Google Cloud console

To create an uptime check by using the Google Cloud console, do the following:

1. In the Google Cloud console, go to the Uptime checks page:

   Go toUptime checks

   If you use the search bar to find this page, then select the result whose subheading isMonitoring.

2. In the toolbar of the Google Cloud console,select your Google Cloud project. ForApp Hubconfigurations, select the App Hub host project or management project.

3. ClickCreate Uptime Check.

   

4. Specify a private uptime check:

   1. Select the protocol, which can beHTTP,HTTPS, orTCP.

   2. Choose theInternal IP resource type.

5. If you don't have a Service Directory service configuredfor your project or if you want to create aService Directory service, then clickView and complete thePrivate Uptime Check Prerequisites pane:

   1. If prompted, enable the Compute Engine API or theService Directory API.Enabling the APIs might take a minute to complete.

   2. Expandarrow_drop_downService Account, if shown,and then clickCreate Service Account.

      When a Monitoring service account doesn't exist, oneis created. Then, Monitoring grants the service accounttwo Service Directory roles.

   3. Expandarrow_drop_downService Directory menu andthen do the following:

      1. Expandarrow_drop_downRegion andthen select the region of the VM that is serving requests.
      2. Expandarrow_drop_downNamespace and then either select anexisting Service Directory namespace orclickCreate namespace and create a namespace.
      3. ClickService name and enter a servicename. Services are the targets of private uptime checks.
      4. ClickEndpoint name and enter a name for the endpoint name.An endpoint is a pair of IP address and port values thata service can use to handle requests.When your service contains multipleendpoints, one endpoint is chosen at random.
      5. Expandarrow_drop_downNetwork and thenselect your private network.
      6. Expandarrow_drop_downInstance and then select the VMon the private network that is serving requests. After you selectthe instance, its internal IP address is displayed.
      7. ClickDone.

   4. Expandarrow_drop_downFirewall rules:

      1. Expandarrow_drop_downNetwork and select the networkto which the network rule is attached.

      2. ClickCreate Firewall Rules.

         The firewall rule enables inbound TCP traffic from routes35.199.192.0/19.A route from 35.199.192.0/19 supports connectivity to forwardingtargets that use private routing.For more information, seeVPC routes.

6. In thePrivate Uptime Check pane, to specify theService Directory service to use, do one of the following:

   • SelectUse fully qualified service name and then enter the fullyqualified name of the service:

     projects/SERVICE_DIRECTORY_PROJECT_ID/locations/REGION/namespaces/PRIVATE_NAMESPACE/services/PRIVATE_SERVICE

   • Select theRegion,Namespace, andService by using themenus. If you created a service, then these fields are selected for you.

7. In thePrivate Uptime Check pane, complete the description of thetarget of the uptime check:

   1. Optional: Enter a path component for the request.

      Private uptime checks that use the HTTP or HTTPS protocol send a request tohttp://target/path. In this expression, thetarget is the internal IP address configured in the Service Directory endpoint.

      If you leave thePath field blank or if you set the value to/, then the request is issued tohttp://target/.

   2. Optional: To set how often the uptime check executes, use theCheck frequency field.

   3. Optional: To select checker regions, or to configureauthentication, headers for HTTP and HTTPS checks, and other values,clickMore target options:

      • Regions: Select the regions where the uptime checks are toreceive requests. An uptime check must have at least three checkers.There's one checker in all regions except theUnited States,which has three checkers. The default setting,Global,includes all regions.
      • Request Method: SelectGET orPOST.
      • Body: For HTTPPOST checks, enter the URL-encoded body; youmust do the encoding yourself. For all other checks, leave thisfield empty.
      • Host header: Don't set this field when configuringprivate uptime checks.
      • Port: Any value you set here overrides the port in yourService Directory endpoint configuration. Don't seta value here if you want the endpoint configuration to be used.
      • Custom Headers: Supply custom headers, and optionally,encrypt them. Encryption hides the values in the header in the form.Use encryption for headers related to authentication that youdon't want visible to others.
      • Authentication: Provide a single username and password. Thesevalues are sent as an Authorization header. If you set values here,don't set a separate Authorization header; if you set anAuthorization header, don't set values here. Passwords are alwayshidden in the form.

8. ClickContinue and configure the response requirements.All settings in this section have default values:

   • To set a timeout period for the uptime check, use theResponse Timeout field. An uptime check fails when noresponse is received from more than one location within this period.

