@intentius/chant-lexicon-gcp 0.124.34 → 0.124.35

package/src/op/activities/gcp-apply.ts

@@ -3,6 +3,15 @@ import { parseYAML } from "@intentius/chant/yaml";
 import { sleep } from "@intentius/chant/op";
 import { hasOwnershipMarker, OWNERSHIP_MANAGED_BY_VALUE } from "@intentius/chant/ownership";
 import { GCP_RESOURCE_OWNERSHIP_KEYS } from "../../ownership";
+import { iamPolicyMemberMapper } from "./gcp-iam";
+import {
+  backendServiceMapper,
+  computeAddressMapper,
+  forwardingRuleMapper,
+  regionNetworkEndpointGroupMapper,
+  targetHttpProxyMapper,
+  urlMapMapper,
+} from "./gcp-compute";
 import {
   applyResult,
   type ApplyResult,
@@ -120,6 +129,29 @@ export interface ListSpec {
   items(responseBody: unknown): Array<{ name: string; labels?: Record<string, string> | null }>;
 }
 
+/**
+ * Where a mapper works: the API base, the project, and the rest of the applied
+ * manifest, so a `*Ref` to a resource declared alongside can take that
+ * resource's scope. The read path has no manifest.
+ */
+export interface MapperCtx {
+  base: string;
+  project: string;
+  manifest?: readonly GcpResource[];
+}
+
+/**
+ * A kind whose apply is not GET-then-create (#4233). IAMPolicyMember is a
+ * member inside another resource's policy, so it reads, merges and writes that
+ * policy instead. `read` answers like a GET: 200 with a body when present, 404
+ * when not.
+ */
+export interface CustomOps {
+  apply(resource: GcpResource, ctx: MapperCtx, http: GcpHttp, signal?: AbortSignal): Promise<{ created: boolean; updated: boolean }>;
+  delete(resource: GcpResource, ctx: MapperCtx, http: GcpHttp, signal?: AbortSignal): Promise<boolean>;
+  read(resource: GcpResource, ctx: MapperCtx, http: GcpHttp, signal?: AbortSignal): Promise<{ status: number; text: string }>;
+}
+
 /** Maps one CNRM kind to its GCP REST operations. The unit of the dispatch table. */
 export interface ResourceMapper {
   /** CNRM kind this handles. */
@@ -127,7 +159,11 @@ export interface ResourceMapper {
   /** Real-GCP API host, used when no `endpoint` override is given. */
   defaultHost: string;
   /** Build the GET + create plan for one resource against `base`. */
-  plan(resource: GcpResource, ctx: { base: string; project: string }): ApplyPlan;
+  plan(resource: GcpResource, ctx: MapperCtx): ApplyPlan;
+  /** False for a resource of this kind chant cannot act on (an IAM binding on a target with no policy endpoint): reported, not attempted. */
+  accepts?(resource: GcpResource, ctx: MapperCtx): boolean;
+  /** Present when apply, delete and read are not the plan's GET-then-create. */
+  custom?: CustomOps;
   /** Present for async resources whose create returns a long-running operation. */
   operation?: OperationSpec;
   /** Present when the kind can be pruned (list live → delete chant-owned orphans). */
@@ -245,14 +281,37 @@ export const pubSubTopicMapper: ResourceMapper = {
   },
 };
 
-/** Map a CNRM RunService to a Cloud Run v2 Service body. Pure. */
-export function cloudRunServiceBody(resource: GcpResource): { template?: unknown } {
-  const spec = (resource.spec ?? {}) as { template?: unknown };
+/**
+ * Map a CNRM RunService to a Cloud Run v2 Service body. Pure. CNRM names the
+ * service account with `template.serviceAccountRef`; v2 takes
+ * `template.serviceAccount` as an email (#4240).
+ */
+export function cloudRunServiceBody(resource: GcpResource, project?: string): { template?: unknown } {
+  const spec = (resource.spec ?? {}) as { template?: Record<string, unknown> };
   const body: { template?: unknown } = {};
-  if (spec.template) body.template = spec.template;
+  if (!spec.template) return body;
+  const { serviceAccountRef, ...template } = spec.template as { serviceAccountRef?: { name?: string; external?: string } };
+  const email = serviceAccountEmail(serviceAccountRef, project);
+  body.template = email ? { ...template, serviceAccount: email } : template;
   return body;
 }
 
