GCP for DevOps — Cloud Load Balancing

3 minute read

Cloud Load Balancing

GCP Cloud Load Balancing is a fully distributed, software-defined, managed service. It’s not based on VMs or appliances — traffic is distributed at the edge of Google’s network.

Load Balancer Types

┌─────────────────────────────────────────────────────────┐
│              GCP Load Balancers                          │
├─────────────────────────────────────────────────────────┤
│                                                         │
│  EXTERNAL (Internet → GCP)                              │
│  ├── Global HTTP(S) LB        ← L7, multi-region       │
│  ├── External TCP/UDP LB      ← L4, regional           │
│  ├── SSL Proxy LB             ← L4, global, SSL        │
│  └── TCP Proxy LB             ← L4, global             │
│                                                         │
│  INTERNAL (GCP → GCP)                                   │
│  ├── Internal HTTP(S) LB      ← L7, regional           │
│  ├── Internal TCP/UDP LB      ← L4, regional           │
│  └── Internal TCP Proxy LB    ← L4, regional, proxy    │
│                                                         │
└─────────────────────────────────────────────────────────┘

Choosing the Right Load Balancer

Scenario	Load Balancer	Layer
Web app across multiple regions	Global External HTTP(S)	L7
Single-region web app	Regional External HTTP(S)	L7
Non-HTTP TCP service (databases)	External TCP/UDP	L4
Microservices within VPC	Internal HTTP(S)	L7
Internal TCP services	Internal TCP/UDP	L4
Game servers (UDP)	External TCP/UDP	L4

External HTTP(S) Load Balancer

The most common load balancer for web applications.

Internet → Global Anycast IP → URL Map → Backend Service → MIG / NEG
                                  │
                           ┌──────┴──────┐
                           │  /api/*     │──→ api-backend
                           │  /static/*  │──→ cdn-bucket
                           │  /*         │──→ web-backend
                           └─────────────┘

Step-by-Step Setup

# Step 1: Create a health check
$ gcloud compute health-checks create http web-hc \
    --port=80 \
    --request-path=/health \
    --check-interval=10s \
    --healthy-threshold=2 \
    --unhealthy-threshold=3

# Step 2: Create a backend service
$ gcloud compute backend-services create web-backend \
    --protocol=HTTP \
    --port-name=http \
    --health-checks=web-hc \
    --global

# Step 3: Add your MIG as a backend
$ gcloud compute backend-services add-backend web-backend \
    --instance-group=web-mig \
    --instance-group-zone=us-central1-a \
    --balancing-mode=UTILIZATION \
    --max-utilization=0.8 \
    --global

# Step 4: Create a URL map
$ gcloud compute url-maps create web-url-map \
    --default-service=web-backend

# Step 5: Create a target HTTP proxy
$ gcloud compute target-http-proxies create web-http-proxy \
    --url-map=web-url-map

# Step 6: Create a global forwarding rule (the entry point)
$ gcloud compute forwarding-rules create web-http-rule \
    --global \
    --target-http-proxy=web-http-proxy \
    --ports=80

# Get the IP address
$ gcloud compute forwarding-rules describe web-http-rule --global \
    --format="get(IPAddress)"

34.120.100.50

HTTPS with Managed SSL Certificate

# Create a managed SSL certificate
$ gcloud compute ssl-certificates create my-cert \
    --domains=example.com,www.example.com \
    --global

# Create an HTTPS target proxy
$ gcloud compute target-https-proxies create web-https-proxy \
    --url-map=web-url-map \
    --ssl-certificates=my-cert

# Create the forwarding rule for HTTPS
$ gcloud compute forwarding-rules create web-https-rule \
    --global \
    --target-https-proxy=web-https-proxy \
    --ports=443

# Check certificate provisioning status
$ gcloud compute ssl-certificates describe my-cert --global \
    --format="get(managed.status)"

ACTIVE

URL Map Routing

# Create path-based routing
$ gcloud compute url-maps add-path-matcher web-url-map \
    --path-matcher-name=api-matcher \
    --default-service=web-backend \
    --path-rules="/api/*=api-backend,/static/*=static-bucket-backend"

# Host-based routing
$ gcloud compute url-maps add-host-rule web-url-map \
    --hosts=api.example.com \
    --path-matcher-name=api-matcher

Internal Load Balancer

For traffic between services within your VPC.

# Create an internal TCP load balancer
$ gcloud compute forwarding-rules create internal-api-lb \
    --region=us-central1 \
    --load-balancing-scheme=INTERNAL \
    --network=prod-vpc \
    --subnet=prod-app \
    --ip-protocol=TCP \
    --ports=8080 \
    --backend-service=api-backend-service

# The internal LB gets a private IP from the subnet
$ gcloud compute forwarding-rules describe internal-api-lb \
    --region=us-central1 \
    --format="get(IPAddress)"

10.1.2.100

Cloud CDN Integration

# Enable Cloud CDN on a backend service
$ gcloud compute backend-services update web-backend \
    --enable-cdn \
    --global

# Configure CDN cache policy
$ gcloud compute backend-services update web-backend \
    --cache-mode=CACHE_ALL_STATIC \
    --default-ttl=3600 \
    --global

Common Mistakes

Mistake	Why It’s Wrong	Fix
Missing health check source ranges	Health checks fail silently	Allow `130.211.0.0/22,35.191.0.0/16`
Using regional LB for multi-region	No cross-region failover	Use global HTTP(S) LB
Not setting `--port-name` on MIG	Backend can’t find the port	Set named ports on instance groups
HTTP instead of HTTPS	Insecure, no SSL/TLS	Use managed SSL certificates
Not enabling CDN for static content	Slow, high egress costs	Enable Cloud CDN

Quick Reference

Command	Description
`gcloud compute health-checks create http NAME`	Create health check
`gcloud compute backend-services create NAME --global`	Create backend service
`gcloud compute backend-services add-backend NAME --instance-group=MIG`	Add backend
`gcloud compute url-maps create NAME`	Create URL map
`gcloud compute target-http-proxies create NAME`	Create HTTP proxy
`gcloud compute forwarding-rules create NAME --global`	Create forwarding rule
`gcloud compute ssl-certificates create NAME --domains=D`	Create managed cert

Next → Shared VPC & Peering

Share on

Twitter Facebook LinkedIn