Monitor infrastructure resources using an App Hub global application

Console

1. In the Google Cloud console, go to the VPC networks page.

   Go to VPC networks

2. Click Create VPC network.
3. In the Name field, enter lb-network.
4. Set the Subnet creation mode to Custom.

5. In the New subnet section, enter the following information:

   • Name: lb-frontend-and-backend-subnet

   • Region: us-west1

   • IP address range: 10.1.2.0/24

6. Click Done.

7. Click Create.

gcloud

1. Set the project as Service Project 1:

     gcloud config set project SERVICE_PROJECT_1_ID

2. Create a VPC network with the gcloud compute networks create command:

   gcloud compute networks create lb-network --subnet-mode=custom
   

3. Create a subnet in the lb-network network in the us-west1 region:

   gcloud compute networks subnets create lb-frontend-and-backend-subnet \
       --network=lb-network \
       --range=10.1.2.0/24 \
       --region=us-west1
   

Console

1. In the Google Cloud console, go to the VPC networks page.

   Go to VPC networks

2. Click the name of the Shared VPC network: lb-network.
3. Click the Subnets tab and click Add subnet.
4. In the Add a subnet pane, in the Name field, enter proxy-only-subnet.
5. In the Region list, select us-west1.
6. Set Purpose to Regional Managed Proxy.
7. In the IP address range field, enter 10.129.0.0/23.
8. Click Add.

gcloud

Create the proxy-only subnet with the gcloud compute networks subnets create command:

gcloud compute networks subnets create proxy-only-subnet \
    --purpose=REGIONAL_MANAGED_PROXY \
    --role=ACTIVE \
    --region=us-west1 \
    --network=lb-network \
    --range=10.129.0.0/23

Console

1. In the Google Cloud console, go to the Firewall policies page.

   Go to Firewall policies

2. Click Create firewall rule to create the rule to allow Google Cloud health checks:
• Name: fw-allow-health-check
• Network: lb-network
• Direction of traffic: Ingress
• Action on match: Allow
• Targets: Specified target tags
• Target tags: load-balanced-backend
• Source filter: IPv4 ranges
• Source IPv4 ranges: 130.211.0.0/22 and 35.191.0.0/16
• Protocols and ports:
  • Choose Specified protocols and ports.
  • Select the TCP checkbox and enter 80 for the port number.

  As a best practice, limit this rule to just the protocols and ports that match those used by your health check. If you use tcp:80 for the protocol and port, Google Cloud can use HTTP on port 80 to contact your VMs, but it can't use HTTPS on port 443 to contact them.

3. Click Create.
4. Click Create firewall rule to create the rule to allow Google Cloud health checks:
• Name: fw-allow-proxies
• Network: lb-network
• Direction of traffic: Ingress
• Action on match: Allow
• Targets: Specified target tags
• Target tags: load-balanced-backend
• Source filter: IPv4 ranges
• Source IPv4 ranges: 10.129.0.0/23
• Protocols and ports:
  • Choose Specified protocols and ports.
  • Select the TCP checkbox and enter 80, 443, 8080 for the port numbers.
5. Click Create.
6. Click Create firewall rule to create the rule to allow Google Cloud health checks:
• Name: fw-allow-ssh
• Network: lb-network
• Direction of traffic: Ingress
• Action on match: Allow
• Targets: Specified target tags
• Target tags: allow-ssh
• Source filter: IPv4 ranges
• Source IPv4 ranges: 0.0.0.0/0
• Protocols and ports:
  • Choose Specified protocols and ports.
  • Select the TCP checkbox and enter 22 for the port number.
7. Click Create.

gcloud

1. Create the fw-allow-health-check firewall rule to allow Google Cloud health checks. This example allows all TCP traffic from health check probers. However, you can configure a narrower set of ports to meet your needs.

   gcloud compute firewall-rules create fw-allow-health-check \
      --network=lb-network \
      --action=allow \
      --direction=ingress \
      --source-ranges=130.211.0.0/22,35.191.0.0/16 \
      --target-tags=load-balanced-backend \
      --rules=tcp
   

2. Create the fw-allow-proxies firewall rule to allow traffic from the Envoy proxy-only subnet to reach your backends:

   gcloud compute firewall-rules create fw-allow-proxies \
      --network=lb-network \
      --action=allow \
      --direction=ingress \
      --source-ranges=10.129.0.0/23 \
      --target-tags=load-balanced-backend \
      --rules=tcp:80,tcp:443,tcp:8080
   

3. Create the fw-allow-ssh firewall rule to allow SSH connectivity to VMs with the network tag allow-ssh:

   gcloud compute firewall-rules create fw-allow-ssh \
      --network=lb-network \
      --action=allow \
      --direction=ingress \
      --target-tags=allow-ssh \
      --rules=tcp:22
   

Console

1. Set up Shared VPC.

2. In the Google Cloud console, go to the Shared VPC page.

   Go to Shared VPC

3. Sign in as a Shared VPC Admin.

4. Select the service project from the project picker.

5. Go to VPC network >IP addresses.

6. In the IP addresses page, click Reserve internal static IP address.

7. In the Name field, enter l7-ilb-ip-address as the IP address name.

8. In the IP version list, select IPv4.

9. In the Network, select lb-network.

10. In the Subnetwork lists, select lb-frontend-and-backend-subnet.

11. Click Reserve.

gcloud

1. If you have not already, authenticate to the Google Cloud CLI as a Shared VPC Service Project Admin.

   gcloud auth login SERVICE_PROJECT_ADMIN
   

   Replace SERVICE_PROJECT_ADMIN with the name of the Shared VPC Service Project Admin. These values must have the format username@yourdomain, for example, 222larabrown@gmail.com.

