Internet NEG backends must not have a health check

Pulumi attempts to enforce the healthChecks field on the compute.BackendService resource but this field must not be passed to the GCP API in certain circumstances.

// The following infrastructure is used so that we can use Cloud CDN with Cloud Functions.
const cloudFunctionsNEG = new gcp.compute.GlobalNetworkEndpointGroup(
  'cloud-functions',
  {
    networkEndpointType: 'INTERNET_FQDN_PORT',
  },
  { provider: gcpProvider },
)
const cloudFunctionsNE = new gcp.compute.GlobalNetworkEndpoint(
  'cloud-functions',
  {
    globalNetworkEndpointGroup: cloudFunctionsNEG.name,
    fqdn: `us-central1-${project}.cloudfunctions.net`,
    port: 443, // HTTPS
  },
  { provider: gcpProvider },
)
const cloudFunctionsBS = new gcp.compute.BackendService(
  'cloud-functions',
  // @ts-expect-error: `healthChecks` is required by Pulumi but backend services with
  // internet NEG backends must not have a health check according to GCP docs.
  //
  // See https://cloud.google.com/compute/docs/reference/rest/v1/backendServices
  {
    backends: [{ group: cloudFunctionsNEG.id }],
    enableCdn: true,
    protocol: 'HTTPS',
  },
  { provider: gcpProvider },
)

Unfortunately the @ts-expect-error directive doesn’t help here since the SDK checks the field at runtime.

[lmakarov]

Never mind. Figured out the issue. I was mistakenly using gcp.compute.NetworkEndpointGroup instead of gcp.compute.GlobalNetworkEndpointGroup.

The following works as expeceted:

const webNEG = new gcp.compute.GlobalNetworkEndpointGroup("web-neg", {
  networkEndpointType: "INTERNET_FQDN_PORT",
});

const webService = new gcp.compute.BackendService("web-service", {
  protocol: "HTTPS",
  backends: [
      {
        group: webNEG.selfLink,
      },
  ],
});

[leezen]

Looks like this is tracked upstream in https://github.com/terraform-google-modules/terraform-google-lb-http/issues/105 and once that’s fixed should get picked up with the next pulumi-gcp update.