Google 部署管理器：创建计算引擎实例时允许 HTTP 流量的等价物是什么？答案

【问题标题】：Google Deployment Manager: Whats the equivalent of Allow HTTP traffic when creating a compute engine instance?Google 部署管理器：创建计算引擎实例时允许 HTTP 流量的等价物是什么？
【发布时间】：2019-11-11 07:23:21
【问题描述】：

我尝试使用 sourceTags 创建防火墙规则，并使用 http 标记我的 VM。但它仍然不允许 HTTP 流量。这是为什么？

resources:
- type: compute.v1.instance
  name: vm-test
  properties:
    zone: {{ properties["zone"] }}
    machineType: https://www.googleapis.com/compute/v1/projects/{{ env["project"] }}/zones/{{ properties["zone"] }}/machineTypes/f1-micro
    # For examples on how to use startup scripts on an instance, see:
    #   https://cloud.google.com/compute/docs/startupscript
    disks:
    - deviceName: boot
      type: PERSISTENT
      boot: true
      autoDelete: true
      initializeParams:
        diskName: disk-{{ env["deployment"] }}
        sourceImage: https://www.googleapis.com/compute/v1/projects/debian-cloud/global/images/family/debian-9
    networkInterfaces:
    - network: https://www.googleapis.com/compute/v1/projects/{{ env["project"] }}/global/networks/default
      # Access Config required to give the instance a public IP address
      accessConfigs:
      - name: External NAT
        type: ONE_TO_ONE_NAT
    metadata:
      items:
        - key: startup-script
          value: |
             #!/bin/bash
             apt-get update
             apt-get install -y apache2
    tags:
      items:
        - http

【问题讨论】：

标签： google-cloud-platform google-compute-engine firewall google-deployment-manager

【解决方案1】：

您还需要在此处添加防火墙部分。这是为我工作的一个：

resources:
- type: compute.v1.firewall
  name: tcp-firewall-rule
  properties:
    network: https://www.googleapis.com/compute/v1/projects/{{ env["project"] }}/global/networks/default
    sourceRanges: ["0.0.0.0/0"]
    targetTags: ["http","http-server"]
    allowed:
     - IPProtocol: TCP
       ports: ["80"]
- type: compute.v1.instance
  name: vm-test
  properties:
    zone: {{ properties['zone'] }}
    machineType: https://www.googleapis.com/compute/v1/projects/{{ env['project'] }}/zones/{{ properties['zone'] }}/machineTypes/f1-micro
    tags:
     items: ["http","http-server"]
    metadata:
      items:
      # For more ways to use startup scripts on an instance, see:
      #   https://cloud.google.com/compute/docs/startupscript
      - key: startup-script
        value: |
          #!/bin/bash
          apt-get update
          apt-get install -y apache2
    disks:
    - deviceName: boot
      type: PERSISTENT
      boot: true
      autoDelete: true
      initializeParams:
        diskName: disk-{{ env["deployment"] }}
        sourceImage: https://www.googleapis.com/compute/v1/projects/debian-cloud/global/images/family/debian-9
    networkInterfaces:
    - network: https://www.googleapis.com/compute/v1/projects/{{ env["project"] }}/global/networks/default
      # Access Config required to give the instance a public IP address
      accessConfigs:
      - name: External NAT
        type: ONE_TO_ONE_NAT

【讨论】：

【解决方案2】：

标签必须与附加的网络标签相同。默认的是“http-server”或“https-server”，所以脚本应该是这样的：

tags    
  items
    - http-server
    - https-server

还要记住正确配置防火墙规则并检查 http 服务器是否正在运行并在该端口上侦听。

【讨论】：