2. Use the compute addresses create command to reserve an IP address:

   
   gcloud compute addresses create l7-ilb-ip-address \
       --project SERVICE_PROJECT_1_ID \
       --subnet=lb-frontend-and-backend-subnet \
       --region=us-west1 \
       --ip-version=IPV4
   

Additional details for creating IP addresses are published in the SDK documentation.

Console

1. Create an instance template. In the Google Cloud console, go to the Instance templates page.

   Go to Instance templates

   1. Click Create instance template.
   2. Enter a Name for the instance template: tutorial-ig-template-sp2.
   3. In the Location section, select Regional (recommended) and us-west1(Oregon) as the Region.
   4. In the Machine configuration section, select N2 as the series.
   5. Ensure that the Boot disk is set to a Debian image, such as Debian GNU/Linux 12 (bookworm). These instructions use commands that are only available on Debian, such as apt-get. If you need to change the Boot disk, click Change.
      1. For Operating System, select Debian.
      2. For Version, select one of the available Debian images such as Debian GNU/Linux 12 (bookworm).
      3. Click Select.
   6. Click Advanced options, and then click Networking.
   7. Enter the following Network tags: allow-ssh,load-balanced-backend.
   8. In the Network interfaces section, select Networks shared with me (from host project: SERVICE_PROJECT_1_ID).
   9. Select the lb-frontend-and-backend-subnet subnet from the lb-network network.
   10. Click Management. For Management, insert the following script into the Startup script field.

       #! /bin/bash
       apt-get update
       apt-get install apache2 -y
       a2ensite default-ssl
       a2enmod ssl
       vm_hostname="$(curl -H "Metadata-Flavor:Google" http://metadata.google.internal/computeMetadata/v1/instance/name)"
       echo "Page served from: $vm_hostname" | tee /var/www/html/index.html
       systemctl restart apache2
       

   11. Click Create.

2. Create a managed instance group. In the Google Cloud console, go to the Instance groups page.

   Go to Instance groups

   1. Click Create instance group.
   2. Choose New managed instance group (stateless). For more information, see Stateless or stateful MIGs.
   3. Enter a Name for the instance group: tutorial-sp2-mig-a.
   4. For Instance template, select tutorial-ig-template-sp2.
   5. For Location, select Single zone.
   6. For Region, select us-west1.

   7. Specify the number of instances that you want to create in the group.

      For this example, specify the following options for Autoscaling:

      • For Autoscaling mode, select Off:do not autoscale.
      • For Maximum number of instances, enter 2.

   8. Click Create.

3. Create a regional backend service. As a part of this step we'll also create the health check and add backends to the backend service. In the Google Cloud console, go to the Backends page.

   Go to Backends

   1. Click Create backend service.
   2. In the Create backend service dialog, click Create beside Regional backend service.
   3. Enter a Name for the backend service: tutorial-backend-service-sp2.
   4. For Region, select us-west1.
   5. For Load balancer type, select Regional internal Application Load Balancer (INTERNAL_MANAGED).
   6. Set Backend type to Instance group.
   7. In the Backends section, set the following fields:
      1. Set Instance group to tutorial-sp2-mig-a.
      2. Enter the Port numbers: 80.
      3. Set Balancing mode to Utilization.
      4. Click Done.
   8. In the Health check section, click Create a health check and set the following fields:
      1. Name: tutorial-regional-health-check
      2. Protocol: HTTP
      3. Port: 80
      4. Click Save.
   9. Click Continue.
   10. Click Create.

4. Repeat the earlier steps and create a managed instance group, tutorial-sp2-mig-b and add it to the backend service, tutorial-backend-service-sp2.

gcloud

1. Select the service project that you created:

   gcloud config set project SERVICE_PROJECT_2_ID

2. Create a VM instance template, tutorial-ig-template-sp2 with an HTTP server:

   gcloud compute instance-templates create tutorial-ig-template-sp2 \
       --region=us-west1 \
       --network=projects/SERVICE_PROJECT_1_ID/global/networks/lb-network \
       --subnet=projects/SERVICE_PROJECT_1_ID/regions/us-west1/subnetworks/lb-frontend-and-backend-subnet \
       --tags=allow-ssh,load-balanced-backend \
       --image-family=debian-12 \
       --image-project=debian-cloud \
       --metadata=startup-script='#! /bin/bash
       apt-get update
       apt-get install apache2 -y
       a2ensite default-ssl
       a2enmod ssl
       vm_hostname="$(curl -H "Metadata-Flavor:Google" \
       http://metadata.google.internal/computeMetadata/v1/instance/name)"
       echo "Page served from: $vm_hostname" | \
       tee /var/www/html/index.html
       systemctl restart apache2' \
       --project=SERVICE_PROJECT_2_ID
   

   Replace the following:

   • SERVICE_PROJECT_1_ID: the project ID for the Shared VPC host project.
   • SERVICE_PROJECT_2_ID: the project ID for the service project, where the load balancer's backends and the backend service are being created.

3. Create a managed instance group, tutorial-sp2-mig-a in the region:

   gcloud compute instance-groups managed create tutorial-sp2-mig-a \
       --region=us-west1 \
       --size=2 \
       --template=tutorial-ig-template-sp2 \
       --project=SERVICE_PROJECT_2_ID
   

4. Define the HTTP health check, tutorial-regional-health-check:

   gcloud compute health-checks create http tutorial-regional-health-check \
     --region=us-west1 \
     --use-serving-port \
     --project=SERVICE_PROJECT_2_ID
   

5. Define the backend service, tutorial-backend-service-sp2:

   gcloud compute backend-services create tutorial-backend-service-sp2 \
     --load-balancing-scheme=INTERNAL_MANAGED \
     --protocol=HTTP \
     --health-checks=tutorial-regional-health-check \
     --health-checks-region=us-west1 \
     --region=us-west1 \
     --project=SERVICE_PROJECT_2_ID
   

