GCP for DevOps — Load Balancing Deep Dive

Load Balancing Deep Dive

Google Cloud offers multiple load balancer types for different protocols, scopes, and traffic patterns. This page covers advanced load balancing configurations beyond the basics.

Load Balancer Types

LB Type	Scope	Protocol	Use Case
Global External HTTP(S)	Global	HTTP/HTTPS	Web apps, APIs
Global External SSL Proxy	Global	SSL/TLS	Non-HTTP SSL traffic
Global External TCP Proxy	Global	TCP	Gaming, streaming
Regional External TCP/UDP	Regional	TCP/UDP	Non-proxied traffic
Internal HTTP(S)	Regional	HTTP/HTTPS	Internal microservices
Internal TCP/UDP	Regional	TCP/UDP	Internal databases
Internal TCP Proxy	Regional	TCP	Internal proxied traffic

Global External HTTP(S) Load Balancer

# Create health check
$ gcloud compute health-checks create http my-hc \
    --port=80 \
    --request-path=/health \
    --check-interval=10s \
    --timeout=5s \
    --healthy-threshold=2 \
    --unhealthy-threshold=3

# Create backend service
$ gcloud compute backend-services create my-backend \
    --protocol=HTTP \
    --port-name=http \
    --health-checks=my-hc \
    --global

# Add backend (instance group or NEG)
$ gcloud compute backend-services add-backend my-backend \
    --instance-group=my-mig \
    --instance-group-zone=us-central1-a \
    --balancing-mode=UTILIZATION \
    --max-utilization=0.8 \
    --global

# Create URL map
$ gcloud compute url-maps create my-lb \
    --default-service=my-backend

# Create target HTTPS proxy with managed SSL
$ gcloud compute ssl-certificates create my-cert \
    --domains=app.example.com \
    --global

$ gcloud compute target-https-proxies create my-proxy \
    --url-map=my-lb \
    --ssl-certificates=my-cert

# Create forwarding rule
$ gcloud compute forwarding-rules create my-frontend \
    --target-https-proxy=my-proxy \
    --ports=443 \
    --global

Path-Based Routing

# Create multiple backend services
$ gcloud compute backend-services create api-backend \
    --protocol=HTTP --health-checks=my-hc --global

$ gcloud compute backend-services create static-backend \
    --protocol=HTTP --health-checks=my-hc --global

# Create URL map with path rules
$ gcloud compute url-maps create my-lb \
    --default-service=api-backend

$ gcloud compute url-maps add-path-matcher my-lb \
    --path-matcher-name=routes \
    --default-service=api-backend \
    --path-rules="/static/*=static-backend,/images/*=static-backend"

Host-Based Routing

# Route by hostname
$ gcloud compute url-maps add-host-rule my-lb \
    --hosts="api.example.com" \
    --path-matcher-name=api-routes

$ gcloud compute url-maps add-host-rule my-lb \
    --hosts="app.example.com" \
    --path-matcher-name=app-routes

Internal HTTP(S) Load Balancer

For microservice-to-microservice traffic within a VPC:

# Create internal health check
$ gcloud compute health-checks create http internal-hc \
    --port=8080 \
    --request-path=/health

# Create internal backend service
$ gcloud compute backend-services create internal-api \
    --protocol=HTTP \
    --health-checks=internal-hc \
    --load-balancing-scheme=INTERNAL_MANAGED \
    --region=us-central1

# Create internal URL map
$ gcloud compute url-maps create internal-lb \
    --default-service=internal-api \
    --region=us-central1

# Create internal target proxy
$ gcloud compute target-http-proxies create internal-proxy \
    --url-map=internal-lb \
    --region=us-central1

# Create internal forwarding rule
$ gcloud compute forwarding-rules create internal-frontend \
    --load-balancing-scheme=INTERNAL_MANAGED \
    --target-http-proxy=internal-proxy \
    --target-http-proxy-region=us-central1 \
    --network=my-vpc \
    --subnet=my-subnet \
    --region=us-central1 \
    --ports=80

Serverless NEGs (Cloud Run / Functions)

# Create a serverless NEG for Cloud Run
$ gcloud compute network-endpoint-groups create run-neg \
    --region=us-central1 \
    --network-endpoint-type=serverless \
    --cloud-run-service=my-run-service

# Add NEG to backend service
$ gcloud compute backend-services add-backend my-backend \
    --network-endpoint-group=run-neg \
    --network-endpoint-group-region=us-central1 \
    --global

Managed SSL Certificates

# Create a managed SSL certificate
$ gcloud compute ssl-certificates create my-cert \
    --domains="app.example.com,api.example.com" \
    --global

# Check certificate provisioning status
$ gcloud compute ssl-certificates describe my-cert --global

# Status: PROVISIONING → ACTIVE

Common Mistakes

Mistake	Why It’s Wrong	Fix
Wrong LB type	Performance/cost mismatch	Match LB to protocol and scope
No health checks	Traffic sent to dead backends	Always configure health checks
Unhealthy threshold too low	Flapping backends	Set threshold to 3+
No path-based routing	All traffic to one backend	Use URL maps for routing
Missing SSL certificate	HTTP only, insecure	Use managed SSL certificates

Quick Reference

Command	Description
gcloud compute backend-services create	Create backend
gcloud compute url-maps create	Create URL map
gcloud compute target-https-proxies create	Create HTTPS proxy
gcloud compute forwarding-rules create	Create frontend
gcloud compute ssl-certificates create	Create managed SSL

Next → Private Access