This [blueprint](./psc-glb-and-armor/) shows how to configure an external Google Cloud Load Balancer, with a simple Cloud Armor rule to protect against DDOS attacks, to provide an external endpoint to an application provided by another team via Private Service Connect (PSC).
+
+It is meant to be used as a starting point for users that want to explore PSC to reduce some of the complexity in their network setup.
+
+ 
string | ✓ | |
+| [prefix](variables.tf#L22) | Prefix used for resource names. | string | ✓ | |
+| [producer_project_id](variables.tf#L31) | The producer project, in which the ILB, PSC Service Attachment and Cloud Run service should be created. | string | ✓ | |
+| [project_create](variables.tf#L36) | Create project instead of using an existing one. | bool | | false |
+| [region](variables.tf#L42) | The GCP region in which the resources should be deployed. | string | | "europe-west1" |
+| [zone](variables.tf#L48) | The GCP zone for the VM. | string | | "europe-west1-b" |
+
+## Outputs
+
+| name | description | sensitive |
+|---|---|:---:|
+| [lb_ip](outputs.tf#L17) | Load balancer IP address. | |
+
+
+## Test
+
+```hcl
+module "psc-glb-and-armor-test" {
+ source = "./fabric/blueprints/networking/psc-glb-and-armor"
+ prefix = "test"
+ project_create = true
+ consumer_project_id = "project-1"
+ producer_project_id = "project-2"
+}
+# tftest modules=3 resources=31
+```
diff --git a/blueprints/networking/psc-glb-and-armor/consumer.tf b/blueprints/networking/psc-glb-and-armor/consumer.tf
new file mode 100644
index 0000000000..4e02c9e0f9
--- /dev/null
+++ b/blueprints/networking/psc-glb-and-armor/consumer.tf
@@ -0,0 +1,98 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+module "consumer_project" {
+ source = "../../../modules/project"
+ name = var.consumer_project_id
+ project_create = var.project_create
+ services = [
+ "iam.googleapis.com",
+ "compute.googleapis.com",
+ ]
+}
+
+resource "google_compute_region_network_endpoint_group" "psc_neg" {
+ name = "psc-neg"
+ region = var.region
+ project = module.consumer_project.project_id
+ network_endpoint_type = "PRIVATE_SERVICE_CONNECT"
+ psc_target_service = google_compute_service_attachment.psc_ilb_service_attachment.self_link
+
+ network = "default"
+ subnetwork = "default"
+}
+
+resource "google_compute_global_forwarding_rule" "default" {
+ project = module.consumer_project.project_id
+ name = "global-rule"
+ load_balancing_scheme = "EXTERNAL_MANAGED"
+ target = google_compute_target_http_proxy.default.id
+ port_range = "80"
+}
+
+resource "google_compute_target_http_proxy" "default" {
+ project = module.consumer_project.project_id
+ name = "target-proxy"
+ description = "a description"
+ url_map = google_compute_url_map.default.id
+}
+
+resource "google_compute_url_map" "default" {
+ project = module.consumer_project.project_id
+ name = "url-map-target-proxy"
+ description = "A simple URL Map, routing all traffic to the PSC NEG"
+ default_service = google_compute_backend_service.default.id
+
+ host_rule {
+ hosts = ["*"]
+ path_matcher = "allpaths"
+ }
+
+ path_matcher {
+ name = "allpaths"
+ default_service = google_compute_backend_service.default.id
+
+ path_rule {
+ paths = ["/*"]
+ service = google_compute_backend_service.default.id
+ }
+ }
+}
+
+resource "google_compute_security_policy" "policy" {
+ provider = google-beta
+ project = module.consumer_project.project_id
+ name = "ddos-protection"
+ adaptive_protection_config {
+ layer_7_ddos_defense_config {
+ enable = true
+ }
+ }
+}
+
+resource "google_compute_backend_service" "default" {
+ provider = google-beta
+ project = module.consumer_project.project_id
+ name = "backend"
+ load_balancing_scheme = "EXTERNAL_MANAGED"
+ protocol = "HTTPS"
+ security_policy = google_compute_security_policy.policy.id
+ backend {
+ group = google_compute_region_network_endpoint_group.psc_neg.id
+ balancing_mode = "UTILIZATION"
+ capacity_scaler = 1.0
+ }
+}
\ No newline at end of file
diff --git a/blueprints/networking/psc-glb-and-armor/diagram.png b/blueprints/networking/psc-glb-and-armor/diagram.png
new file mode 100644
index 0000000000..d72625a579
Binary files /dev/null and b/blueprints/networking/psc-glb-and-armor/diagram.png differ
diff --git a/blueprints/networking/psc-glb-and-armor/outputs.tf b/blueprints/networking/psc-glb-and-armor/outputs.tf
new file mode 100644
index 0000000000..b8e50ed43c
--- /dev/null
+++ b/blueprints/networking/psc-glb-and-armor/outputs.tf
@@ -0,0 +1,20 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+output "lb_ip" {
+ description = "Load balancer IP address."