6. Add backends to the backend service with the gcloud compute backend-services add-backend command:

   gcloud compute backend-services add-backend tutorial-backend-service-sp2 \
     --balancing-mode=UTILIZATION \
     --instance-group=tutorial-sp2-mig-a \
     --instance-group-region=us-west1 \
     --region=us-west1 \
     --project=SERVICE_PROJECT_2_ID
   

7. Create another managed instance group, tutorial-sp2-mig-b in the region:

   gcloud compute instance-groups managed create tutorial-sp2-mig-b \
       --region=us-west1 \
       --size=2 \
       --template=tutorial-ig-template-sp2 \
       --project=SERVICE_PROJECT_2_ID
   

8. Add backends to the backend service:

   gcloud compute backend-services add-backend tutorial-backend-service-sp2 \
     --balancing-mode=UTILIZATION \
     --instance-group=tutorial-sp2-mig-b \
     --instance-group-region=us-west1 \
     --region=us-west1 \
     --project=SERVICE_PROJECT_2_ID
   

Console

1. Create an instance template. In the Google Cloud console, go to the Instance templates page.

   Go to Instance templates

   1. Click Create instance template.
   2. Enter a Name for the instance template: tutorial-ig-template-sp3.
   3. In the Location section, select Regional (recommended) and us-west1(Oregon) as the Region.
   4. In the Machine configuration section, select N2 as the series.
   5. Ensure that the Boot disk is set to a Debian image, such as Debian GNU/Linux 12 (bookworm). These instructions use commands that are only available on Debian, such as apt-get. If you need to change the Boot disk, click Change.
      1. For Operating System, select Debian.
      2. For Version, select one of the available Debian images such as Debian GNU/Linux 12 (bookworm).
      3. Click Select.
   6. Click Advanced options, and then click Networking.
   7. Enter the following Network tags: allow-ssh,load-balanced-backend.
   8. In the Network interfaces section, select Networks shared with me (from host project: SERVICE_PROJECT_1_ID).
   9. Select the lb-frontend-and-backend-subnet subnet from the lb-network network.
   10. Click Management. For Management, insert the following script into the Startup script field.

       #! /bin/bash
       apt-get update
       apt-get install apache2 -y
       a2ensite default-ssl
       a2enmod ssl
       vm_hostname="$(curl -H "Metadata-Flavor:Google" http://metadata.google.internal/computeMetadata/v1/instance/name)"
       echo "Page served from: $vm_hostname" | tee /var/www/html/index.html
       systemctl restart apache2
       

   11. Click Create.

2. Create a managed instance group. In the Google Cloud console, go to the Instance groups page.

   Go to Instance groups

   1. Click Create instance group.
   2. Choose New managed instance group (stateless). For more information, see Stateless or stateful MIGs.
   3. Enter a Name for the instance group: tutorial-sp3-mig-a.
   4. For Instance template, select tutorial-ig-template-sp3.
   5. For Location, select Single zone.
   6. For Region, select us-west1.

   7. Specify the number of instances that you want to create in the group.

      For this example, specify the following options for Autoscaling:

      • For Autoscaling mode, select Off:do not autoscale.
      • For Maximum number of instances, enter 2.

   8. Click Create.

3. Create a regional backend service. As a part of this step we'll also create the health check and add backends to the backend service. In the Google Cloud console, go to the Backends page.

   Go to Backends

   1. Click Create backend service.
   2. In the Create backend service dialog, click Create beside Regional backend service.
   3. Enter a Name for the backend service: tutorial-backend-service-sp3.
   4. For Region, select us-west1.
   5. For Load balancer type, select Regional internal Application Load Balancer (INTERNAL_MANAGED).
   6. Set Backend type to Instance group.
   7. In the Backends section, set the following fields:
      1. Set Instance group to tutorial-sp3-mig-a.
      2. Enter the Port numbers: 80.
      3. Set Balancing mode to Utilization.
      4. Click Done.
   8. In the Health check section, click Create a health check and set the following fields:
      1. Name: tutorial-regional-health-check
      2. Protocol: HTTP
      3. Port: 80
      4. Click Save.
   9. Click Continue.
   10. Click Create.

4. Repeat the earlier steps and create a managed instance group, tutorial-sp3-mig-b and add it to the backend service, tutorial-backend-service-sp3.

gcloud

1. Select the service project that you created:

   gcloud config set project SERVICE_PROJECT_3_ID

2. Create a VM instance template, tutorial-ig-template-sp3 with an HTTP server:

   gcloud compute instance-templates create tutorial-ig-template-sp3 \
       --region=us-west1 \
       --network=projects/SERVICE_PROJECT_1_ID/global/networks/lb-network \
       --subnet=projects/SERVICE_PROJECT_1_ID/regions/us-west1/subnetworks/lb-frontend-and-backend-subnet \
       --tags=allow-ssh,load-balanced-backend \
       --image-family=debian-12 \
       --image-project=debian-cloud \
       --metadata=startup-script='#! /bin/bash
       apt-get update
       apt-get install apache2 -y
       a2ensite default-ssl
       a2enmod ssl
       vm_hostname="$(curl -H "Metadata-Flavor:Google" \
       http://metadata.google.internal/computeMetadata/v1/instance/name)"
       echo "Page served from: $vm_hostname" | \
       tee /var/www/html/index.html
       systemctl restart apache2' \
       --project=SERVICE_PROJECT_3_ID
   

   Replace the following:

   • SERVICE_PROJECT_1_ID: the project ID for the Shared VPC host project.
   • SERVICE_PROJECT_3_ID: the project ID for the service project, where the load balancer's backends and the backend service are being created.

