google-cloud-platformgoogle-compute-enginegoogle-stackdrivernginx
Cloud Monitoring Uptime checks allow users to send a request to a resource to see if it respond.
Since the checks are performed outside Google Cloud infrastructure, an external ip is needed.
Is there a way to implement Uptime checks for sites ( http requests ) that does not have a public IP?
health checks managed instance groups VS health checks load balancing
The health checks used by managed instance groups are the same health checks used by load balancing, with some differences in behavior. Health checks that you apply to load balancing services help a load balancer determine where to direct network traffic. These health checks do not cause Compute Engine to recreate instances. Health checks that you apply to managed instance groups will proactively signal to the managed instance group to delete and recreate instances if they become UNHEALTHY.
For the majority of scenarios, use separate health checks for load balancing and for monitoring managed instance groups. Health checking for load balancing can and should be more aggressive since these health checks determine whether an instance receives user traffic. Since customers might rely on your services, you want to catch non-responsive instances quickly so you can redirect traffic if necessary. In contrast, health checking for instance groups will cause Compute Engine proactively replace failing instances so you could create health checks that are more conservative than health checks for a load balancer.
The description of you use case makes it suitable for using the App Engine firewall:
Allow only traffic from within a specific network Ensure that only a certain range of IP addresses from specific networks can access your app. For example, create rules to allow only the range of IP addresses from within your company's private network during your app's testing phase...
Allow only traffic from a specific service Ensure that all the traffic to your App Engine app is first proxied through a specific service..
Beginning at Allowing requests from your services there are the instructions on how to create firewall rules.
When you create your firewall rules in app engine, you can choose which IP's to allow or deny access to your app. It is not mandatory to deny all HTTP traffic to all IP's. Take a look at the Example Firewall where some rules are created. Some of them allow traffic to a certain IP's while others deny traffic to other IP's as well:
Best Answer
TL;DR: yes, by using a bastion host with external IP that can query reach the internal site and use a proxy ( NGINX , SquidProxy , etc ) to pass your health check request from the external services to your internal sites.
What you need:
The process:
If you want to skip the installation process, you may choose to use NGINX PLUS and install it by using Google Cloud MarketPlace
You can also use NGINX Docker container for this task.
Some tips and tricks on how to configure nginx
When you install NGINX by following NGINX’s instructions, you will get a functional NGINX at the end of the process. But you may need extra configurations to achieve the goal.
/etc/nginx/conf.d/default.confto answer a 404 to any request that does not includes a valid HOST header:Create a configuration file under
/etc/nginx/conf.d/directory for each site you want to monitor. i.e./etc/nginx/conf.d/finance-sites.conf. Do not forget the .conf termination.Set a bogus host for each site you want to monitor and do not forget to set the host header in Cloud Monitoring.
Do not forget to check syntax
nginx -tand reload configurationnginx -s reloadeach time you perform a change in your configuration.