Skip to content

Add helper script for creating deployment connectivity resources #1306

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add helper script for creating deployment connectivity resources #1306

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
174 changes: 172 additions & 2 deletions content/nginxaas-google/getting-started/create-deployment/deploy-console.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,22 +85,192 @@ In the NGINXaaS Console,

To set up connectivity to your NGINXaaS deployment, you will need to configure a [Private Service Connect backend](https://cloud.google.com/vpc/docs/private-service-connect-backends).

1. Access the [Google Cloud Console](https://console.cloud.google.com/).
1. Access the [Google Cloud Console](https://console.cloud.google.com/) and select the project where your networking resources for connecting to your F5 NGINXaaS deployment should be created.
1. Create or reuse a [VPC network](https://cloud.google.com/vpc/docs/create-modify-vpc-networks).
1. Create a proxy-only subnet in your consumer VPC. See [Google's documentation on creating a proxy-only subnet](https://cloud.google.com/load-balancing/docs/tcp/set-up-ext-reg-tcp-proxy-zonal#console_1) for a step-by-step guide.
1. Create a public IP address. See [Google's documentation on reserving a static address](https://cloud.google.com/load-balancing/docs/tcp/set-up-ext-reg-tcp-proxy-zonal#console_3) for a step-by-step guide.
1. Create a Private Service Connect Network Endpoint Group (PSC NEG). See [Google's documentation on creating a NEG](https://cloud.google.com/vpc/docs/access-apis-managed-services-private-service-connect-backends#console) for a step-by-step guide.
- Set **Network endpoint group type** to **Private Service Connect NEG (Regional)**.
- Set **Taget** to **Published service**.
- For **Target service**, enter your NGINXaaS deployment's Service Attachment, which is visible on the `Deployment Details` section for your deployment.
- For **Producer port**, enter the port your NGINX server is listening on. If you're using the default NGINX config, enter port `80`.
- For **Network** and **Subnetwork** select your consumer VPC network and subnet.
1. Create a proxy-only subnet in your consumer VPC. See [Google's documentation on creating a proxy-only subnet](https://cloud.google.com/load-balancing/docs/tcp/set-up-ext-reg-tcp-proxy-zonal#console_1) for a step-by-step guide.
1. Create a regional external proxy Network Load Balancer. See [Google's documentation on configuring the load balancer](https://cloud.google.com/load-balancing/docs/tcp/set-up-ext-reg-tcp-proxy-zonal#console_6) for a step-by-step guide.
- For **Network**, select your consumer VPC network.
- For **Backend configuration**, follow [Google's step-by-step guide to add a backend](https://cloud.google.com/vpc/docs/access-apis-managed-services-private-service-connect-backends#console_5).
- In the **Frontend configuration** section,
- For **IP address**, select the public IP address created earlier.
- For **Port number**, enter the same port as your NEG's Producer port, for example, port `80`.


Each listening port configured on NGINX requires its own network endpoint group with a matching port. You can use the following helper script to automate these steps:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Each listening port configured on NGINX requires its own network endpoint group with a matching port. You can use the following helper script to automate these steps:
Each listening port configured on NGINXaaS requires its own network endpoint group with a matching port. You can use the following helper script to automate these steps:

it's a nit but let's talk in terms of the service rather than what it has underneath.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

separately, let's be specific about the type of NEG, PSC NEG to avoid confusion as there are various types of NEGs in GCP.