3. Create a managed instance group, tutorial-sp3-mig-a in the region:

   gcloud compute instance-groups managed create tutorial-sp3-mig-a \
       --region=us-west1 \
       --size=2 \
       --template=tutorial-ig-template-sp3 \
       --project=SERVICE_PROJECT_3_ID
   

4. Define the HTTP health check, tutorial-regional-health-check:

   gcloud compute health-checks create http tutorial-regional-health-check \
     --region=us-west1 \
     --use-serving-port \
     --project=SERVICE_PROJECT_3_ID
   

5. Define the backend service, tutorial-backend-service-sp3:

   gcloud compute backend-services create tutorial-backend-service-sp3 \
     --load-balancing-scheme=INTERNAL_MANAGED \
     --protocol=HTTP \
     --health-checks=tutorial-regional-health-check \
     --health-checks-region=us-west1 \
     --region=us-west1 \
     --project=SERVICE_PROJECT_3_ID
   

6. Add backends to the backend service with the gcloud compute backend-services add-backend command:

   gcloud compute backend-services add-backend tutorial-backend-service-sp3 \
     --balancing-mode=UTILIZATION \
     --instance-group=tutorial-sp3-mig-a \
     --instance-group-region=us-west1 \
     --region=us-west1 \
     --project=SERVICE_PROJECT_3_ID
   

7. Create another managed instance group, tutorial-sp3-mig-b in the region:

   gcloud compute instance-groups managed create tutorial-sp3-mig-b \
       --region=us-west1 \
       --size=2 \
       --template=tutorial-ig-template-sp3 \
       --project=SERVICE_PROJECT_3_ID
   

8. Add backends to the backend service:

   gcloud compute backend-services add-backend tutorial-backend-service-sp3 \
     --balancing-mode=UTILIZATION \
     --instance-group=tutorial-sp3-mig-b \
     --instance-group-region=us-west1 \
     --region=us-west1 \
     --project=SERVICE_PROJECT_3_ID
   

Console

Start your configuration

1. In the Google Cloud console, go to the Load balancing page.

   Go to Load balancing

2. Click Create load balancer.
3. For Type of load balancer, select Application Load Balancer (HTTP/HTTPS) and click Next.
4. For Public facing or internal, select Internal and click Next.
5. For Cross-region or single region deployment, select Best for regional workloads and click Next.
6. Click Configure.

Basic configuration

1. Enter a Name for the load balancer, tutorial-url-maps.
2. In the Region list, select us-west1.

3. In the Network list, select lb-network (from Project: SERVICE_PROJECT_1_ID).

   If you see a Proxy-only subnet required in Shared VPC network warning, confirm that the host project administrator has created the proxy-only-subnet in the us-west1 region in the lb-network Shared VPC network. Load balancer creation succeeds even if you don't have permission to view the proxy-only subnet on this page.

4. Keep the window open to continue.

Configure the backend

1. Click Backend configuration.
2. Click Cross-project backend services.
3. In the Project ID field, enter the project ID for Service Project 2.
4. In the Backend service name field, enter the name of the backend service from Service Project 2 that you want to use. For this example, it's tutorial-backend-service-sp2.
5. Click Add backend service.
6. In the Project ID field, enter the project ID for Service Project 3.
7. In the Backend service name field, enter the name of the backend service from Service Project 3 that you want to use. For this example, it's tutorial-backend-service-sp3.
8. Click Add backend service.

Configure the routing rules

1. Click Routing rules.
2. In the Host and path rules section, in the Host 2 field, enter *.
3. In the Paths 2 field, enter /*.
4. From the Backend 2 drop-down list, select tutorial-backend-service-sp2.
5. Click Add host and path rule.
6. In the Host 3 field, enter tutorial-host.
7. In the Paths 3 field, enter /*.

8. From the Backend 3 drop-down list, select tutorial-backend-service-sp3.

9. Look for the blue checkmark to the left of Host and Path Rules and click the Update button.

   For information about traffic management, see Setting up traffic management.

Configure the frontend

For cross-project service referencing to work, the frontend must use the same network (lb-network) from the Shared VPC host project that was used to create the backend service.

1. Click Frontend configuration.
2. Enter a Name for the forwarding rule: l7-ilb-forwarding-rule.
3. Set the Protocol to HTTP.
4. Set the Subnetwork to lb-frontend-and-backend-subnet. Don't select the proxy-only subnet for the frontend even if it is an option in the list.
5. Set the Port to 80.
6. In the IP address field, retain the default option, Ephemeral (Automatic).
7. Click Done.

Review and finalize the configuration

• Click Create.

gcloud

1. Select the service project that you created:

   gcloud config set project SERVICE_PROJECT_1_ID

2. Create the URL map, tutorial-url-maps and set the default service to the backend service created in Service Project 1:

   gcloud compute url-maps create tutorial-url-maps \
       --default-service=projects/SERVICE_PROJECT_2_ID/regions/us-west1/backendServices/tutorial-backend-service-sp2 \
       --region=us-west1 \
       --project=SERVICE_PROJECT_1_ID
   

   Replace the following:

   • SERVICE_PROJECT_2_ID: the project ID for Service Project 2, where the load balancer's backends and the backend service are created.
   • SERVICE_PROJECT_1_ID: the project ID for Service Project 1, where the load balancer's frontend is being created.