   • To configure the uptime check to perform content matching,ensure that the toggle label isContent matching is enabled:

     • Select theResponse Content Match Type from the menu of options.This field determines how the response content is compared to thereturned data. For example, assume that the response content isabcd and the content match type isContains. The uptime checkis successful only when the response data containsabcd.For more information, seeValidate response data.
     • Enter theResponse content. The response content must be a stringno longer than 1024 bytes. In the API, this field is theContentMatcher object.

   • To prevent log entries from being created due to uptime checks,clearLog check failures.

   • For the HTTP uptime checks, configure the acceptable response codes.By default, HTTP uptime checks mark any2xx response as a successful response.

9. ClickContinue and configure alerting policies and notifications.

   To be notified when an uptime check fails, create analerting policy andconfigurenotification channels for that policy:

   1. Optional: Update the name of the alerting policy.
   2. Optional: In theDuration field, select how long the uptime checksmust fail before notifications are sent. By default, notifications aresent when at least two regions report uptime check failures for aduration of at least one minute.

   3. In the box labeledNotification channels,expandarrow_drop_downMenu, select the channels to add,and then clickOK.

      In the menu, the notification channels are grouped alphabetically foreach channel type.

   If you don't want to create an alerting policy, then ensurethat the text of the toggle button isDo not create an alert.

10. ClickContinue and complete the uptime check:

    1. Enter a descriptive title for the uptime check.

    2. Optional: To add user-defined labels to your uptime check,do the following:

       1. Clickexpand_moreShow user labels.
       2. In theKey field, enter a name for the label.Label names must start with a lowercase letter, and they can containlowercase letters, numerals, underscores, and dashes. For example,enterseverity.
       3. In theValue field, enter a value for your label. Label valuescan containlowercase letters, numerals, underscores, and dashes. For example,entercritical.
       4. For each additional label, clickAdd user label and then enterthe key and value of the label.

    3. To verify your uptime check configuration, clickTest.If the result isn't what you expect, seeTroubleshooting,correct your configuration, and then repeat the verification step.

    4. ClickCreate.

API: Scoping project

To create the configuration for a private uptime check, you create anUptimeCheckConfig object and pass thatobject to theuptimeCheckConfigs.create methodin the Cloud Monitoring API.

TheUptimeCheckConfig object for a private uptime check differsfrom the object for a public uptime check in the following ways:

• The monitored resource specified in the uptime-check configuration must beof typeservicedirectory_service. This resource typehas the following labels:

  • project_id: The project ID associated with theService Directory service.
  • location: The cloud region associated with the service.
  • namespace_name: The Service Directory namespace.
  • service_name: The name of the Service Directory service.
  Note: The values for these labels are determined when youConfigureService Directory resources.

• You don't need to specify aport value in the uptime-check configuration.The port value from the Service Directory endpoint overridesany value set in the uptime-check configuration, and the check fails ifno port is specified in the Service Directory configuration.

• The uptime-check configuration must specify thechecker_type fieldwith the valueVPC_CHECKERS. This value is required for private uptimechecks. By default, uptime checks are public, so public uptime checksdon't need to specify this field.

The following JSON code illustrates anUptimeCheckConfig object for aprivate uptime check using the Service Directory resourcesconfigured for a VM instance on a private network:

{  "displayName": "private-check-demo",  "monitoredResource": {    "type": "servicedirectory_service",    "labels": {      "project_id": "SERVICE_DIRECTORY_PROJECT_ID",      "service_name": "PRIVATE_SERVICE",      "namespace_name": "PRIVATE_NAMESPACE",      "location": "REGION"    }  },  "httpCheck": {    "requestMethod": "GET"  },  "period": "60s",  "timeout": "10s",  "checker_type": "VPC_CHECKERS"}'

To create a private uptime check when theService Directory serviceis in the same Google Cloud project as the uptime check, do the following:

1. Set the default Google Cloud project for the gcloud CLI:

   gcloud config set projectPROJECT_ID

2. Create an environment variable to store your project ID:

   export PROJECT_ID=$(gcloud config get-value core/project)

3. Create an environment variable hold an access token:

   export TOKEN=`gcloud auth print-access-token`

4. Use thecurl tool to invoke theuptimeCheckConfigs.create methodand post a configuration object to it:

   curl https://monitoring.googleapis.com/v3/projects/${PROJECT_ID}/uptimeCheckConfigs \-H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \--request POST --data '{"displayName": "private-check-demo","monitoredResource": {  "type": "servicedirectory_service",  "labels": {    "project_id": "'"$PROJECT_ID"'",    "service_name": "PRIVATE_SERVICE",    "namespace_name": "PRIVATE_NAMESPACE",    "location": "REGION"  }},"httpCheck": {  "requestMethod": "GET"},"period": "60s","timeout": "10s","checker_type": "VPC_CHECKERS"}'

If the creation of the uptime check fails, then verify that theservice account has the necessary roles. For more information,seeCreate of uptime check fails.

