Setting up an external HTTPS load balancer

External HTTP(S) Load Balancing with Identity-Aware Proxy (IAP) is supported with the following backend types:

This setup guide shows you how to create an external HTTP(S) load balancer and a Compute Engine backend with IAP enabled. The load balancer has the following resources:

This setup guide shows you how to create an external HTTP(S) load balancer and a Compute Engine backend with the following resources:

If this example doesn't match your use case, see one of the following pages:

For general concepts, see the External HTTP(S) Load Balancing overview.

Load balancer topologies

For an HTTPS load balancer, you create the configuration that is illustrated in the following diagram.

HTTPS load balancer with a Compute Engine backend (click to enlarge)
HTTPS load balancer with a Compute Engine backend (click to enlarge)

For an HTTP load balancer, you create the configuration that is illustrated in the following diagram.

HTTP load balancer with a Compute Engine backend (click to enlarge)
HTTP load balancer with a Compute Engine backend (click to enlarge)

The sequence of events in the diagrams are as follows:

  1. A client sends a content request to the external IPv4 address defined in the forwarding rule.
  2. For an HTTPS load balancer, the forwarding rule directs the request to the target HTTPS proxy.

    For an HTTP load balancer, the forwarding rule directs the request to the target HTTP proxy.

  3. The target proxy uses the rule in the URL map to determine that the single backend service receives all requests.

  4. The load balancer determines that the backend service has only one instance group and directs the request to a virtual machine (VM) instance in that group.

  5. The VM serves the content requested by the user.

Before you begin

Make sure that your setup meets the prerequisites.

Set up an SSL certificate resource

For an HTTPS load balancer, create an SSL certificate resource as described in the following:

We recommend using a Google-managed certificate.

This example assumes that you already have an SSL certificate resource named www-ssl-cert.

Set up permissions

To complete the steps in this guide, you must have permission to create Compute Engine instances, firewall rules, and reserved IP addresses in a project. You must have either a project owner or editor role, or you must have the following Compute Engine IAM roles.

Task Required role
Create instances Instance Admin
Add and remove firewall rules Security Admin
Create load balancer components Network Admin
Create a project (optional) Project Creator

For more information, see the following guides:

Creating a managed instance group

To set up a load balancer with a Compute Engine backend, your VMs need to be in an instance group. This guide describes how to create a managed instance group with Linux VMs that have Apache running, and then set up load balancing.

The managed instance group provides VMs running the backend servers of an external HTTP(S) load balancer. For demonstration purposes, backends serve their own hostnames.

Console

  1. In the Google Cloud Console, go to the Instance groups page.

    Go to the Instance groups page

  2. Click Create instance group.
  3. On the left, choose New managed instance group.
  4. For Name, enter lb-backend-example.
  5. Under Location, select Single zone.
  6. For Region, select your preferred region. This example uses us-east1.
  7. For Zone, select us-east1-b.
  8. Under Instance template, select Create a new instance template.
  9. For Name, enter lb-backend-template.
  10. Ensure that the Boot disk is set to a Debian image, such as Debian GNU/Linux 9 (stretch). These instructions use commands that are only available on Debian, such as apt-get.
  11. Do not configure the Firewall option.

    Because the external HTTP(S) load balancer is a proxy, you don't need to select Allow HTTPS traffic or Allow HTTP traffic under Firewall. In Configuring a firewall rule, you create the only necessary firewall rule for this load balancer.

  12. Under Management, security, disks, networking, sole tenancy, on the Management tab, insert the following script into the Startup script field.