3. Create the target proxy, tutorial-http-proxy:

   gcloud compute target-http-proxies create tutorial-http-proxy \
     --url-map=tutorial-url-maps \
     --url-map-region=us-west1 \
     --region=us-west1 \
     --project=SERVICE_PROJECT_1_ID
   

4. Create the forwarding rule, l7-ilb-forwarding-rule to handle HTTP traffic. For cross-project service referencing to work, the forwarding rule must use the same network (lb-network) from the Shared VPC host project that was used to create the backend service.

   gcloud compute forwarding-rules create l7-ilb-forwarding-rule \
     --load-balancing-scheme=INTERNAL_MANAGED \
     --network=projects/SERVICE_PROJECT_1_ID/global/networks/lb-network \
     --subnet=projects/SERVICE_PROJECT_1_ID/regions/us-west1/subnetworks/lb-frontend-and-backend-subnet \
     --address=l7-ilb-ip-address \
     --ports=80 \
     --region=us-west1 \
     --target-http-proxy=tutorial-http-proxy \
     --target-http-proxy-region=us-west1 \
     --project=SERVICE_PROJECT_1_ID
   

5. To send traffic to the backend service, link the URL map with the backend service. For more information, see Use URL maps.

   1. Link the backend service tutorial-backend-service-sp2 in Service Project 2 with the URL map, tutorial-url-maps and path matcher name, tutorial-path-matcher-sp2:

      gcloud compute url-maps add-path-matcher tutorial-url-maps \
         --path-matcher-name=tutorial-path-matcher-sp2 \
         --default-service=projects/SERVICE_PROJECT_2_ID/regions/us-west1/backendServices/tutorial-backend-service-sp2 \
         --region=us-west1
      

   2. Link the backend service, tutorial-backend-service-sp3 in Service Project 3 with the URL map, tutorial-url-maps and path matcher name, tutorial-path-matcher-sp3. Add new host rule, tutorial-host with the given hosts so that the path matcher is tied to the new host rule

      gcloud compute url-maps add-path-matcher tutorial-url-maps \
        --path-matcher-name=tutorial-path-matcher-sp3 \
        --default-service=projects/SERVICE_PROJECT_3_ID/regions/us-west1/backendServices/tutorial-backend-service-sp3 \
        --region=us-west1 \
        --new-hosts=tutorial-host
      

Console

1. In the Google Cloud console, go to the VM instances page.

   Go to VM instances

2. Click Create instance.

3. In the Name field, enter client-vm.

4. Set the Zone to us-west1-b.

5. Click Advanced options, and then click Networking.

6. Enter the following Network tags: allow-ssh,load-balanced-backend.

7. In the Network interfaces section, select Networks shared with me (from host project: SERVICE_PROJECT_1_ID).

8. Select the lb-frontend-and-backend-subnet subnet from the lb-network network.

9. Click Create.

gcloud

Create a test VM instance.

gcloud compute instances create client-vm \
    --image-family=debian-12 \
    --image-project=debian-cloud \
    --subnet=projects/SERVICE_PROJECT_1_ID/regions/us-west1/subnetworks/lb-frontend-and-backend-subnet \
    --zone=us-west1-b \
    --tags=allow-ssh \
    --project=SERVICE_PROJECT_2_ID

Console

1. In the Google Cloud console, go to the project selector page.

   Go to project selector

2. Select the App Hub host project.

3. In the Google Cloud console, go to the IAM page.

   Go to IAM

4. Click person_addGrant access. The Grant access pane opens.

5. In the New principals field, enter the email address of the individual who will administer App Hub, the App Hub Admin role in the App Hub host project.

6. Click Select a role and in the Filter field, enter App Hub.

7. Select the App Hub Admin role and click Save.

8. In each of the App Hub service projects, grant the App Hub Admin role to the same user.

gcloud

1. To grant the roles to individuals who will use App Hub, repeat the following command by replacing the IAM roles, as required. For more information, see App Hub roles and permissions.

   gcloud projects add-iam-policy-binding HOST_PROJECT_ID \
       --member='user:HOST_PROJECT_ADMIN' \
       --role='roles/apphub.admin'

   Replace HOST_PROJECT_ADMIN with the user who has the App Hub Admin role in the App Hub host project. This value has the format username@yourdomain, for example, 222larabrown@gmail.com.

2. Grant the App Hub Admin role in the service project to the individuals who administer App Hub. They must have the App Hub Admin role to add service projects to the host project. You need at least one person with this role for each service project.

   gcloud projects add-iam-policy-binding SERVICE_PROJECT_ID \
      --member='user:HOST_PROJECT_ADMIN' \
      --role='roles/apphub.admin'

   Replace SERVICE_PROJECT_ID with the ID of the service projects.

Console

1. In the Google Cloud console, go to the App Hub Settings page.

   Go to Settings

2. On the Settings page, click Attach projects.

3. On the pane that opens, search for projects from the displayed list and select the checkboxes for the projects you want to add as the service projects.

4. Click Select. The Attached Service Project(s) table displays the selected service projects.

5. Click Close.

gcloud

1. Attach service projects 1, 2, and 3 to your App Hub host project.

   gcloud apphub service-projects add SERVICE_PROJECT_1_ID \
     --project=HOST_PROJECT_ID
   

   gcloud apphub service-projects add SERVICE_PROJECT_2_ID \
     --project=HOST_PROJECT_ID
   

   gcloud apphub service-projects add SERVICE_PROJECT_3_ID \
     --project=HOST_PROJECT_ID
   

2. Confirm that you have attached the App Hub service projects to the App Hub host project:

   gcloud apphub service-projects list --project=HOST_PROJECT_ID
   

Console

1. Make sure that you're in the App Hub host project.

2. In the Google Cloud console, go to the App Hub Applications page.

   Go to Applications

3. Click Create application.

4. On the Create application page, in the Choose application region and name pane, select Global.

5. In the Application name field, enter tutorial-application. This name is a unique identifier and is immutable after you create the application.

6. Enter a Display name, Tutorial and click Continue. This is a user-friendly name that you can update. For more information, see Update an existing application.

7. In the Add attributes pane, from the Criticality list, select High. Criticality indicates how critical an application, service, or workload is to your business operations.

