV4 \
  --global

# Step 6: Create an SSL certificate (Google-managed)
gcloud compute ssl-certificates create web-cert \
  --domains=example.com,www.example.com,api.example.com \
  --global

# Step 7: Create the HTTPS target proxy
gcloud compute target-https-proxies create web-https-proxy \
  --url-map=web-url-map \
  --ssl-certificates=web-cert \
  --global

# Step 8: Create the forwarding rule
gcloud compute forwarding-rules create web-https-forwarding \
  --address=web-lb-ip \
  --target-https-proxy=web-https-proxy \
  --ports=443 \
  --global \
  --load-balancing-scheme=EXTERNAL_MANAGED

# Step 9: Create HTTP-to-HTTPS redirect
gcloud compute url-maps create http-redirect \
  --default-url-redirect-https-redirect

gcloud compute target-http-proxies create http-redirect-proxy \
  --url-map=http-redirect \
  --global

gcloud compute forwarding-rules create http-redirect-forwarding \
  --address=web-lb-ip \
  --target-http-proxy=http-redirect-proxy \
  --ports=80 \
  --global \
  --load-balancing-scheme=EXTERNAL_MANAGED

# Get the load balancer IP
gcloud compute addresses describe web-lb-ip --global --format='value(address)'

# Create an internal health check
gcloud compute health-checks create http internal-api-health \
  --port=8080 \
  --request-path=/health \
  --region=us-central1

# Create an internal backend service
gcloud compute backend-services create internal-api-backend \
  --protocol=HTTP \
  --health-checks=internal-api-health \
  --health-checks-region=us-central1 \
  --region=us-central1 \
  --load-balancing-scheme=INTERNAL_MANAGED

# Add backend instances
gcloud compute backend-services add-backend internal-api-backend \
  --instance-group=api-instances \
  --instance-group-zone=us-central1-a \
  --region=us-central1

# Create a URL map for internal routing
gcloud compute url-maps create internal-url-map \
  --default-service=internal-api-backend \
  --region=us-central1

# Create a proxy-only subnet (required for internal HTTP(S) LB)
gcloud compute networks subnets create proxy-only-subnet \
  --purpose=REGIONAL_MANAGED_PROXY \
  --role=ACTIVE \
  --network=my-vpc \
  --region=us-central1 \
  --range=10.129.0.0/23

# Create the internal target proxy
gcloud compute target-http-proxies create internal-http-proxy \
  --url-map=internal-url-map \
  --region=us-central1

# Create the internal forwarding rule
gcloud compute forwarding-rules create internal-api-forwarding \
  --load-balancing-scheme=INTERNAL_MANAGED \
  --network=my-vpc \
  --subnet=app-subnet \
  --address=10.0.1.100 \
  --target-http-proxy=internal-http-proxy \
  --target-http-proxy-region=us-central1 \
  --ports=80 \
  --region=us-central1

# Enable Cloud CDN on an existing backend service
gcloud compute backend-services update web-backend \
  --enable-cdn \
  --global

# Configure CDN cache policy
gcloud compute backend-services update web-backend \
  --global \
  --cache-mode=CACHE_ALL_STATIC \
  --default-ttl=3600 \
  --max-ttl=86400 \
  --client-ttl=3600 \
  --serve-while-stale=86400 \
  --negative-caching \
  --negative-caching-policy='404=60,405=60'

# Configure custom cache key policy (what makes a unique cache entry)
gcloud compute backend-services update web-backend \
  --global \
  --no-cache-key-include-protocol \
  --cache-key-include-host \
  --cache-key-include-query-string \
  --cache-key-query-string-whitelist=page,lang,category

# Create a Cloud Storage backend bucket with CDN
gcloud compute backend-buckets create static-assets-backend \
  --gcs-bucket-name=my-static-assets-bucket \
  --enable-cdn \
  --default-ttl=86400 \
  --max-ttl=604800

# Add the bucket backend to the URL map
gcloud compute url-maps add-path-matcher web-url-map \
  --path-matcher-name=static-matcher \
  --default-service=web-backend \
  --new-hosts=static.example.com \
  --backend-bucket-path-rules="/assets/*=static-assets-backend,/images/*=static-assets-backend"