+/**
+ * The email a CNRM `serviceAccountRef` names: `external` as given (an email,
+ * or a `projects/<p>/serviceAccounts/<email>` path), `name` as an account id
+ * in the project.
+ */
+export function serviceAccountEmail(ref: { name?: string; external?: string } | undefined, project?: string): string | undefined {
+  if (!ref) return undefined;
+  if (ref.external) return ref.external.split("/").pop();
+  if (ref.name) {
+    if (ref.name.includes("@")) return ref.name;
+    if (!project) throw new Error(`serviceAccountRef { name: "${ref.name}" } needs a project to form the account's email`);
+    return `${ref.name}@${project}.iam.gserviceaccount.com`;
+  }
+  return undefined;
+}
+
 export const cloudRunServiceMapper: ResourceMapper = {
   kind: "RunService",
   defaultHost: "https://run.googleapis.com",
@@ -269,11 +328,11 @@ export const cloudRunServiceMapper: ResourceMapper = {
       create: {
         method: "POST",
         url: `${services}?serviceId=${encodeURIComponent(name)}`,
-        body: cloudRunServiceBody(resource),
+        body: cloudRunServiceBody(resource, project),
       },
       // Cloud Run reconciles with a PATCH of the service; like create it returns
       // a long-running operation, polled via the mapper's `operation`.
-      update: { method: "PATCH", url, body: cloudRunServiceBody(resource) },
+      update: { method: "PATCH", url, body: cloudRunServiceBody(resource, project) },
     };
   },
 };
@@ -368,6 +427,14 @@ export const MAPPERS: Record<string, ResourceMapper> = {
   SecretManagerSecret: secretManagerSecretMapper,
   IAMServiceAccount: gcpServiceAccountMapper,
   RunService: cloudRunServiceMapper,
+  // #4233: a binding member, and the Cloud Run load balancer.
+  IAMPolicyMember: iamPolicyMemberMapper,
+  ComputeAddress: computeAddressMapper,
+  ComputeRegionNetworkEndpointGroup: regionNetworkEndpointGroupMapper,
+  ComputeBackendService: backendServiceMapper,
+  ComputeURLMap: urlMapMapper,
+  ComputeTargetHTTPProxy: targetHttpProxyMapper,
+  ComputeForwardingRule: forwardingRuleMapper,
 };
 
 /**
@@ -376,7 +443,29 @@ export const MAPPERS: Record<string, ResourceMapper> = {
  * refs point outside the manifest and are ignored for ordering. Pure.
  */
 export function referencedNames(resource: GcpResource): string[] {
-  const names: string[] = [];
+  return [...new Set(referencedResources(resource).map((r) => r.name))];
+}
+
+/**
+ * The CNRM kind a `*Ref` key points at, where the key alone says. A ref that
+ * carries its own `kind` (`resourceRef`) uses that. Two resources of different
+ * kinds may share a name (a RunService `web` and its NEG `web`), so ordering
+ * matches on kind when it can.
+ */
+const REF_KINDS: Record<string, string> = {
+  topicRef: "PubSubTopic",
+  serviceRef: "RunService",
+  serviceAccountRef: "IAMServiceAccount",
+  addressRef: "ComputeAddress",
+  networkEndpointGroupRef: "ComputeRegionNetworkEndpointGroup",
+  backendServiceRef: "ComputeBackendService",
+  urlMapRef: "ComputeURLMap",
+  targetHTTPProxyRef: "ComputeTargetHTTPProxy",
+};
+
+/** The local resources this resource references via `*Ref` fields, each with its kind when known. Pure. */
+export function referencedResources(resource: GcpResource): Array<{ name: string; kind?: string }> {
+  const refs: Array<{ name: string; kind?: string }> = [];
   const visit = (v: unknown, key?: string): void => {
     if (Array.isArray(v)) {
       for (const x of v) visit(x, key);
@@ -385,13 +474,14 @@ export function referencedNames(resource: GcpResource): string[] {
     if (v && typeof v === "object") {
       const obj = v as Record<string, unknown>;
       if (key && /Refs?$/.test(key) && typeof obj.name === "string") {
-        names.push(obj.name);
+        const kind = typeof obj.kind === "string" ? obj.kind : REF_KINDS[key];
+        refs.push(kind ? { name: obj.name, kind } : { name: obj.name });
       }
       for (const [k, val] of Object.entries(obj)) visit(val, k);
     }
   };
   visit(resource.spec);
-  return [...new Set(names)];
+  return refs;
 }
 