8. In the Environment field, to indicate the stage of the software lifecycle, select Production.

9. Click Continue.

10. In the Add owners pane, add the following details for Developer Owners, Operator Owners, and Business Owners. Note that you must enter the owner's email address if you add a display name.

    1. Enter an owner's display name.
    2. Enter the owner's email address. This value must have the format username@yourdomain, for example, 222larabrown@gmail.com.

11. Repeat these steps for each developer, operator, and business owner.

12. Click Create.

The new application gets created and is listed on the Applications page. Note that only the forwarding rule, URL map, backend service, and managed instance group (MIG) become available as discovered resources on the App Hub application. For more information, see concepts and data model.

gcloud

1. Select the App Hub host project that you created:

   gcloud config set project HOST_PROJECT_ID

2. Create a new application called tutorial-application in the region, global and give it a display name, Tutorial. This application name, tutorial-application is a unique identifier and is immutable after you create the application. The display name,Tutorial is a user-friendly name that you can update. For more information, see Update an existing application.

   gcloud apphub applications create tutorial-application \
       --display-name='Tutorial' \
       --scope-type=GLOBAL \
       --project=HOST_PROJECT_ID \
       --location=global
   

3. List the applications in your App Hub host project:

   gcloud apphub applications list \
       --project=HOST_PROJECT_ID \
       --location=global
   

   You see output similar to the following:

   ID                    DISPLAY_NAME  CREATE_TIME
   tutorial-application  Tutorial      2023-10-31T18:33:48
   

4. Update your application with the criticality-type, environment-type, and owner attributes:

   gcloud apphub applications update tutorial-application \
     --criticality-type='HIGH' \
     --environment-type='PRODUCTION' \
     --developer-owners=display-name=DISPLAY-NAME-DEVELOPER,email=EMAIL-DEVELOPER \
     --operator-owners=display-name=DISPLAY-NAME-OPERATOR,email=EMAIL-OPERATOR \
     --business-owners=display-name=DISPLAY-NAME-BUSINESS,email=EMAIL-BUSINESS \
     --project=HOST_PROJECT_ID \
     --location=global
   

   Replace the following:

   • DISPLAY-NAME-DEVELOPER, DISPLAY-NAME-OPERATOR, and DISPLAY-NAME-BUSINESS: display names of the developer, operator, and business owners, respectively.
   • EMAIL-NAME-DEVELOPER, EMAIL-NAME-OPERATOR, and EMAIL-NAME-BUSINESS: email addresses of the developer, operator, and business owners, respectively. These values must have the format username@yourdomain, for example, 222larabrown@gmail.com.

   Notes:

   • criticality-type: indicates how critical an application, service, or workload is to your business operations.
   • environment-type: indicates the stages of the software lifecycle.

5. Get details for the application that you created:

   gcloud apphub applications describe tutorial-application \
     --project=HOST_PROJECT_ID \
     --location=global
   

   The command returns information in YAML format, similar to the following:

   attributes:
   businessOwners:
   – displayName: [DISPLAY-NAME-BUSINESS]
     email: [EMAIL-BUSINESS]
   criticality:
     type: HIGH
   developerOwners:
   – displayName: [DISPLAY-NAME-DEVELOPER]
     email: [EMAIL-DEVELOPER]
   environment:
     type: PRODUCTION
   operatorOwners:
   – displayName: [DISPLAY-NAME-OPERATOR]
     email: [EMAIL-OPERATOR]
   createTime: '2023-10-31T18:33:48.199394108Z'
   displayName: Tutorial
   name: projects/HOST_PROJECT_ID/locations/global/applications/tutorial-application
   scope:
     type: REGIONAL
   state: ACTIVE
   uid: 9d991a9d-5d8a-4c0d-b5fd-85e39fb58c73
   updateTime: '2023-10-31T18:33:48.343303819Z'
   

Console

1. In the Google Cloud console, go to the App Hub Applications page.

   Go to Applications

2. Click the name of your application, Tutorial. The Services and workloads tab is displayed with a list of registered services and workloads that are in your App Hub service projects.

3. Register a service:

   1. On the Services and workloads tab, click Register service/workload.
   2. On the Register service or workload page, in the Select resource pane, click Browse to select the service or workload as a Resource.
   3. In the Select resource pane, choose the Name of the service, tutorial-backend-service-sp2, and click Select.
   4. In the Select resource pane, enter the Name of the resource, tutorial-service-backend-sp2.
   5. Enter a Display name, Backend service (SP2) and click Continue.
   6. In the Add attributes pane, in the Criticality list, to indicate the importance of the application, select High.
   7. In the Environment field, to indicate the stage of the software lifecycle, select Production.
   8. Click Continue.
   9. In the Add owners pane, add the following details as required for Developer Owners, Operator Owners, and Business Owners. Note that you must enter the owner's email address if you add a display name.
      1. Enter an owner's display name.
      2. Enter the owner's email address. This value must have the format username@yourdomain, for example, 222larabrown@gmail.com.
   10. Repeat these steps for each developer, operator, and business owner.
   11. Click Register.

   On the Services and workloads tab, in the Registered services and workloads section, you can see the new service added.

4. Repeat the previous steps to register the other services as tutorial-service-backend-sp3, tutorial-service-forwarding-rule and tutorial-service-url-map, respectively.
5. Register a workload by repeating the earlier steps to register a service with the following exceptions:
   1. In the Register service or workload pane, in the Choose service or workload section, select the Name of the workload, tutorial-sp2-mig-a, and click Continue.
   2. In the Select resource pane, enter the Name of the resource, tutorial-workload-sp2-mig-a.
   3. Enter a Display name, Instance group - A (SP2) and click Continue.
6. Repeat the previous steps to register the other workloads as tutorial-workload-sp2-mig-a, tutorial-workload-sp2-mig-b, tutorial-workload-sp3-mig-a, and tutorial-workload-sp3-mig-b, respectively.

gcloud

1. Add an individual with App Hub Editor permissions:

   gcloud projects add-iam-policy-binding HOST_PROJECT_ID \
     --member='user:APP_HUB_EDITOR' \
     --role='roles/apphub.editor'
   

   Replace APP_HUB_EDITOR with the user who has the App Hub Editor role in the App Hub host project. This value has the format username@yourdomain, for example, 222larabrown@gmail.com.

