Setting up a simple external HTTP load balancer

This setup guide shows you how to create a simple external HTTP load balancer with the following resources:

The default VPC network
A Compute Engine managed instance group
A default URL map
A reserved external IP address

For a simple external HTTPS load balancer with TLS termination, see Setting up a simple external HTTPS load balancer.

For a content-based, multi-region example that includes IPv6 and SSL certificate setup, see Setting up an HTTPS load balancer.

If you're using GKE, the load balancer is typically configured by the Kubernetes Ingress controller. For more information, see Configuring Ingress for external load balancing.

Topology

In this how-to document, you create the configuration that is illustrated in the following diagram.

Simple HTTP Load Balancing (click to enlarge)

The sequence of events in the diagram is:

A client sends a content request to the external IPv4 address defined in the forwarding rule.
The forwarding rule directs the request to the target HTTP proxy.
The target proxy uses the rule in the URL map to determine that the single backend service receives all requests.
The load balancer determines that the backend service has only one instance group and directs the request to a VM in that group.
The VM serves the content requested by the user.

Permissions

To complete the steps in this guide, you must have permission to create Compute Engine instances, firewall rules, and reserved IP addresses in a project. You must have either a project owner or editor role, or you must have the following Compute Engine IAM roles:

Task	Required Role
Create instances	Instance Admin
Add and remove firewall rules	Security Admin
Create load balancer components	Network Admin
Create a project (Optional)	Project Creator

For more information, see the following guides:

Creating a managed instance group

To set up a load balancer with a Compute Engine backend, your VMs need to be in an instance group. This guide describes how to create a managed instance group with Linux VMs that have Apache running and then set up load balancing.

The managed instance group provides VMs running the backend servers of an external HTTP load balancer. For demonstration purposes, backends serve their own hostnames.

Console

Go to the Instance groups page in the Cloud Console.
Go to the Instance Groups page
Click Create instance group.
Choose New managed instance group on the left.
For the Name, enter lb-backend-example.
Under Location, select Single zone.
For the Region, select your preferred region. This example uses us-east1.
For the Zone, select us-east1-b.
Under Instance template, select Create a new instance template.
For the Name, enter lb-backend-template.
Ensure that the Boot disk is set to a Debian image, such as Debian GNU/Linux 9 (stretch). These instructions use commands that are only available on Debian, such as apt-get.

Under Management, security, disks, networking, sole tenancy, on the Management tab, insert the following script into the Startup script field.

#! /bin/bash
apt-get update
apt-get install apache2 -y
a2ensite default-ssl
a2enmod ssl
vm_hostname="$(curl -H "Metadata-Flavor:Google" \
http://169.254.169.254/computeMetadata/v1/instance/name)"
echo "Page served from: $vm_hostname" | \
tee /var/www/html/index.html

Under Networking, add the network tags: allow-health-check
Click Save and continue.
Under Number of instances, enter 2.
Under Autoscaling mode, select Don't autoscale.
Click Create to create the new instance group.

gcloud

Create the template.

gcloud compute instance-templates create lb-backend-template \
   --region=us-east1 \
   --network=default \
   --subnet=default \
   --tags=allow-health-check \
   --image-family=debian-9 \
   --image-project=debian-cloud \
   --metadata=startup-script='#! /bin/bash
     apt-get update
     apt-get install apache2 -y
     a2ensite default-ssl
     a2enmod ssl
     vm_hostname="$(curl -H "Metadata-Flavor:Google" \
     http://169.254.169.254/computeMetadata/v1/instance/name)"
     echo "Page served from: $vm_hostname" | \
     tee /var/www/html/index.html
     systemctl restart apache2'

Create the managed instance group based on the template.

gcloud compute instance-groups managed create lb-backend-example \
   --template=lb-backend-template --size=2 --zone=us-east1-b

Configuring a firewall rule

In this example, you create the fw-allow-health-check firewall rule. This is an ingress rule that allows traffic from the Google Cloud health checking systems (130.211.0.0/22 and 35.191.0.0/16). This example uses the target tag allow-health-check to identify the VMs.