+ value = google_compute_global_forwarding_rule.default.ip_address
+}
diff --git a/blueprints/networking/psc-glb-and-armor/producer.tf b/blueprints/networking/psc-glb-and-armor/producer.tf
new file mode 100644
index 0000000000..5755aff1a9
--- /dev/null
+++ b/blueprints/networking/psc-glb-and-armor/producer.tf
@@ -0,0 +1,231 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+module "producer_project" {
+ source = "../../../modules/project"
+ name = var.producer_project_id
+ project_create = var.project_create
+ services = [
+ "iam.googleapis.com",
+ "run.googleapis.com",
+ "compute.googleapis.com",
+ ]
+}
+
+resource "google_service_account" "app" {
+ project = module.producer_project.project_id
+ account_id = "example-app"
+ display_name = "Example App Service Account"
+}
+
+resource "google_cloud_run_service" "app" {
+ name = "example-app"
+ location = var.region
+ project = module.producer_project.project_id
+
+ template {
+ spec {
+ containers {
+ image = "kennethreitz/httpbin:latest"
+ ports {
+ container_port = 80
+ }
+ }
+ service_account_name = google_service_account.app.email
+ }
+ }
+
+ autogenerate_revision_name = true
+ traffic {
+ percent = 100
+ latest_revision = true
+ }
+ metadata {
+ annotations = {
+ "run.googleapis.com/ingress" = "internal-and-cloud-load-balancing"
+ }
+ }
+}
+
+resource "google_compute_region_network_endpoint_group" "neg" {
+ name = "example-app-neg"
+ network_endpoint_type = "SERVERLESS"
+ region = var.region
+ project = module.producer_project.project_id
+ cloud_run {
+ service = google_cloud_run_service.app.name
+ }
+}
+
+resource "google_compute_forwarding_rule" "psc_ilb_target_service" {
+ name = "producer-forwarding-rule"
+ region = var.region
+ project = module.producer_project.project_id
+
+ load_balancing_scheme = "INTERNAL_MANAGED"
+ port_range = "443"
+ allow_global_access = true
+ target = google_compute_region_target_https_proxy.default.id
+
+ network = google_compute_network.psc_ilb_network.name
+ subnetwork = google_compute_subnetwork.ilb_subnetwork.name
+}
+
+resource "google_compute_region_target_https_proxy" "default" {
+ name = "l7-ilb-target-http-proxy"
+ provider = google-beta
+ region = var.region
+ project = module.producer_project.project_id
+ url_map = google_compute_region_url_map.default.id
+ ssl_certificates = [google_compute_region_ssl_certificate.default.id]
+}
+
+resource "google_compute_region_ssl_certificate" "default" {
+ region = var.region
+ project = module.producer_project.project_id
+ name = "my-certificate"
+ private_key = tls_private_key.example.private_key_pem
+ certificate = tls_self_signed_cert.example.cert_pem
+}
+
+resource "google_compute_region_url_map" "default" {
+ name = "l7-ilb-regional-url-map"
+ provider = google-beta
+ region = var.region
+ project = module.producer_project.project_id
+ default_service = google_compute_region_backend_service.producer_service_backend.id
+}
+
+resource "tls_private_key" "example" {
+ algorithm = "RSA"
+ rsa_bits = 2048
+}
+
+resource "tls_self_signed_cert" "example" {
+ private_key_pem = tls_private_key.example.private_key_pem
+
+ subject {
+ common_name = "app.example.com"
+ organization = "Org"
+ }
+
+ validity_period_hours = 12
+
+ allowed_uses = [
+ "key_encipherment",