2. List all discovered services in the App Hub host project. This command returns services that are available to be registered to an application.

   gcloud apphub discovered-services list \
       --project=HOST_PROJECT_ID \
       --location=us-west1
   

   You see output similar to the following:

   ID                             SERVICE_REFERENCE                                                                                                                      SERVICE_PROPERTIES
   BACKEND_SERVICE_SP2_ID      {'uri': '//compute.googleapis.com/projects/[SERVICE_PROJECT_2_NUMBER]/regions/us-west1/backendServices/tutorial-backend-service-sp2'}  {'gcpProject': 'projects/SERVICE_PROJECT_2_ID', 'location': 'us-west1'}
   BACKEND_SERVICE_SP3_ID      {'uri': '//compute.googleapis.com/projects/[SERVICE_PROJECT_3_NUMBER]/regions/us-west1/backendServices/tutorial-backend-service-sp3'}  {'gcpProject': 'projects/SERVICE_PROJECT_3_ID', 'location': 'us-west1'}
   FORWARDING_RULE_SERVICE_ID  {'uri': '//compute.googleapis.com/projects/[SERVICE_PROJECT_1_NUMBER]/regions/us-west1/forwardingRules/l7-ilb-forwarding-rule'}        {'gcpProject': 'projects/SERVICE_PROJECT_1_ID', 'location': 'us-west1'}
   URL_MAP_SERVICE_ID          {'uri': '//compute.googleapis.com/projects/[SERVICE_PROJECT_1_NUMBER]/regions/us-west1/urlMaps/tutorial-url-maps'}                     {'gcpProject': 'projects/SERVICE_PROJECT_1_ID', 'location': 'us-west1'}
   

   Copy the service IDs, for example, BACKEND_SERVICE_SP2_ID from the output to use in the next step.

3. Register services from the previous step to your application. Copy the service IDs from the output field in the previous step.

   gcloud apphub applications services create tutorial-service-backend-sp2 \
       --discovered-service='projects/HOST_PROJECT_ID/locations/us-west1/discoveredServices/BACKEND_SERVICE_SP2_ID' \
       --display-name='Backend service (SP2)' \
       --criticality-type='HIGH' \
       --environment-type='PRODUCTION' \
       --application=tutorial-application \
       --project=HOST_PROJECT_ID \
       --location=global
   

   gcloud apphub applications services create tutorial-service-backend-sp3 \
       --discovered-service='projects/HOST_PROJECT_ID/locations/us-west1/discoveredServices/BACKEND_SERVICE_SP3_ID' \
       --display-name='Backend service (SP3)' \
       --criticality-type='HIGH' \
       --environment-type='PRODUCTION' \
       --application=tutorial-application \
       --project=HOST_PROJECT_ID \
       --location=global
   

   gcloud apphub applications services create tutorial-service-forwarding-rule \
       --discovered-service='projects/HOST_PROJECT_ID/locations/us-west1/discoveredServices/FORWARDING_RULE_SERVICE_ID' \
       --display-name='Forwarding rule' \
       --criticality-type='HIGH' \
       --environment-type='PRODUCTION' \
       --application=tutorial-application \
       --project=HOST_PROJECT_ID \
       --location=global
   

   gcloud apphub applications services create tutorial-service-url-map \
       --discovered-service='projects/HOST_PROJECT_ID/locations/us-west1/discoveredServices/URL_MAP_SERVICE_ID' \
       --display-name='URL map' \
       --criticality-type='HIGH' \
       --environment-type='PRODUCTION' \
       --application=tutorial-application \
       --project=HOST_PROJECT_ID \
       --location=global
   

   Replace the following:

   • BACKEND_SERVICE_SP2_ID: the service ID of the backend service from Service Project 2 that you want to register.
   • BACKEND_SERVICE_SP3_ID: the service ID of the backend service from Service Project 3 that you want to register.
   • FORWARDING_RULE_SERVICE_ID: the service ID of the forwarding rule from Service Project 1 that you want to register.
   • URL_MAP_SERVICE_ID: the service ID of the URL map from Service Project 1 that you want to register.

4. List all registered services in the application:

   gcloud apphub applications services list \
       --application=tutorial-application \
       --project=HOST_PROJECT_ID \
       --location=global
   

   You see output similar to the following:

   ID                               DISPLAY_NAME      SERVICE_REFERENCE                                                                                                                       CREATE_TIME
   tutorial-service-backend-sp2     Backend service   {'uri': '//compute.googleapis.com/projects/[SERVICE_PROJECT_2_NUMBER]/regions/us-west1/backendServices/tutorial-backend-service-sp2'}   2024-02-13T00:31:45
   tutorial-service-backend-sp3     Backend service   {'uri': '//compute.googleapis.com/projects/[SERVICE_PROJECT_3_NUMBER]/regions/us-west1/backendServices/tutorial-backend-service-sp3'}   2024-02-13T00:31:45
   tutorial-service-forwarding-rule Forwarding rule   {'uri': '//compute.googleapis.com/projects/[SERVICE_PROJECT_1_NUMBER]/regions/us-west1/forwardingRules/l7-ilb-forwarding-rule'}         2024-02-13T00:31:45
   tutorial-service-url-map         URL map           {'uri': '//compute.googleapis.com/projects/[SERVICE_PROJECT_1_NUMBER]/regions/us-west1/urlMaps/tutorial-url-maps'}                      2024-02-13T00:31:45
   

   Registered, but detached services are denoted by an empty value in the SERVICE_REFERENCE field. For more information on the registration statuses, see the properties and attributes of App Hub.