    #! /bin/bash
    apt-get update
    apt-get install apache2 -y
    a2ensite default-ssl
    a2enmod ssl
    vm_hostname="$(curl -H "Metadata-Flavor:Google" \
    http://169.254.169.254/computeMetadata/v1/instance/name)"
    echo "Page served from: $vm_hostname" | \
    tee /var/www/html/index.html
    
  13. On the Networking tab, add the network tags: allow-health-check

  14. Click Save and continue.

  15. Under Autoscaling mode, select Don't autoscale.

  16. Under Number of instances, enter 2.

  17. To create the new instance group, click Create.

gcloud

  1. Create the template.
       gcloud compute instance-templates create lb-backend-template \
           --region=us-east1 \
           --network=default \
           --subnet=default \
           --tags=allow-health-check \
           --image-family=debian-9 \
           --image-project=debian-cloud \
           --metadata=startup-script='#! /bin/bash
             apt-get update
             apt-get install apache2 -y
             a2ensite default-ssl
             a2enmod ssl
             vm_hostname="$(curl -H "Metadata-Flavor:Google" \
             http://169.254.169.254/computeMetadata/v1/instance/name)"
             echo "Page served from: $vm_hostname" | \
             tee /var/www/html/index.html
             systemctl restart apache2'
        
  2. Create the managed instance group based on the template.
       gcloud compute instance-groups managed create lb-backend-example \
           --template=lb-backend-template --size=2 --zone=us-east1-b
       

Adding a named port to the instance group

For your instance group, define an HTTP service and map a port name to the relevant port. The load balancing service forwards traffic to the named port.

Console

  1. In the Google Cloud Console, go to the Instance groups page.

    Go to the Instance groups page

  2. Click the name of your instance group (in this example lb-backend-example).
  3. On the instance group's Overview page, click Edit .
  4. Click Specify port name mapping.
  5. Click Add item.
  6. For the port name, enter http. For the port number, enter 80.
  7. Click Save.

gcloud

Use the gcloud compute instance-groups set-named-ports command.

gcloud compute instance-groups set-named-ports lb-backend-example \
    --named-ports http:80 \
    --zone us-east1-b

Configuring a firewall rule

In this example, you create the fw-allow-health-check firewall rule. This is an ingress rule that allows traffic from the Google Cloud health checking systems (130.211.0.0/22 and 35.191.0.0/16). This example uses the target tag allow-health-check to identify the VMs.

Console

  1. In the Google Cloud Console, go to the Firewall page.

    Go to the Firewall page

  2. Click Create firewall rule to create the second firewall rule.
  3. For Name, enter fw-allow-health-check.
  4. Under Network, select Default.
  5. Under Targets, select Specified target tags.
  6. Populate the Target tags field with allow-health-check.
  7. Set Source filter to IPv4 ranges.
  8. Set Source IPv4 ranges to 130.211.0.0/22 and 35.191.0.0/16.
  9. Under Protocols and ports, select Specified protocols and ports.
  10. Select the tcp checkbox, and then type 80 for the port numbers.
  11. Click Create.

gcloud

gcloud compute firewall-rules create fw-allow-health-check \
    --network=default \
    --action=allow \
    --direction=ingress \
    --source-ranges=130.211.0.0/22,35.191.0.0/16 \
    --target-tags=allow-health-check \
    --rules=tcp:80

Reserving an external IP address

Now that your instances are up and running, set up a global static external IP address that your customers use to reach your load balancer.

Console

  1. In the Google Cloud Console, go to the External IP addresses page.

    Go to the External IP addresses page

  2. To reserve an IPv4 address, click Reserve static address.
  3. For Name, enter lb-ipv4-1.
  4. Set Network Service Tier to Premium.
  5. Set IP version to IPv4.
  6. Set Type to Global.
  7. Click Reserve.

gcloud

gcloud compute addresses create lb-ipv4-1 \
    --ip-version=IPV4 \
    --network-tier=PREMIUM \
    --global

Note the IPv4 address that was reserved:

gcloud compute addresses describe lb-ipv4-1 \
    --format="get(address)" \
    --global

Setting up the load balancer

In this example, you are using HTTP or HTTPS between the client and the load balancer. For HTTPS, you need one or more SSL certificate resources to configure the proxy. We recommend using a Google-managed certificate.

Even if you're using HTTPS on the frontend, you can use HTTP on the backend. Google automatically encrypts traffic between Google Front Ends (GFEs) and your backends that reside within Google Cloud VPC networks.