+ "digital_signature",
+ "server_auth",
+ ]
+}
+resource "google_compute_region_backend_service" "producer_service_backend" {
+ name = "producer-service"
+ region = var.region
+ project = module.producer_project.project_id
+ load_balancing_scheme = "INTERNAL_MANAGED"
+ protocol = "HTTPS"
+
+ backend {
+ group = google_compute_region_network_endpoint_group.neg.id
+ balancing_mode = "UTILIZATION"
+ capacity_scaler = 1.0
+ }
+}
+
+resource "google_compute_network" "psc_ilb_network" {
+ name = "psc-ilb-network"
+ auto_create_subnetworks = false
+ project = module.producer_project.project_id
+}
+
+resource "google_compute_subnetwork" "ilb_subnetwork" {
+ name = "ilb-subnetwork"
+ region = var.region
+ project = module.producer_project.project_id
+
+ network = google_compute_network.psc_ilb_network.id
+ ip_cidr_range = "10.0.0.0/16"
+ purpose = "INTERNAL_HTTPS_LOAD_BALANCER"
+ role = "ACTIVE"
+}
+
+resource "google_compute_subnetwork" "psc_private_subnetwork" {
+ name = "psc-private-subnetwork"
+ region = var.region
+ project = module.producer_project.project_id
+
+ network = google_compute_network.psc_ilb_network.id
+ ip_cidr_range = "10.3.0.0/16"
+ purpose = "PRIVATE"
+ role = "ACTIVE"
+}
+
+resource "google_compute_subnetwork" "psc_ilb_nat" {
+ name = "psc-ilb-nat"
+ region = var.region
+ project = module.producer_project.project_id
+
+ network = google_compute_network.psc_ilb_network.id
+ purpose = "PRIVATE_SERVICE_CONNECT"
+ ip_cidr_range = "10.1.0.0/16"
+}
+
+resource "google_compute_subnetwork" "vms" {
+ name = "vms"
+ region = var.region
+ project = module.producer_project.project_id
+
+ network = google_compute_network.psc_ilb_network.id
+ ip_cidr_range = "10.4.0.0/16"
+}
+
+resource "google_compute_service_attachment" "psc_ilb_service_attachment" {
+ name = "my-psc-ilb"
+ region = var.region
+ project = module.producer_project.project_id
+ description = "A service attachment configured with Terraform"
+
+ enable_proxy_protocol = false
+ connection_preference = "ACCEPT_AUTOMATIC"
+ nat_subnets = [google_compute_subnetwork.psc_ilb_nat.id]
+ target_service = google_compute_forwarding_rule.psc_ilb_target_service.id
+}
+
+resource "google_service_account" "noop" {
+ project = module.producer_project.project_id
+ account_id = "noop-sa"
+ display_name = "Service Account for NOOP VM"
+}
+
+resource "google_compute_instance" "noop-vm" {
+ project = module.producer_project.project_id
+ name = "noop-ilb-vm"
+ machine_type = "e2-medium"
+ zone = var.zone
+ boot_disk {
+ initialize_params {
+ image = "debian-cloud/debian-11"
+ }
+ }
+
+ network_interface {
+ network = google_compute_network.psc_ilb_network.id
+ subnetwork = google_compute_subnetwork.vms.id
+ }
+ service_account {
+ email = google_service_account.noop.email
+ scopes = []
+ }
+}
\ No newline at end of file
diff --git a/blueprints/networking/psc-glb-and-armor/variables.tf b/blueprints/networking/psc-glb-and-armor/variables.tf
new file mode 100644
index 0000000000..b8715ea697
--- /dev/null
+++ b/blueprints/networking/psc-glb-and-armor/variables.tf
@@ -0,0 +1,52 @@
+/**
+ * Copyright 2023 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+variable "consumer_project_id" {
+ description = "The consumer project, in which the GCLB and Cloud Armor should be created."