API: Monitored project

To create the configuration for a private uptime check, you create anUptimeCheckConfig object and pass thatobject to theuptimeCheckConfigs.create methodin the Cloud Monitoring API.

TheUptimeCheckConfig object for a private uptime check differsfrom the object for a public uptime check in the following ways:

• The monitored resource specified in the uptime-check configuration must beof typeservicedirectory_service. This resource typehas the following labels:

  • project_id: The project ID associated with theService Directory service.
  • location: The cloud region associated with the service.
  • namespace_name: The Service Directory namespace.
  • service_name: The name of the Service Directory service.
  Note: The values for these labels are determined when youConfigureService Directory resources.

• You don't need to specify aport value in the uptime-check configuration.The port value from the Service Directory endpoint overridesany value set in the uptime-check configuration, and the check fails ifno port is specified in the Service Directory configuration.

• The uptime-check configuration must specify thechecker_type fieldwith the valueVPC_CHECKERS. This value is required for private uptimechecks. By default, uptime checks are public, so public uptime checksdon't need to specify this field.

The following JSON code illustrates anUptimeCheckConfig object for aprivate uptime check using the Service Directory resourcesconfigured for a VM instance on a private network:

{  "displayName": "private-check-demo",  "monitoredResource": {    "type": "servicedirectory_service",    "labels": {      "project_id": "SERVICE_DIRECTORY_PROJECT_ID",      "service_name": "PRIVATE_SERVICE",      "namespace_name": "PRIVATE_NAMESPACE",      "location": "REGION"    }  },  "httpCheck": {    "requestMethod": "GET"  },  "period": "60s",  "timeout": "10s",  "checker_type": "VPC_CHECKERS"}'

To create a private uptime check when theService Directory service is in a Google Cloud projectthat is monitored by the metrics scope of the uptime check'sGoogle Cloud project, do the following:

1. Configure the gcloud CLI to default to the Google Cloud projectwhere the uptime check is to be created:

   gcloud config set projectPROJECT_ID

2. Create an environment variable to store your project ID:

   export PROJECT_ID=$(gcloud config get-value core/project)

3. Create an environment variable to store the project ID of theGoogle Cloud projectin which the Service Directory service is defined:

   export MONITORED_PROJECT_ID=MONITORED_PROJECT_ID

   This project must be in the metrics scope of the uptime check'sproject.

4. Create an environment variable hold an access token:

   export TOKEN=`gcloud auth print-access-token`

5. Use thecurl tool to invoke theuptimeCheckConfigs.create methodand post a configuration object to it:

   curl https://monitoring.googleapis.com/v3/projects/${PROJECT_ID}/uptimeCheckConfigs \-H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \--request POST --data '{"displayName": "private-check-demo","monitoredResource": {  "type": "servicedirectory_service",  "labels": {    "project_id": "'"$MONITORED_PROJECT_ID"'",    "service_name": "PRIVATE_SERVICE",    "namespace_name": "PRIVATE_NAMESPACE",    "location": "REGION"  }},"httpCheck": {  "requestMethod": "GET"},"period": "60s","timeout": "10s","checker_type": "VPC_CHECKERS"}'

If the creation of the uptime check fails, then verify that theservice account has the necessary roles. For more information,seeCreate of uptime check fails.

Google Cloud console

When you use the Google Cloud console, after you selectInternal IP as theresource type for an uptime check, you are prompted to create aService Directory and a service.

gcloud CLI - VM

For information about the commands used in this document for services,namespaces, and endpoints, see thegcloud service-directory command group.

