Backend services and backend buckets in GCP - Commands & Configuration

Introduction

When you want to deliver content or services on the internet, you need a way to connect users to your resources. Backend services and backend buckets help you manage and serve your app or website content efficiently by linking your storage or compute resources to a load balancer.

When you want to serve static website files stored in a Google Cloud Storage bucket through a load balancer.

When you need to distribute traffic to multiple virtual machine instances running your backend application.

When you want to cache content closer to users by using a backend bucket with a CDN.

When you want to control how traffic is routed to your backend resources based on health checks.

When you want to combine multiple backend services and buckets under one global load balancer.

Config File - backend-service.yaml

backend-service.yaml

apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeBackendService
metadata:
  name: example-backend-service
spec:
  protocol: HTTP
  backends:
  - group: projects/my-project/zones/us-central1-a/instanceGroups/example-instance-group
  healthChecks:
  - projects/my-project/global/healthChecks/example-health-check
  timeoutSec: 30
  connectionDraining:
    drainingTimeoutSec: 300
---
apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeBackendBucket
metadata:
  name: example-backend-bucket
spec:
  bucketName: example-static-content-bucket
  enableCdn: true
  cdnPolicy:
    cacheMode: CACHE_ALL_STATIC
    defaultTtl: 3600
    maxTtl: 86400
    clientTtl: 3600

This file defines two resources:

• ComputeBackendService: Connects a load balancer to a group of VM instances. It includes protocol, backend instance group, health checks, and connection draining settings.
• ComputeBackendBucket: Connects a load balancer to a Cloud Storage bucket to serve static content. It enables CDN with caching policies for faster delivery.

Commands

This command creates a backend service named 'example-backend-service' using HTTP protocol and links it to a health check. The --global flag means it is for a global load balancer.

Terminal

gcloud compute backend-services create example-backend-service --protocol=HTTP --health-checks=example-health-check --global

Expected Output

Created [https://www.googleapis.com/compute/v1/projects/my-project/global/backendServices/example-backend-service].

→

--protocol - Specifies the protocol used by the backend service.

→

--health-checks - Associates health checks to monitor backend health.

→

--global - Creates a global backend service for global load balancing.

This command adds an instance group as a backend to the previously created backend service. It tells the load balancer where to send traffic.

Terminal

gcloud compute backend-services add-backend example-backend-service --instance-group=example-instance-group --instance-group-zone=us-central1-a --global

Expected Output

Updated [https://www.googleapis.com/compute/v1/projects/my-project/global/backendServices/example-backend-service].

→

--instance-group - Specifies the instance group to add as backend.

→

--instance-group-zone - Specifies the zone of the instance group.

→

--global - Indicates the backend service is global.

This command creates a backend bucket named 'example-backend-bucket' linked to a Cloud Storage bucket and enables CDN for faster content delivery.

Terminal

gcloud compute backend-buckets create example-backend-bucket --gcs-bucket-name=example-static-content-bucket --enable-cdn

Expected Output

Created [https://www.googleapis.com/compute/v1/projects/my-project/global/backendBuckets/example-backend-bucket].

→

--gcs-bucket-name - Specifies the Cloud Storage bucket to use.

→

--enable-cdn - Enables Cloud CDN for the backend bucket.

This command shows details of the backend service to verify its configuration and backends.

Terminal

gcloud compute backend-services describe example-backend-service --global

Expected Output

creationTimestamp: '2024-06-01T12:00:00.000-07:00'

description: ''

healthChecks:

- https://www.googleapis.com/compute/v1/projects/my-project/global/healthChecks/example-health-check

name: example-backend-service

protocol: HTTP

backends:

- group: https://www.googleapis.com/compute/v1/projects/my-project/zones/us-central1-a/instanceGroups/example-instance-group

selfLink: https://www.googleapis.com/compute/v1/projects/my-project/global/backendServices/example-backend-service

timeoutSec: 30

connectionDraining:

  drainingTimeoutSec: 300

→

--global - Specifies the backend service is global.

Key Concept

Backend services connect load balancers to compute resources, while backend buckets connect load balancers to storage buckets for serving static content.

Common Mistakes

Not specifying the correct zone when adding an instance group to a backend service.

The load balancer cannot find the instance group without the zone, so traffic routing fails.

Always include the --instance-group-zone flag with the correct zone when adding instance groups.

Creating a backend bucket without enabling CDN when fast content delivery is needed.

Without CDN, content delivery can be slower and less efficient for users far from the bucket location.

Use the --enable-cdn flag to enable Cloud CDN for backend buckets serving static content.

Forgetting to create or link a health check to the backend service.

Without health checks, the load balancer cannot detect unhealthy backends and may send traffic to them.

Create a health check and associate it with the backend service during creation.

Summary

Create backend services to connect load balancers to VM instance groups with health checks.

Add instance groups to backend services specifying the correct zone.

Create backend buckets to serve static content from Cloud Storage with optional CDN.

Use commands to verify backend service configurations and ensure proper traffic routing.