+ type = string
+}
+
+variable "prefix" {
+ description = "Prefix used for resource names."
+ type = string
+ validation {
+ condition = var.prefix != ""
+ error_message = "Prefix cannot be empty."
+ }
+}
+
+variable "producer_project_id" {
+ description = "The producer project, in which the ILB, PSC Service Attachment and Cloud Run service should be created."
+ type = string
+}
+
+variable "project_create" {
+ description = "Create project instead of using an existing one."
+ type = bool
+ default = false
+}
+
+variable "region" {
+ description = "The GCP region in which the resources should be deployed."
+ type = string
+ default = "europe-west1"
+}
+
+variable "zone" {
+ description = "The GCP zone for the VM."
+ type = string
+ default = "europe-west1-b"
+}
\ No newline at end of file
diff --git a/modules/gke-hub/README.md b/modules/gke-hub/README.md
index 793a81cacd..ed80af5590 100644
--- a/modules/gke-hub/README.md
+++ b/modules/gke-hub/README.md
@@ -314,7 +314,7 @@ module "hub" {
]
}
-# tftest modules=8 resources=31
+# tftest modules=8 resources=32
```
diff --git a/modules/project/README.md b/modules/project/README.md
index 730fe19080..7be0a1aa27 100644
--- a/modules/project/README.md
+++ b/modules/project/README.md
@@ -189,6 +189,7 @@ This table lists all affected services and roles that you need to grant to servi
| cloudasset.googleapis.com | cloudasset | roles/cloudasset.serviceAgent |
| cloudbuild.googleapis.com | cloudbuild | roles/cloudbuild.builds.builder |
| gkehub.googleapis.com | fleet | roles/gkehub.serviceAgent |
+| meshconfig.googleapis.com | servicemesh | roles/anthosservicemesh.serviceAgent |
| multiclusteringress.googleapis.com | multicluster-ingress | roles/multiclusteringress.serviceAgent |
| pubsub.googleapis.com | pubsub | roles/pubsub.serviceAgent |
| sqladmin.googleapis.com | sqladmin | roles/cloudsql.serviceAgent |
diff --git a/modules/project/service-accounts.tf b/modules/project/service-accounts.tf
index e93978a860..96563ce062 100644
--- a/modules/project/service-accounts.tf
+++ b/modules/project/service-accounts.tf
@@ -50,6 +50,7 @@ locals {
notebooks = "service-%s@gcp-sa-notebooks"
pubsub = "service-%s@gcp-sa-pubsub"
secretmanager = "service-%s@gcp-sa-secretmanager"
+ servicemesh = "service-%s@gcp-sa-servicemesh"
sql = "service-%s@gcp-sa-cloud-sql"
sqladmin = "service-%s@gcp-sa-cloud-sql"
storage = "service-%s@gs-project-accounts"
@@ -81,6 +82,7 @@ locals {
"gkehub.googleapis.com", # grant roles/gkehub.serviceAgent to fleet
"multiclusteringress.googleapis.com", # grant roles/multiclusteringress.serviceAgent to multicluster-ingress
"pubsub.googleapis.com", # grant roles/pubsub.serviceAgent to pubsub
+ "meshconfig.googleapis.com", # grant roles/anthosservicemesh.serviceAgent to meshconfig
"secretmanager.googleapis.com", # no grants needed
"sqladmin.googleapis.com", # grant roles/cloudsql.serviceAgent to sqladmin (TODO: verify)
]