{{< details summary="Show helper script" >}}

```bash
#!/bin/bash
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we should always apply set -eo pipefail in any bash scripts, otherwise poor error handling can lead to unexpected results.

I'd also suggest -u to ensure any expected env vars are set (set -euo pipefail)

set -euo pipefail

# Default values
PROJECT=""
REGION=""
NETWORK=""
SA_URI=""
PORTS="80"
PROXY_SUBNET="psc-proxy-subnet"
VIPNAME="psc-vip"
# Prerequisites:
# - gcloud CLI installed and configured
# - An existing projectID and a VPC network created in that project
# - A valid Service Attachment URI from F5 NGINXaaS

# Function to display usage
usage() {
cat << EOF
Usage: $0 --project PROJECT --region REGION --network NETWORK --service-attachment SA_URI [--ports PORTS]

Options:
--project GCP Project ID
--region GCP Region
--network VPC Network name
--service-attachment Service Attachment Self Link
--ports Comma-separated list of ports (default: 80)
--help Show this help message

Note: Proxy subnet and public IP will be automatically created as 'psc-proxy-subnet' and 'psc-vip' respectively.

Example:
$0 --project my-project --region us-central1 --network my-vpc \\
--service-attachment "projects/producer-proj/regions/us-central1/serviceAttachments/sa-aa4c6965-4b03-4518-85ea-2ca6fc2e869c" \\
--ports "80,443,8080"
EOF
}

# Parse command line arguments
while [[ $# -gt 0 ]]; do
case $1 in
--project)
PROJECT="$2"
shift 2
;;
--region)
REGION="$2"
shift 2
;;
--network)
NETWORK="$2"
shift 2
;;
--service-attachment)
SA_URI="$2"
shift 2
;;
--ports)
PORTS="$2"
shift 2
;;
--help|-h)
usage
exit 0
;;
*)
echo "Unknown option: $1"
usage
exit 1
;;
esac
done

# Set auto-generated proxy subnet name and VIP name

# Validate required parameters
missing_params=()
[[ -z "$PROJECT" ]] && missing_params+=("--project")
[[ -z "$REGION" ]] && missing_params+=("--region")
[[ -z "$NETWORK" ]] && missing_params+=("--network")
[[ -z "$SA_URI" ]] && missing_params+=("--service-attachment")

if [[ ${#missing_params[@]} -gt 0 ]]; then
echo "Error: Missing required parameters: ${missing_params[*]}"
usage
exit 1
fi

# Create proxy-only subnet (skip if exists)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this statement can be echoed out instead of being a comment. The comment applies throughout the script where you do so.

echo "Creating proxy-only subnet..."
if ! gcloud compute networks subnets describe $PROXY_SUBNET --region=$REGION --project=$PROJECT >/dev/null 2>&1; then
gcloud compute networks subnets create $PROXY_SUBNET \
--project=$PROJECT --region=$REGION \
--network=$NETWORK \
--range=192.168.1.0/24 \
--purpose=REGIONAL_MANAGED_PROXY \
--role=ACTIVE
echo "Created proxy-only subnet: $PROXY_SUBNET"
else
Copy link
Contributor

@puneetsarna puneetsarna Oct 24, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you can safely drop this and just state that you are using the subnet whether it exists or was just created.

or we fix up the rest of the script with this if-else logic to stay consistent.

echo "Proxy-only subnet $PROXY_SUBNET already exists"
fi

# Create regional VIP address (skip if exists)
echo "Creating regional VIP address..."
if ! gcloud compute addresses describe $VIPNAME --region=$REGION --project=$PROJECT >/dev/null 2>&1; then
gcloud compute addresses create $VIPNAME --region=$REGION --project=$PROJECT --network-tier=PREMIUM
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

--network-tier=PREMIUM I don't think it needs to be premium?

fi
VIP=$(gcloud compute addresses describe $VIPNAME --region=$REGION --project=$PROJECT --format='get(address)')
echo "Using VIP address: $VIP"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is this a VIP or a static public IP that you are reserving on Google?


# Convert comma-separated ports to array
IFS=',' read -ra PORTS_ARRAY <<< "$PORTS"

for P in "${PORTS_ARRAY[@]}"; do
echo "Processing port $P..."

# Create Network Endpoint Group (skip if exists)
if ! gcloud compute network-endpoint-groups describe psc-neg-$P --region=$REGION --project=$PROJECT >/dev/null 2>&1; then
gcloud compute network-endpoint-groups create psc-neg-$P \
--project=$PROJECT --region=$REGION \
--network-endpoint-type=private-service-connect \
--psc-target-service="$SA_URI" \
--network=$NETWORK \
--producer-port=$P
fi

# Create Backend Service (skip if exists)
if ! gcloud compute backend-services describe be-$P --region=$REGION --project=$PROJECT >/dev/null 2>&1; then
gcloud compute backend-services create be-$P \
--project=$PROJECT --region=$REGION \
--protocol=TCP --load-balancing-scheme=EXTERNAL_MANAGED

# Add backend to service
gcloud compute backend-services add-backend be-$P \
--project=$PROJECT --region=$REGION \
--network-endpoint-group=psc-neg-$P \
--network-endpoint-group-region=$REGION
fi

# Create Target TCP Proxy (skip if exists)
if ! gcloud compute target-tcp-proxies describe tp-$P --region=$REGION --project=$PROJECT >/dev/null 2>&1; then
gcloud compute target-tcp-proxies create tp-$P \
--project=$PROJECT --region=$REGION --backend-service=be-$P
fi

# Create Forwarding Rule (skip if exists)
if ! gcloud compute forwarding-rules describe fr-$P --region=$REGION --project=$PROJECT >/dev/null 2>&1; then
gcloud compute forwarding-rules create fr-$P \
--project=$PROJECT --region=$REGION \
--address=$VIP --network=$NETWORK \
--target-tcp-proxy=tp-$P --target-tcp-proxy-region=$REGION \
--ports=$P --load-balancing-scheme=EXTERNAL_MANAGED \
--network-tier=PREMIUM --ip-protocol=TCP
fi

echo "Completed setup for port $P"
done

echo "Setup complete! Public Virtual IP: $VIP"
```

{{< /details >}}

## Test your deployment

1. To test your deployment, go to the IP address created in [Set up connectivity to your deployment]({{< ref "/nginxaas-google/getting-started/create-deployment/deploy-console.md#set-up-connectivity-to-your-deployment" >}}) using your favorite web browser.
Expand Down