Practice

1. What is the main purpose of a backend service in Google Cloud Load Balancing?

easy

A. To manage user authentication and authorization

B. To connect the load balancer to server groups for dynamic content

C. To monitor network traffic between regions

D. To store static files like images and videos

Solution

1. Step 1: Understand backend service role

   A backend service connects the load balancer to server groups that handle dynamic content like web apps.

2. Step 2: Differentiate from backend bucket

   Backend buckets connect to Cloud Storage for static content, not dynamic server groups.

3. Final Answer:

   To connect the load balancer to server groups for dynamic content -> Option B

4. Quick Check:

   Backend service = dynamic content connection [OK]

Hint: Backend service = dynamic servers, backend bucket = static storage [OK]

Common Mistakes:

• Confusing backend service with backend bucket
• Thinking backend service stores static files
• Assuming backend service manages authentication

2. Which of the following is the correct way to specify a backend bucket in a Google Cloud Load Balancer configuration?

easy

A. "backendService": "projects/my-project/global/backendBuckets/my-bucket"

B. "backendService": "projects/my-project/global/backendServices/my-service"

C. "backendBucket": "projects/my-project/global/backendServices/my-service"

D. "backendBucket": "projects/my-project/global/backendBuckets/my-bucket"

Solution

1. Step 1: Identify correct field for backend bucket

   The field to specify a backend bucket is "backendBucket" with the bucket's full path.

2. Step 2: Verify resource path matches backend bucket

   The resource path must include "backendBuckets" for a bucket, not "backendServices".

3. Final Answer:

   "backendBucket": "projects/my-project/global/backendBuckets/my-bucket" -> Option D

4. Quick Check:

   backendBucket field + backendBuckets path = correct [OK]

Hint: backendBucket key + backendBuckets path = backend bucket config [OK]

Common Mistakes:

• Using backendService key for backend bucket
• Mixing backendServices and backendBuckets in path
• Incorrect resource path format

3. Given this backend service configuration snippet, what will happen if the health check fails for all instances in the backend?

{
  "name": "my-backend-service",
  "healthChecks": ["projects/my-project/global/healthChecks/my-check"],
  "backends": [{"group": "projects/my-project/zones/us-central1-a/instanceGroups/my-group"}]
}

medium

A. The load balancer will stop sending traffic to this backend service

B. The load balancer will continue sending traffic to the backend service regardless

C. The load balancer will delete the backend service automatically

D. The load balancer will redirect traffic to the backend bucket

Solution

1. Step 1: Understand health check role

   Health checks monitor backend instances. If all fail, the backend is unhealthy.

2. Step 2: Effect on load balancer traffic

   Load balancer stops sending traffic to unhealthy backends to avoid errors.

3. Final Answer:

   The load balancer will stop sending traffic to this backend service -> Option A

4. Quick Check:

   Health check fail = no traffic sent [OK]

Hint: Failed health checks stop traffic to backend service [OK]

Common Mistakes:

• Assuming traffic continues despite health check failure
• Thinking backend service is deleted automatically
• Confusing backend service with backend bucket behavior

4. You configured a backend bucket for your load balancer but users report 403 errors when accessing static content. What is the most likely cause?

medium

A. The load balancer is not attached to any instance group

B. The backend service health check is failing

C. The backend bucket is missing the correct Cloud Storage permissions

D. The backend bucket name is misspelled in the load balancer config

Solution

1. Step 1: Check backend bucket access

   Backend buckets serve static content from Cloud Storage, which requires proper permissions.

2. Step 2: Identify cause of 403 errors

   Missing or incorrect permissions cause 403 errors because content cannot be accessed.

3. Final Answer:

   The backend bucket is missing the correct Cloud Storage permissions -> Option C

4. Quick Check:

   Missing permissions cause 403 on static content [OK]

Hint: 403 on static content usually means permission issues [OK]

Common Mistakes:

• Confusing backend bucket with backend service health checks
• Assuming instance groups affect backend buckets
• Overlooking spelling errors as cause

5. You want to serve a website with both dynamic content from Compute Engine instances and static content from Cloud Storage using a single HTTP(S) load balancer. How should you configure the backend services and backend buckets?

hard

A. Create a backend service for the instance group and a backend bucket for the Cloud Storage bucket, then configure URL map to route requests accordingly

B. Create only a backend bucket and upload dynamic content to Cloud Storage

C. Create multiple backend services for both static and dynamic content and ignore backend buckets

D. Use a backend service for static content and a backend bucket for dynamic content

Solution

1. Step 1: Understand content types and backends

   Dynamic content requires backend services connected to instance groups; static content uses backend buckets linked to Cloud Storage.

2. Step 2: Configure URL map routing

   Use URL map rules to route requests to backend service or backend bucket based on URL paths.

3. Final Answer:

   Create a backend service for the instance group and a backend bucket for the Cloud Storage bucket, then configure URL map to route requests accordingly -> Option A

4. Quick Check:

   Dynamic = backend service, static = backend bucket, route with URL map [OK]

Hint: Use URL map to route dynamic to backend service, static to backend bucket [OK]

Common Mistakes:

• Trying to serve dynamic content from backend bucket
• Ignoring URL map routing configuration
• Using backend service for static content