# Invalidate cached content
gcloud compute url-maps invalidate-cdn-cache web-url-map \
  --path="/assets/*" \
  --global \
  --async

# View CDN cache hit/miss metrics
gcloud monitoring metrics list \
  --filter='metric.type = starts_with("loadbalancing.googleapis.com/https/backend_request_count")'

# Create a security policy
gcloud compute security-policies create web-security-policy \
  --description="Production web application WAF policy"

# Allow traffic from specific countries only
gcloud compute security-policies rules create 1000 \
  --security-policy=web-security-policy \
  --expression="origin.region_code == 'US' || origin.region_code == 'CA' || origin.region_code == 'GB'" \
  --action=allow \
  --description="Allow US, Canada, and UK traffic"

# Block known-bad IP ranges
gcloud compute security-policies rules create 2000 \
  --security-policy=web-security-policy \
  --src-ip-ranges="198.51.100.0/24,203.0.113.0/24" \
  --action=deny-403 \
  --description="Block known malicious IP ranges"

# Enable OWASP Top 10 protection (pre-configured WAF rules)
gcloud compute security-policies rules create 3000 \
  --security-policy=web-security-policy \
  --expression="evaluatePreconfiguredExpr('xss-v33-stable')" \
  --action=deny-403 \
  --description="Block XSS attacks"

gcloud compute security-policies rules create 3001 \
  --security-policy=web-security-policy \
  --expression="evaluatePreconfiguredExpr('sqli-v33-stable')" \
  --action=deny-403 \
  --description="Block SQL injection attacks"

gcloud compute security-policies rules create 3002 \
  --security-policy=web-security-policy \
  --expression="evaluatePreconfiguredExpr('rce-v33-stable')" \
  --action=deny-403 \
  --description="Block remote code execution attacks"

gcloud compute security-policies rules create 3003 \
  --security-policy=web-security-policy \
  --expression="evaluatePreconfiguredExpr('lfi-v33-stable')" \
  --action=deny-403 \
  --description="Block local file inclusion attacks"

# Rate limiting rule
gcloud compute security-policies rules create 4000 \
  --security-policy=web-security-policy \
  --expression="true" \
  --action=rate-based-ban \
  --rate-limit-threshold-count=100 \
  --rate-limit-threshold-interval-sec=60 \
  --ban-duration-sec=300 \
  --conform-action=allow \
  --exceed-action=deny-429 \
  --enforce-on-key=IP \
  --description="Rate limit: 100 req/min per IP, ban for 5 min"

# Set default action to deny (allowlist approach)
gcloud compute security-policies rules update 2147483647 \
  --security-policy=web-security-policy \
  --action=allow

# Attach the policy to a backend service
gcloud compute backend-services update web-backend \
  --security-policy=web-security-policy \
  --global

# Create a Google-managed certificate (simplest approach)
gcloud compute ssl-certificates create my-cert \
  --domains=example.com,www.example.com \
  --global

# Create a Certificate Manager certificate with DNS authorization
# (supports wildcards and does not require the LB to be set up first)
gcloud certificate-manager dns-authorizations create example-auth \
  --domain=example.com

# Get the DNS record to add to your DNS zone
gcloud certificate-manager dns-authorizations describe example-auth \
  --format='value(dnsResourceRecord.name,dnsResourceRecord.type,dnsResourceRecord.data)'

# Create the certificate (after adding the DNS record)
gcloud certificate-manager certificates create wildcard-cert \
  --domains="example.com,*.example.com" \
  --dns-authorizations=example-auth

# Create a certificate map and entry
gcloud certificate-manager maps create my-cert-map

gcloud certificate-manager maps entries create main-entry \
  --map=my-cert-map \
  --certificates=wildcard-cert \
  --hostname=example.com

gcloud certificate-manager maps entries create wildcard-entry \
  --map=my-cert-map \
  --certificates=wildcard-cert \
  --hostname="*.example.com"

# Attach the certificate map to the HTTPS proxy
gcloud compute target-https-proxies update web-https-proxy \
  --certificate-map=my-cert-map \
  --global

