Network bridge VM's health check is failing while provisioning Apigee using Terraform modules.

[PoornimaD]

One of my customers is using the Terraform modules [1] to provision their organization but the network bridge VM's health check is failing. 

[1] https://github.com/apigee/terraform-modules

@carlosrsantos 

[carlosrsantos · Accepted solution]

If the health check w/timeouts trying to reach the network bridge VM, here are a few things to review when facing:

• Does VPC's firewall allow access on TCP port 443 to load balancer CIDR ranges?
• Does the network bridge VM (name typically prefixed with "apigee-network-bridge") have the startup-script-url metadata property set?
• Can network bridge VM download the startup script from Google Cloud Storage (at the time of this writing, URL is gs://apigee-5g-saas/apigee-envoy-proxy-release/latest/conf/startup-script.sh)? Validate that the subnet the VM is in either has network connectivity or has private access to Google services.
• Did the startup script execute successfully? Check the VM's serial port output

If the network should not allow outbound internet connectivity, checkout the Private access options for services page for options, including enabling Private Google Access at the subnet, or using Private Service Connect.

[dchiesa1]

I observed this problem, or a very similar problem, with a different customer, when the project/folder  settings required a DENYALL firewall setting for ingress and egress.  Basically the VMs were completely isolated by default.  When we adjusted the firewall settings on those VMs, they began responding healthy. 

Something to check.

[PoornimaD]

Thanks @dchiesa1 @carlosrsantos. Customer just replied that after enabling Private Google Access on their subnet, they were able to provision it. 

[dchiesa1]

OUTSTANDING.  Thanks for the followup.