5. List all discovered workloads in the App Hub host project. This command returns workloads that are available to be registered to an application.

   gcloud apphub discovered-workloads list \
       --project=HOST_PROJECT_ID \
       --location=global
   

   You see output similar to the following:

   ID                            WORKLOAD_REFERENCE                                                                                                          WORKLOAD_PROPERTIES
   INSTANCE_GROUP_SP3_A_ID    {'uri': '//compute.googleapis.com/projects/[SERVICE_PROJECT_3_NUMBER]/zones/us-west1-a/instanceGroups/tutorial-sp3-mig-a'}  {'gcpProject': 'projects/SERVICE_PROJECT_3_ID', 'location': 'us-west1'}
   INSTANCE_GROUP_SP3_B_ID    {'uri': '//compute.googleapis.com/projects/[SERVICE_PROJECT_3_NUMBER]/zones/us-west1-a/instanceGroups/tutorial-sp3-mig-b'}  {'gcpProject': 'projects/SERVICE_PROJECT_3_ID', 'location': 'us-west1'}
   INSTANCE_GROUP_SP2_A_ID    {'uri': '//compute.googleapis.com/projects/[SERVICE_PROJECT_2_NUMBER]/zones/us-west1-a/instanceGroups/tutorial-sp2-mig-a'}  {'gcpProject': 'projects/SERVICE_PROJECT_2_ID', 'location': 'us-west1'}
   INSTANCE_GROUP_SP2_B_ID    {'uri': '//compute.googleapis.com/projects/[SERVICE_PROJECT_2_NUMBER]/zones/us-west1-a/instanceGroups/tutorial-sp2-mig-b'}  {'gcpProject': 'projects/SERVICE_PROJECT_2_ID', 'location': 'us-west1'}
   

   Copy the workload ID from the output to use in the next step.

6. Register the workloads from the previous step to your application. Copy the workload ID from the output field in the previous step.

   gcloud apphub applications workloads create tutorial-workload-sp3-mig-a \
       --discovered-workload='projects/HOST_PROJECT_ID/locations/us-west1/discoveredWorkloads/INSTANCE_GROUP_SP3_A_ID' \
       --display-name='Workload instance group (SP3-A)' \
       --application=tutorial-application \
       --project=HOST_PROJECT_ID \
       --location=global
   

   gcloud apphub applications workloads create tutorial-workload-sp3-mig-b \
       --discovered-workload='projects/HOST_PROJECT_ID/locations/us-west1/discoveredWorkloads/INSTANCE_GROUP_SP3_B_ID' \
       --display-name='Workload instance group (SP3-B)' \
       --application=tutorial-application \
       --project=HOST_PROJECT_ID \
       --location=global
   

   gcloud apphub applications workloads create tutorial-workload-sp2-mig-a \
       --discovered-workload='projects/HOST_PROJECT_ID/locations/us-west1/discoveredWorkloads/INSTANCE_GROUP_SP2_A_ID' \
       --display-name='Workload instance group (SP2-A)' \
       --application=tutorial-application \
       --project=HOST_PROJECT_ID \
       --location=global
   

   gcloud apphub applications workloads create tutorial-workload-sp2-mig-b \
       --discovered-workload='projects/HOST_PROJECT_ID/locations/us-west1/discoveredWorkloads/INSTANCE_GROUP_SP2_B_ID' \
       --display-name='Workload instance group (SP2-B)' \
       --application=tutorial-application \
       --project=HOST_PROJECT_ID \
       --location=global
   

   Replace the following:

   • INSTANCE_GROUP_SP3_A_ID, INSTANCE_GROUP_SP3_B_ID: the workload IDs of the managed instance groups from Service Project 3 that you want to register.
   • INSTANCE_GROUP_SP2_A_ID, INSTANCE_GROUP_SP2_B_ID: the workload IDs of the managed instance groups from Service Project 2 that you want to register.

7. List all registered workloads in the application:

   gcloud apphub applications workloads list \
       --application=tutorial-application \
       --project=HOST_PROJECT_ID \
       --location=global
   

   You see output similar to the following:

   ID                              DISPLAY_NAME                      SERVICE_REFERENCE                                                                                                            CREATE_TIME
   tutorial-workload-sp3-mig-a     Workload instance group (SP3-A)   {'uri': '//compute.googleapis.com/projects/[SERVICE_PROJECT_3_NUMBER]/zones/us-west1-a/instanceGroups/tutorial-sp3-mig-a'}   2024-02-13T00:31:45
   tutorial-workload-sp3-mig-b     Workload instance group (SP3-B)   {'uri': '//compute.googleapis.com/projects/[SERVICE_PROJECT_3_NUMBER]/zones/us-west1-a/instanceGroups/tutorial-sp3-mig-b'}   2024-02-13T00:31:45
   tutorial-workload-sp2-mig-a     Workload instance group (SP2-A)   {'uri': '//compute.googleapis.com/projects/[SERVICE_PROJECT_2_NUMBER]/zones/us-west1-a/instanceGroups/tutorial-sp2-mig-a'}   2024-02-13T00:31:45
   tutorial-workload-sp2-mig-b     Workload instance group (SP2-B)   {'uri': '//compute.googleapis.com/projects/[SERVICE_PROJECT_2_NUMBER]/zones/us-west1-a/instanceGroups/tutorial-sp2-mig-b'}   2024-02-13T00:31:45
   

   Registered, but detached workloads are denoted by an empty value in the WORKLOAD_REFERENCE field. For more information on the registration statuses, see the properties and attributes of App Hub.