 /**
@@ -401,10 +491,10 @@ export function referencedNames(resource: GcpResource): string[] {
  * Pure — a DFS post-order.
  */
 export function orderByReferences(resources: GcpResource[]): GcpResource[] {
-  const byName = new Map<string, GcpResource>();
+  const byName = new Map<string, GcpResource[]>();
   for (const r of resources) {
     const n = r.metadata?.name;
-    if (n) byName.set(n, r);
+    if (n) byName.set(n, [...(byName.get(n) ?? []), r]);
   }
   const ordered: GcpResource[] = [];
   const done = new Set<GcpResource>();
@@ -413,9 +503,10 @@ export function orderByReferences(resources: GcpResource[]): GcpResource[] {
     if (done.has(r)) return;
     if (active.has(r)) throw new Error(`reference cycle involving ${r.metadata?.name ?? "?"}`);
     active.add(r);
-    for (const ref of referencedNames(r)) {
-      const dep = byName.get(ref);
-      if (dep && dep !== r) visit(dep);
+    for (const ref of referencedResources(r)) {
+      const named = (byName.get(ref.name) ?? []).filter((d) => d !== r);
+      const deps = ref.kind ? named.filter((d) => d.kind === ref.kind) : named;
+      for (const dep of deps) visit(dep);
     }
     active.delete(r);
     done.add(r);
@@ -503,12 +594,16 @@ const defaultHttp: GcpHttp = async (method, url, body, signal) => {
 export async function applyResource(
   mapper: ResourceMapper,
   resource: GcpResource,
-  ctx: { base: string; project: string },
+  ctx: MapperCtx,
   http: GcpHttp = defaultHttp,
   signal?: AbortSignal,
 ): Promise<{ kind: string; name: string; created: boolean; updated: boolean }> {
-  const plan = mapper.plan(resource, ctx);
   const name = resource.metadata?.name ?? "?";
+  if (mapper.custom) {
+    const result = await mapper.custom.apply(resource, ctx, http, signal);
+    return { kind: mapper.kind, name, ...result };
+  }
+  const plan = mapper.plan(resource, ctx);
   const get = await http("GET", plan.getUrl, undefined, signal);
 
   if (get.status === 200) {
@@ -712,7 +807,7 @@ export interface GcpNotPrunable {
  */
 export async function pruneOrphans(
   desired: GcpResource[],
-  resolve: (mapper: ResourceMapper, resource?: GcpResource) => { base: string; project: string },
+  resolve: (mapper: ResourceMapper, resource?: GcpResource) => MapperCtx,
   http: GcpHttp = defaultHttp,
   signal?: AbortSignal,
 ): Promise<{
@@ -780,9 +875,10 @@ export async function gcpApply(
 }> {
   const resources = orderByReferences(parseManifest(readFileSync(args.manifestPath, "utf8"), args.manifestPath));
   const endpoint = resolveGcpEndpoint(args);
-  const resolve = (mapper: ResourceMapper, resource?: GcpResource) => ({
+  const resolve = (mapper: ResourceMapper, resource?: GcpResource): MapperCtx => ({
     base: (endpoint ?? mapper.defaultHost).replace(/\/$/, ""),
     project: args.project ?? (resource ? resolveGcpProject(resource) : ""),
+    manifest: resources,
   });
 