# Upload a self-managed certificate
gcloud compute ssl-certificates create custom-cert \
  --certificate=path/to/cert.pem \
  --private-key=path/to/key.pem \
  --global

# Terraform configuration for health checks and backend services

# HTTP health check for web applications
resource "google_compute_health_check" "web_health" {
  name                = "web-health-check"
  check_interval_sec  = 10
  timeout_sec         = 5
  healthy_threshold   = 2
  unhealthy_threshold = 3

  http_health_check {
    port         = 80
    request_path = "/health"
    # Only consider 200 as healthy
    response = ""
  }

  log_config {
    enable = true
  }
}

# HTTPS health check for TLS backends
resource "google_compute_health_check" "api_health" {
  name                = "api-health-check"
  check_interval_sec  = 15
  timeout_sec         = 10
  healthy_threshold   = 2
  unhealthy_threshold = 5

  https_health_check {
    port         = 443
    request_path = "/api/health"
  }
}

# gRPC health check
resource "google_compute_health_check" "grpc_health" {
  name                = "grpc-health-check"
  check_interval_sec  = 10
  timeout_sec         = 5
  healthy_threshold   = 2
  unhealthy_threshold = 3

  grpc_health_check {
    port = 50051
    # Uses the standard gRPC health checking protocol
  }
}

# Backend service with advanced configuration
resource "google_compute_backend_service" "web" {
  name                  = "web-backend"
  protocol              = "HTTP"
  port_name             = "http"
  load_balancing_scheme = "EXTERNAL_MANAGED"
  timeout_sec           = 30

  health_checks = [google_compute_health_check.web_health.id]

  # Enable Cloud CDN
  enable_cdn = true
  cdn_policy {
    cache_mode                   = "CACHE_ALL_STATIC"
    default_ttl                  = 3600
    max_ttl                      = 86400
    serve_while_stale            = 86400
    signed_url_cache_max_age_sec = 7200
  }

  # Connection draining
  connection_draining_timeout_sec = 30

  # Session affinity (for stateful applications)
  session_affinity = "GENERATED_COOKIE"
  affinity_cookie_ttl_sec = 3600

  # Circuit breaker settings
  circuit_breakers {
    max_connections             = 1000
    max_pending_requests        = 500
    max_requests                = 2000
    max_requests_per_connection = 100
    max_retries                 = 3
  }

  # Outlier detection (automatic ejection of failing backends)
  outlier_detection {
    consecutive_errors                   = 5
    interval { seconds = 10 }
    base_ejection_time { seconds = 30 }
    max_ejection_percent                 = 50
    enforcing_consecutive_errors         = 100
    enforcing_success_rate               = 0
    success_rate_minimum_hosts           = 3
    success_rate_request_volume          = 100
    success_rate_stdev_factor            = 1900
  }

  # Logging
  log_config {
    enable      = true
    sample_rate = 1.0
  }

  # Cloud Armor security policy
  security_policy = google_compute_security_policy.waf.id

  backend {
    group           = google_compute_instance_group_manager.web.instance_group
    balancing_mode  = "UTILIZATION"
    max_utilization = 0.8
    capacity_scaler = 1.0
  }
}

# Serverless NEG for Cloud Run
gcloud compute network-endpoint-groups create api-serverless-neg \
  --region=us-central1 \
  --network-endpoint-type=serverless \
  --cloud-run-service=my-api-service

# Serverless NEG for Cloud Functions
gcloud compute network-endpoint-groups create func-serverless-neg \
  --region=us-central1 \
  --network-endpoint-type=serverless \
  --cloud-function-name=my-function

# Internet NEG for external backends
gcloud compute network-endpoint-groups create external-neg \
  --network-endpoint-type=internet-fqdn-port \
  --global

gcloud compute network-endpoint-groups update external-neg \
  --global \
  --add-endpoint="fqdn=legacy-api.example.com,port=443"

# Add NEGs to backend services
gcloud compute backend-services add-backend api-backend \
  --global \
  --network-endpoint-group=api-serverless-neg \
  --network-endpoint-group-region=us-central1

# Container-native load balancing (GKE)
# In your GKE Service manifest, use NEG annotation:
# metadata:
#   annotations:
#     cloud.google.com/neg: '{"ingress": true}'