DevOps Peach

GCP Basics · Load Balancing & Hybrid – Cloud Load Balancing, Cloud Armor, CDN, VPN and IAP · Lesson 1 of 5

Cloud Load Balancing: Types and Building Blocks

Application Load Balancers work at layer 7 and Network Load Balancers at layer 4; choose global or regional, external or internal, and wire forwarding rule → proxy → URL map → backend service → backends.

Practice interactively →

Cloud Load Balancing is a software-defined, fully managed service: there are no load-balancer VMs to size. One global external load balancer can serve users worldwide from a single anycast IP.

flowchart TB
  C["Clients"] --> FR["Forwarding rule<br/>34.120.10.5:443"]
  FR --> TP["Target HTTPS proxy<br/>certificate"]
  TP --> UM["URL map<br/>/api → api, / → web"]
  UM --> BS["Backend service web<br/>health check, CDN, Armor"]
  BS --> MIG["Regional MIG and serverless NEG"]
  %% step FR: The forwarding rule owns the IP address, protocol and port that clients connect to.
  %% step TP: The target proxy terminates HTTPS with a Google-managed or uploaded certificate.
  %% step UM: The URL map routes by host and path to different backend services.
  %% step BS: The backend service holds the health check, balancing mode, session affinity, Cloud CDN and Cloud Armor settings.
  %% step MIG: Backends are instance groups or network endpoint groups (NEGs), such as a serverless NEG for Cloud Run.

Choosing a load balancer

Traffic External (from Internet) Internal (inside VPC)
HTTP(S), layer 7 Global external Application LB (Premium tier), regional external Application LB Regional or cross-region internal Application LB
TCP/SSL proxy, layer 4 Global or regional external proxy Network LB Regional internal proxy Network LB
TCP/UDP passthrough Regional external passthrough Network LB Regional internal passthrough Network LB

Questions to ask:

  1. HTTP(S) or not? HTTP(S) → Application LB (URL routing, TLS, CDN, Cloud Armor).
  2. Users worldwide? → global; data must stay in one region → regional.
  3. Need the client source IP and UDP? → passthrough Network LB (packets are not proxied).
  4. Internal microservices? → internal Application LB or internal passthrough LB.

Backends

Backend type Example
Managed / unmanaged instance group VMs in a regional MIG
Zonal NEG GKE Pods (container-native load balancing)
Serverless NEG Cloud Run, Cloud Run functions, App Engine
Internet NEG An external origin outside Google Cloud
Backend bucket Static files in Cloud Storage

Health checks

Load balancers send probes from Google ranges 35.191.0.0/16 and 130.211.0.0/22. Allow them in your firewall, or every backend will be marked unhealthy and the LB returns 502. A health check can also drive autohealing of a MIG.

gcloud compute health-checks create http hc-web --port=80 --request-path=/healthz
gcloud compute backend-services create web-backend --global   --protocol=HTTP --health-checks=hc-web --load-balancing-scheme=EXTERNAL_MANAGED
gcloud compute backend-services add-backend web-backend --global   --instance-group=mig-web --instance-group-region=asia-southeast1
Command Meaning
gcloud compute backend-services get-health web-backend --global Health of each backend
gcloud compute url-maps create web-map --default-service=web-backend URL map
gcloud compute forwarding-rules list Frontends (IP:port)

Traps: a global LB needs Premium tier; health-check ranges must be allowed by the firewall; passthrough LBs do not terminate TLS or route by path.

Practice interactively →