   const applied: Array<{ kind: string; name: string; created: boolean; updated: boolean }> = [];
@@ -796,6 +892,11 @@ export async function gcpApply(
       continue;
     }
     const ctx = resolve(mapper, r);
+    if (mapper.accepts && !mapper.accepts(r, ctx)) {
+      console.log(`skip: ${r.kind}/${r.metadata?.name ?? "?"} has nothing chant can apply it to`);
+      notAttempted.push({ kind: r.kind as string, name: r.metadata?.name ?? "?", reason: "unsupported-kind" });
+      continue;
+    }
     const result = await applyResource(mapper, r, ctx, http, signal);
     const verb = result.created ? "created" : result.updated ? "updated" : "unchanged";
     console.log(`${verb}: ${result.kind}/${result.name} (${ctx.base})`);
@@ -816,12 +917,15 @@ export async function gcpApply(
 export async function deleteResource(
   mapper: ResourceMapper,
   resource: GcpResource,
-  ctx: { base: string; project: string },
+  ctx: MapperCtx,
   http: GcpHttp = defaultHttp,
   signal?: AbortSignal,
 ): Promise<{ kind: string; name: string; deleted: boolean }> {
-  const plan = mapper.plan(resource, ctx);
   const name = resource.metadata?.name ?? "?";
+  if (mapper.custom) {
+    return { kind: mapper.kind, name, deleted: await mapper.custom.delete(resource, ctx, http, signal) };
+  }
+  const plan = mapper.plan(resource, ctx);
   const res = await http("DELETE", plan.getUrl, undefined, signal);
   if (res.status === 404) {
     return { kind: mapper.kind, name, deleted: false };
@@ -870,7 +974,13 @@ export async function gcpDelete(
     }
     const base = (resolveGcpEndpoint(args) ?? mapper.defaultHost).replace(/\/$/, "");
     const project = args.project ?? resolveGcpProject(r);
-    const result = await deleteResource(mapper, r, { base, project }, http, signal);
+    const ctx: MapperCtx = { base, project, manifest: resources };
+    if (mapper.accepts && !mapper.accepts(r, ctx)) {
+      console.log(`skip: ${r.kind}/${r.metadata?.name ?? "?"} has nothing chant can delete it from`);
+      notAttempted.push({ kind: r.kind as string, name: r.metadata?.name ?? "?", reason: "unsupported-kind" });
+      continue;
+    }
+    const result = await deleteResource(mapper, r, ctx, http, signal);
     console.log(`${result.deleted ? "deleted" : "absent"}: ${result.kind}/${result.name} (${base})`);
     deleted.push(result);
   }