To create Service Directory resources for a VM,do the following:

1. Configure the Google Cloud CLI to default to the Google Cloud project wherethe Service Directory resources are to be created:

   gcloud config set projectPROJECT_ID

2. Create environment variables to store your project ID and project number:

   export PROJECT_ID=$(gcloud config get-value core/project)export PROJECT_NUMBER=$(gcloud projects describe $PROJECT_ID --format='get(projectNumber)')

3. Create a Service Directory namespace:

   gcloud service-directory namespaces createPRIVATE_NAMESPACE --location=REGION

4. Create a Service Directory service in the namespace:

   gcloud service-directory services createPRIVATE_SERVICE \--namespacePRIVATE_NAMESPACE --location=REGION

5. Create an environment variable to hold the IP address of the VM on theprivate network:

   export INTERNAL_IP=$(gcloud compute instances describe --zone=ZONE \PRIVATE_SERVICE_INSTANCE --format='get(networkInterfaces[0].networkIP)')

6. Create a Service Directory endpoint that contains theinternal IP address and a port:

   gcloud service-directory endpoints createPRIVATE_ENDPOINT \--location=REGION --namespace=PRIVATE_NAMESPACE \--service=PRIVATE_SERVICE \--network=projects/$PROJECT_NUMBER/locations/global/networks/PRIVATE_CHECK_NETWORK \--address=$INTERNAL_IP --port=80

gcloud CLI - L4 ILB

For information about the commands used in this document for services,namespaces, and endpoints, see thegcloud service-directory command group.

You can use private uptime checks to monitor availability of an L4 internalload balancer (ILB) by creating Service Directory resourcesfor the L4 ILB.

When you create new L4 ILBs, you can use the automatic integration provided byService Directory; for more information, seeConfigureinternal load balancers in Service Directoryfor more information.

If you have L4 ILBs that were created without using the automatic integrationprovided by Service Directory, then you can manually configurethe Service Directory resources by doing the following:

1. Configure the Google Cloud CLI to default to the Google Cloud project wherethe Service Directory resources are to be created:

   gcloud config set projectPROJECT_ID

2. Create environment variables to store your project ID and project number:

   export PROJECT_ID=$(gcloud config get-value core/project)export PROJECT_NUMBER=$(gcloud projects describe $PROJECT_ID --format='get(projectNumber)')

3. To permit all uptime checkers to transfer data to your L4 ILB,enable global access to the ILB:

   gcloud compute forwarding-rules updateILB_FORWARDING_RULE_NAME \--region=ILB_REGION --allow-global-access

   If your L4 ILB does not permit global access, then uptime metrics areavailable only ifILB_REGION is one of the following:

   • us-east4
   • us-central1
   • us-west1
   • europe-west1
   • southamerica-east1
   • asia-southeast1

4. Create a Service Directory namespace:

   gcloud service-directory namespaces createPRIVATE_NAMESPACE_FOR_ILB\--location=REGION

5. Create a Service Directory service in the namespace:

   gcloud service-directory services createPRIVATE_SERVICE_FOR_ILB \--namespacePRIVATE_NAMESPACE_FOR_ILB --location=REGION

6. Create an environment variable to hold the IP address of the load balanceron the private network:

   export INTERNAL_IP=$( gcloud compute forwarding-rules describeILB_FORWARDING_RULE_NAME\--region=ILB_REGION --format='get(IPAddress)')

7. Create a Service Directory endpoint that contains theinternal IP address and a port:

   gcloud service-directory endpoints createPRIVATE_ENDPOINT_FOR_ILB \--location=ILB_REGION --namespace=PRIVATE_NAMESPACE_FOR_ILB \--service=PRIVATE_SERVICE_FOR_ILB \--network=projects/$PROJECT_NUMBER/locations/global/networks/PRIVATE_CHECK_NETWORK \--address=$INTERNAL_IP --port=80

Google Cloud console

When you use the Google Cloud console, after you selectInternal IP as theresource type for an uptime check, you are prompted to authorize theservice account.

API: Scoping project

To grant theService Directory roles toan existing service account, do the following:

1. Configure the gcloud CLI to default to the Google Cloud projectwhere the uptime check is to be created:

   gcloud config set projectPROJECT_ID

2. Create environment variables to store the project ID and project number:

   export PROJECT_ID=$(gcloud config get-value core/project)export PROJECT_NUMBER=$(gcloud projects describe $PROJECT_ID --format='get(projectNumber)')

3. Run the following commands:

   gcloud projects add-iam-policy-binding $PROJECT_ID \--member='serviceAccount:service-'$PROJECT_NUMBER'@gcp-sa-monitoring-notification.iam.gserviceaccount.com' \--role='roles/servicedirectory.viewer'

   gcloud projects add-iam-policy-binding $PROJECT_ID \--member='serviceAccount:service-'$PROJECT_NUMBER'@gcp-sa-monitoring-notification.iam.gserviceaccount.com' \--role='roles/servicedirectory.pscAuthorizedService'

   The previous commands grant the following roles to the service account:

   • roles/servicedirectory.viewer
   • roles/servicedirectory.pscAuthorizedService

API: Monitored project

To grant theService Directory roles toan existing service account, do the following:

1. Configure the gcloud CLI to default to the Google Cloud projectwhere the uptime check is to be created:

   gcloud config set projectPROJECT_ID

2. Create environment variables to store the project ID and project number:

   export PROJECT_ID=$(gcloud config get-value core/project)export PROJECT_NUMBER=$(gcloud projects describe $PROJECT_ID --format='get(projectNumber)')

3. Create an environment variable hold the project ID of the projectin which the Service Directory service is defined:

   export MONITORED_PROJECT_ID=MONITORED_PROJECT_ID

   This project must be in the metrics scope of the uptime check'sproject.

4. Create an environment variable hold the project ID of the projectwhere the network is defined:

   export NETWORK_PROJECT_ID=NETWORK_PROJECT_ID

   This project does not need to be in the metrics scope of theuptime check's project.

5. Run the following commands:

   gcloud projects add-iam-policy-binding $MONITORED_PROJECT_ID \--member='serviceAccount:service-'$PROJECT_NUMBER'@gcp-sa-monitoring-notification.iam.gserviceaccount.com' \--role='roles/servicedirectory.viewer'

   gcloud projects add-iam-policy-binding $NETWORK_PROJECT_ID \--member='serviceAccount:service-'$PROJECT_NUMBER'@gcp-sa-monitoring-notification.iam.gserviceaccount.com' \--role='roles/servicedirectory.pscAuthorizedService'

   The previous commands grant the following roles to the service account:

   • roles/servicedirectory.viewer for the monitored project in which theService Directory service is configured,$SERVICE_MONITORED_PROJECT_ID.
   • roles/servicedirectory.pscAuthorizedService for the project in whichthe private network is configured,$NETWORK_PROJECT_ID.

Google Cloud console

When you use the Google Cloud console, after you selectInternal IP as theresource type for an uptime check, you are prompted to configure thefirewall rules.

gcloud CLI

To create a firewall rule that permits inbound TCP trafficthrough the firewall for private network access, run the following command:

1. Configure the gcloud CLI to default to the Google Cloud projectwhere the uptime check is to be created:

   gcloud config set projectPROJECT_ID

2. Create environment variables to store the project ID and project number:

   export PROJECT_ID=$(gcloud config get-value core/project)

3. Create the network rule:

   gcloud compute firewall-rules createPRIVATE_CHECK_NETWORK_HOPE_RULE \--network="PRIVATE_CHECK_NETWORK"  \--action=allow   --direction=ingress   --source-ranges="35.199.192.0/19" \--rules=tcp   --project="$PROJECT_ID"

   In the previous command,PRIVATE_CHECK_NETWORK is the network to which this rule isattached whilePRIVATE_CHECK_NETWORK_HOPE_RULE is the name of the firewall rule.

For more information about this step, seeConfigure the network project.

Google Cloud console

When you use the Google Cloud console to create the private uptime check,the Google Cloud console issues the commands to grant theService Directory roles to the service account.

For information about how to grant roles to a service account,seeAuthorize the service account.

API: Scoping project

The first time you create a private uptime check for aService Directory service and private resourcesin a single Google Cloud project,the request might succeed or fail. The result depends on whether youhave disabledautomatic role grants for service accountsin your project:

• The first uptime-check creation succeeds if your project permitsautomatic role grants for service accounts. A service account iscreated for you and is granted the necessary roles.

• The first uptime-check creation fails if your project doesn't permitautomatic role grants for service accounts. A service account iscreated, but no roles are granted.

If the creation of the uptime check fails, then do the following:

1. Authorize the service account.
2. Wait a few minutes for the permissions to propagate.
3. Try creating the private uptime check again.

API: Monitored project

The first time you create a private uptime check that targets aService Directory service in a monitored project orprivate resources in different Google Cloud project,the request fails and results in the creation of aMonitoring service account.

How you authorize the service account depends on the number ofGoogle Cloud projects you are using and their relationships.You might have up to four projects involved:

• The project in which you defined the private uptime check.
• The monitored project in which you configured theService Directory service.
• The project in which you configured the VPC network.
• The project in which network resources like VMs or load balancers areconfigured. This project has no role in the service-account authorizationdiscussed here.

When the creation of the first uptime check fails, do the following:

1. Authorize the service account.
2. Wait a few minutes for the permissions to propagate.
3. Try creating the private uptime check again.