Update GCP Service Extensions documentation #28511
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Preview links (active after the
|
e-n-0
force-pushed
the
flavien/gcp-se-terraform-doc
branch
2 times, most recently
from
51e650d to
93dc471
Compare
e-n-0
force-pushed
the
flavien/gcp-se-terraform-doc
branch
from
93dc471 to
9a44642
Compare
|
Created an Editorial Review card for documentation! https://datadoghq.atlassian.net/browse/DOCS-10554 |
domalessi
reviewed
Apr 7, 2025
Comment on lines
+31
to
+35
| - The [Datadog Agent][1] installed and configured for your application's operating system or container, cloud, or virtual environment. | ||
| - [Configured the Agent with Remote Configuration][2] to enable blocking attackers using the Datadog UI. | ||
| - In your GCP project, either the project `owner` or `editor` role, or the relevant Compute Engine IAM roles: `compute.instanceAdmin.v1` (to create instances) and `compute.networkAdmin` (to set up load balancing). | ||
| - A GCP project with a Cloud Load Balancer configured for your services. Your Cloud Load Balancer must be one of the [Application Load Balancers that supports Traffic Callouts][3]. | ||
| - The Compute Engine API and Network Services API enabled: |
There was a problem hiding this comment.
Suggested change
| - The [Datadog Agent][1] installed and configured for your application's operating system or container, cloud, or virtual environment. | |
| - [Configured the Agent with Remote Configuration][2] to enable blocking attackers using the Datadog UI. | |
| - In your GCP project, either the project `owner` or `editor` role, or the relevant Compute Engine IAM roles: `compute.instanceAdmin.v1` (to create instances) and `compute.networkAdmin` (to set up load balancing). | |
| - A GCP project with a Cloud Load Balancer configured for your services. Your Cloud Load Balancer must be one of the [Application Load Balancers that supports Traffic Callouts][3]. | |
| - The Compute Engine API and Network Services API enabled: | |
| - Installed and configured the [Datadog Agent][1] for your application's operating system or container, cloud, or virtual environment. | |
| - [Configured Remote Configuration on the Agent][2] to enable blocking attackers through the Datadog UI. | |
| - One of the following roles in your GCP project: | |
| - `owner` | |
| - `editor` | |
| - both of the following Compute Engine IAM roles: `compute.instanceAdmin.v1` (to create instances) and `compute.networkAdmin` (to set up load balancing) | |
| - A GCP project with a Cloud Load Balancer configured for your services. The Cloud Load Balancer must be one of the [Application Load Balancers that supports Traffic Callouts][3]. | |
| - Enabled the Compute Engine API and Network Services API: |
|
|
||
| To integrate a Service Extension with ASM, do the following: | ||
| To set up the ASM Service Extension in your GCP environment, follow the instructions by either using the Google Cloud Console or Terraform scripts. |
There was a problem hiding this comment.
Suggested change
| To set up the ASM Service Extension in your GCP environment, follow the instructions by either using the Google Cloud Console or Terraform scripts. | |
| To set up the ASM Service Extension in your GCP environment, use the Google Cloud Console or Terraform scripts and complete the following steps. |
|
|
||
| 1. **Create a new VM Compute instance** using the Datadog Service Extensions Docker image. The image is available on the [Datadog Go tracer GitHub Registry][6]. | ||
| **Note**: Google Cloud provides guides to create [a callout backend service][4] |
There was a problem hiding this comment.
@e-n-0 I'm a little confused about the purpose and placement note. Can you clarify the motivation/goal of this line and why it's relevant to users here? It's not clear whether users need to reference these as prerequisites for the setup steps, or if they're just included for additional context. Wondering if this might be better framed or moved depending on its relevance to the instructions below.
| |----------------------------------------|---------------|-----------------------------------------------------------------------| | ||
| | `DD_AGENT_HOST` | `localhost` | Hostname where your Datadog Agent is running. | | ||
| | `DD_TRACE_AGENT_PORT` | `8126` | Port of the Datadog Agent for trace collection. | | ||
| To integrate a Service Extension with ASM using the Google Cloud Console, complete the following steps: |
There was a problem hiding this comment.
We already have an intro line to this effect above the start of the tabs, so this is redundant.
Suggested change
| To integrate a Service Extension with ASM using the Google Cloud Console, complete the following steps: |
|
|
||
| 2. **Add the VM to an unmanaged instance group.** | ||
| 1. **Create a VM Compute instance** using the Datadog ASM Service Extensions Docker image. The image is available on the [Datadog Go tracer GitHub Registry][1]. |
There was a problem hiding this comment.
We typically don't bold step titles like this. I think the numbering should be enough of a visual aid for users!
Suggested change
| 1. **Create a VM Compute instance** using the Datadog ASM Service Extensions Docker image. The image is available on the [Datadog Go tracer GitHub Registry][1]. | |
| 1. Create a VM Compute instance using the [Datadog ASM Service Extensions Docker image][1]. |
| mkdir gcp-asm-service-extension && cd gcp-asm-service-extension | ||
| touch main.tf variables.tf | ||
| ``` | ||
|
|
There was a problem hiding this comment.
Let's add small lead-in phrases to describe what these files are.
| } | ||
| } | ||
| ``` | ||
|
|
There was a problem hiding this comment.
Same here - some small phrase to lead into the block of text to help orient the user.
This will be easier to parse then trying to make sense of three large, consecutive blocks of code.
Comment on lines
+404
to
+405
| ##### Module configuration | ||
| Insert into your terraform project the module created in the previous step. |
There was a problem hiding this comment.
Suggested change
| ##### Module configuration | |
| Insert into your terraform project the module created in the previous step. | |
| ##### 2. Module configuration | |
| Insert into your Terraform project the module created in the previous step. |
| } | ||
| ``` | ||
|
|
||
| #### 2. Initialize and apply the Terraform configuration |
There was a problem hiding this comment.
Suggested change
| #### 2. Initialize and apply the Terraform configuration | |
| #### 3. Initialize and apply the Terraform configuration |
|
|
||
| The service extension automatically inspects all traffic passing through your load balancer for security threats. | ||
|
|
||
| {{% appsec-getstarted-2-plusrisk %}} |
There was a problem hiding this comment.
Can we add a header before going into this content? It's a lot of text and it's not clearly distinguishable from the configuration steps above. Is this considered a next step under "Deployment Steps" or is this a post-deployment piece?
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do? What is the motivation?
Merge instructions
Merge readiness:
For Datadog employees:
Merge queue is enabled in this repo. Your branch name MUST follow the
<name>/<description>convention and include the forward slash (/). Without this format, your pull request will not pass in CI, the GitLab pipeline will not run, and you won't get a branch preview. Getting a branch preview makes it easier for us to check any issues with your PR, such as broken links.If your branch doesn't follow this format, rename it or create a new branch and PR.
To have your PR automatically merged after it receives the required reviews, add the following PR comment:
Additional notes