package/src/op/activities/gcp-compute.test.ts

@@ -0,0 +1,212 @@
+import { beforeEach, describe, expect, test } from "vitest";
+import { applyResource, deleteResource, MAPPERS, orderByReferences, type GcpHttp, type GcpResource } from "./gcp-apply";
+import { computeLabels, computeOperation } from "./gcp-compute";
+import { getResource } from "../../api/read-client";
+
+beforeEach(() => {
+  delete process.env.GCP_REGION;
+});
+
+/** The serverless load balancer behold's three-cloud demo declares, in the shape the serializer writes. */
+const lb: GcpResource[] = [
+  {
+    kind: "ComputeForwardingRule",
+    metadata: { name: "web-fr", labels: { "app.kubernetes.io/component": "lb", tier: "edge" } },
+    spec: {
+      location: "global",
+      loadBalancingScheme: "EXTERNAL_MANAGED",
+      portRange: "80",
+      ipProtocol: "TCP",
+      ipAddress: { addressRef: { name: "web-ip" } },
+      target: { targetHTTPProxyRef: { name: "web-proxy" } },
+    },
+  },
+  { kind: "ComputeTargetHTTPProxy", metadata: { name: "web-proxy" }, spec: { location: "global", urlMapRef: { name: "web-map" } } },
+  { kind: "ComputeURLMap", metadata: { name: "web-map" }, spec: { location: "global", defaultService: { backendServiceRef: { name: "web" } } } },
+  {
+    kind: "ComputeBackendService",
+    metadata: { name: "web" },
+    spec: {
+      location: "global",
+      loadBalancingScheme: "EXTERNAL_MANAGED",
+      protocol: "HTTPS",
+      enableCdn: false,
+      backend: [{ group: { networkEndpointGroupRef: { name: "web" } } }],
+    },
+  },
+  {
+    kind: "ComputeRegionNetworkEndpointGroup",
+    metadata: { name: "web" },
+    spec: { region: "europe-west1", networkEndpointType: "SERVERLESS", cloudRun: { serviceRef: { name: "web" } } },
+  },
+  { kind: "ComputeAddress", metadata: { name: "web-ip" }, spec: { location: "global" } },
+  { kind: "RunService", metadata: { name: "web" }, spec: { location: "europe-west1" } },
+];
+
+const ctx = { base: "https://compute.googleapis.com", project: "p1", manifest: lb };
+const byKind = (kind: string) => lb.find((r) => r.kind === kind)!;
+const plan = (kind: string) => MAPPERS[kind].plan(byKind(kind), ctx);
+
+describe("compute load balancer mappers (#4233)", () => {
+  test("apply order: service, NEG and address before the backend, map, proxy and forwarding rule", () => {
+    const order = orderByReferences(lb).map((r) => r.kind);
+    const at = (k: string) => order.indexOf(k);
+    expect(at("RunService")).toBeLessThan(at("ComputeRegionNetworkEndpointGroup"));
+    expect(at("ComputeRegionNetworkEndpointGroup")).toBeLessThan(at("ComputeBackendService"));
+    expect(at("ComputeBackendService")).toBeLessThan(at("ComputeURLMap"));
+    expect(at("ComputeURLMap")).toBeLessThan(at("ComputeTargetHTTPProxy"));
+    expect(at("ComputeTargetHTTPProxy")).toBeLessThan(at("ComputeForwardingRule"));
+    expect(at("ComputeAddress")).toBeLessThan(at("ComputeForwardingRule"));
+  });
+
+  test("a serverless NEG is regional and names its Cloud Run service", () => {
+    expect(plan("ComputeRegionNetworkEndpointGroup")).toEqual({
+      getUrl: "https://compute.googleapis.com/compute/v1/projects/p1/regions/europe-west1/networkEndpointGroups/web",
+      create: {
+        method: "POST",
+        url: "https://compute.googleapis.com/compute/v1/projects/p1/regions/europe-west1/networkEndpointGroups",
+        body: { name: "web", networkEndpointType: "SERVERLESS", cloudRun: { service: "web" } },
+      },
+    });
+  });
+
+  test("a global backend service points at the regional NEG by the NEG's own region", () => {
+    expect(plan("ComputeBackendService").create).toEqual({
+      method: "POST",
+      url: "https://compute.googleapis.com/compute/v1/projects/p1/global/backendServices",
+      body: {
+        name: "web",
+        loadBalancingScheme: "EXTERNAL_MANAGED",
+        protocol: "HTTPS",
+        enableCDN: false,
+        backends: [{ group: "projects/p1/regions/europe-west1/networkEndpointGroups/web" }],
+      },
+    });
+  });
+
+  test("URL map, proxy and forwarding rule resolve their refs to partial URLs", () => {
+    expect(plan("ComputeURLMap").create.body).toEqual({ name: "web-map", defaultService: "projects/p1/global/backendServices/web" });
+    expect(plan("ComputeTargetHTTPProxy").create.body).toEqual({ name: "web-proxy", urlMap: "projects/p1/global/urlMaps/web-map" });
+    expect(plan("ComputeForwardingRule").create.body).toEqual({
+      name: "web-fr",
+      loadBalancingScheme: "EXTERNAL_MANAGED",
+      portRange: "80",
+      IPProtocol: "TCP",
+      IPAddress: "projects/p1/global/addresses/web-ip",
+      target: "projects/p1/global/targetHttpProxies/web-proxy",
+      labels: { tier: "edge", "managed-by": "chant" },
+    });
+  });
+
+  test("a global address goes to the global collection, with the ownership label", () => {
+    expect(plan("ComputeAddress")).toMatchObject({
+      getUrl: "https://compute.googleapis.com/compute/v1/projects/p1/global/addresses/web-ip",
+      create: { body: { name: "web-ip", labels: { "managed-by": "chant" } } },
+    });
+  });
+
+  test("labels GCP refuses are left out", () => {
+    expect(computeLabels({ "app.kubernetes.io/name": "x", Bad: "y", ok: "Value", good: "v-1" })).toEqual({ good: "v-1", "managed-by": "chant" });
+  });
+
+  test("an external ref is used as given", () => {
+    const proxy: GcpResource = {
+      kind: "ComputeTargetHTTPProxy",
+      metadata: { name: "p" },
+      spec: { location: "global", urlMapRef: { external: "projects/shared/global/urlMaps/m" } },
+    };
+    expect(MAPPERS.ComputeTargetHTTPProxy.plan(proxy, { base: "b", project: "p1" }).create.body).toEqual({
+      name: "p",
+      urlMap: "projects/shared/global/urlMaps/m",
+    });
+  });
+});
+
+describe("compute operations (#4233)", () => {
+  test("the selfLink is rebased onto an endpoint override, and DONE ends the poll", () => {
+    const op = { kind: "compute#operation", selfLink: "https://compute.googleapis.com/compute/v1/projects/p1/global/operations/op-1", status: "RUNNING" };
+    expect(computeOperation.pollUrl(op, { base: "http://localhost:4588", project: "p1" })).toBe(
+      "http://localhost:4588/compute/v1/projects/p1/global/operations/op-1",
+    );
+    expect(computeOperation.isDone({ status: "DONE" })).toBe(true);
+    expect(computeOperation.error({ status: "DONE", error: { errors: [{ message: "quota" }] } })).toBe("quota");
+    expect(computeOperation.pollUrl({ name: "web" }, { base: "b", project: "p1" })).toBeUndefined();
+  });
+
+  test("apply inserts, polls the operation, and leaves an existing resource alone", async () => {
+    const calls: string[] = [];
+    let exists = false;
+    const http: GcpHttp = async (method, url) => {
+      calls.push(`${method} ${url}`);
+      if (method === "GET" && url.endsWith("/addresses/web-ip")) return exists ? { status: 200, text: "{}" } : { status: 404, text: "" };
+      if (method === "POST") {
+        exists = true;
+        return { status: 200, text: JSON.stringify({ kind: "compute#operation", selfLink: "https://compute.googleapis.com/compute/v1/projects/p1/global/operations/op-1", status: "PENDING" }) };
+      }
+      if (url.includes("/operations/")) return { status: 200, text: JSON.stringify({ status: "DONE" }) };
+      return { status: 500, text: "" };
+    };
+    const created = await applyResource(MAPPERS.ComputeAddress, byKind("ComputeAddress"), ctx, http);
+    expect(created.created).toBe(true);
+    expect(calls).toContain("GET https://compute.googleapis.com/compute/v1/projects/p1/global/operations/op-1");
+    const again = await applyResource(MAPPERS.ComputeAddress, byKind("ComputeAddress"), ctx, http);
+    expect(again).toMatchObject({ created: false, updated: false });
+  });
+
+  test("delete removes the resource at its scoped URL", async () => {
+    const calls: string[] = [];
+    const http: GcpHttp = async (method, url) => {
+      calls.push(`${method} ${url}`);
+      return { status: 200, text: JSON.stringify({ status: "DONE" }) };
+    };
+    await deleteResource(MAPPERS.ComputeRegionNetworkEndpointGroup, byKind("ComputeRegionNetworkEndpointGroup"), ctx, http);
+    expect(calls[0]).toBe("DELETE https://compute.googleapis.com/compute/v1/projects/p1/regions/europe-west1/networkEndpointGroups/web");
+  });
+
+  test("the reader reads a load balancer kind through the same URL", async () => {
+    const http = async (_m: string, url: string) =>
+      url.endsWith("/global/urlMaps/web-map") ? { status: 200, text: JSON.stringify({ name: "web-map" }) } : { status: 404, text: "" };
+    const body = await getResource({ project: "p1", http }, "ComputeURLMap", "web-map", byKind("ComputeURLMap").spec);
+    expect(body).toEqual({ name: "web-map" });
+  });
+});
+
+describe("deep observe reads a load balancer back in the declared vocabulary (#4233)", () => {
+  test("refs, renamed fields and the scope invert the body builders", async () => {
+    const { toCnrmTree } = await import("../../deep-observe");
+    const c = { project: "p1" };
+    expect(
+      toCnrmTree(
+        "ComputeBackendService",
+        {
+          name: "web",
+          selfLink: "https://compute.googleapis.com/compute/v1/projects/p1/global/backendServices/web",
+          enableCDN: false,
+          protocol: "HTTPS",
+          backends: [{ group: "https://compute.googleapis.com/compute/v1/projects/p1/regions/europe-west1/networkEndpointGroups/web" }],
+        },
+        c,
+      ),
+    ).toEqual({
+      metadata: { name: "web" },
+      selfLink: "https://compute.googleapis.com/compute/v1/projects/p1/global/backendServices/web",
+      enableCdn: false,
+      protocol: "HTTPS",
+      location: "global",
+      backend: [{ group: { networkEndpointGroupRef: { name: "web" } } }],
+    });
+    expect(
+      toCnrmTree(
+        "ComputeRegionNetworkEndpointGroup",
+        { name: "web", region: "https://compute.googleapis.com/compute/v1/projects/p1/regions/europe-west1", cloudRun: { service: "web" } },
+        c,
+      ),
+    ).toMatchObject({ region: "europe-west1", cloudRun: { serviceRef: { name: "web" } } });
+    expect(
+      toCnrmTree("ComputeForwardingRule", { name: "fr", IPProtocol: "TCP", target: "projects/p1/global/targetHttpProxies/web-proxy" }, c),
+    ).toMatchObject({ ipProtocol: "TCP", location: "global", target: { targetHTTPProxyRef: { name: "web-proxy" } } });
+    expect(toCnrmTree("ComputeURLMap", { name: "m", defaultService: "projects/p1/global/backendServices/web" }, c)).toMatchObject({
+      defaultService: { backendServiceRef: { name: "web" } },
+    });
+  });
+});