Console

Go to the Firewalls page in the Google Cloud Console.
Go to the Firewalls page
Click Create firewall rule to create the second firewall rule:
Enter a Name of fw-allow-health-check.
Under Network, select Default.
Under Targets, select Specified target tags.
Populate the Target tags field with allow-health-check.
Set Source filter to IP ranges.
Set Source IP ranges to 130.211.0.0/22 and 35.191.0.0/16.
Under Protocols and ports, select Specified protocols and ports.
Select the checkbox next to tcp and type 80 for the port numbers.
Click Create.

gcloud

gcloud compute firewall-rules create fw-allow-health-check \
    --network=default \
    --action=allow \
    --direction=ingress \
    --source-ranges=130.211.0.0/22,35.191.0.0/16 \
    --target-tags=allow-health-check \
    --rules=tcp

Reserving an external IP address

Now that your instances are up and running, set up a global static external IP address that your customers use to reach your load balancer.

Console

Go to the External IP addresses page in the Google Cloud Console.
Go to the External IP addresses page
Click Reserve static address to reserve an IPv4 address.
Assign a Name of lb-ipv4-1.
Set the Network tier to Standard.
Set the IP version to IPv4.
Set the Type to Global.
Click Reserve.
Ensure that the Type is set to Global.
Click Reserve.

gcloud

gcloud compute addresses create lb-ipv4-1 \
    --ip-version=IPV4 \
    --global

Note the IPv4 address that was reserved:

gcloud compute addresses describe lb-ipv4-1 \
    --format="get(address)" \
    --global

Setting up the load balancer

Console

Go to the Load balancing page[Load balancing page].
Go to the Load balancing page
Click Create load balancer.
Under HTTP(S) Load Balancing, click Start configuration.
Select From Internet to my VMs.
For the load balancer Name, enter web-map-http.
Click Backend configuration.
1. Under Create or select backend services & backend buckets, select Backend services > Create a backend service.
2. Add a Name for your backend service, such as web-backend-service.
3. Under Protocol, select HTTP.
4. In Backends > New Backend > Instance group, select your instance group, lb-backend-example.
5. Retain the other default settings.
6. In Health check > Create a health check, add a Name for your health check, such as http-basic-check.
7. Set the protocol to HTTP.
8. Retain the other default settings.
9. Click Save and Continue.
10. Click Create.
In Host and path rules, you can retain the default settings.
In Frontend configuration.

In IP address, select lb-ipv4-1, which you created earlier.
You can retain the other default settings.
Click Done.

In Frontend configuration.

In IP address, select lb-ipv4-1, which you created earlier.
Ensure that the Port is set to 80, to allow HTTP traffic.

When you're finished configuring the load balancer, click Create.
On the Load balancing screen, note the IP:Port for your load balancer.

gcloud

Create a health check.

    gcloud compute health-checks create http http-basic-check \
        --port 80

Create a backend service.

    gcloud compute backend-services create web-backend-service \
        --protocol HTTP \
        --health-checks http-basic-check \
        --global

Add your instance group as the backend to the backend services.

    gcloud compute backend-services add-backend web-backend-service \
        --balancing-mode=UTILIZATION \
        --max-utilization=0.8 \
        --capacity-scaler=1 \
        --instance-group=lb-backend-example \
        --instance-group-zone=us-east1-b \
        --global

Create a URL map to route the incoming requests to the default backend service.

    gcloud compute url-maps create web-map-http \
        --default-service web-backend-service

Create a target HTTP proxy to route requests to your URL map.

    gcloud compute target-http-proxies create http-lb-proxy \
        --url-map web-map-http

Create a global forwarding rule to route incoming requests to the proxy.

    gcloud compute forwarding-rules create http-content-rule \
        --address=lb-ipv4-1\
        --global \
        --target-http-proxy=http-lb-proxy \
        --ports=80

Sending traffic to your instances

Now that the load balancing service is running, you can send traffic to the forwarding rule and watch the traffic be dispersed to different instances.

Go to the Load balancing page in the Google Cloud Console.
Go to the Load balancing page
Click the load balancer you just created.
In the Backend section, confirm that VMs are healthy. The Healthy column should be populated, indicating that both VMs are healthy (2/2). If you see otherwise, first try reloading the page. It can take a few moments for the Cloud Console to indicate that the VMs are healthy. If the backends do not appear healthy after a few minutes, review the firewall configuration and the network tag assigned to your backend VMs.
After the Cloud Console shows that the backend instances are healthy, you can test your load balancer using a web browser by going to the http://ip-address, where ip-address is the load balancer's IP address.
Your browser should render a page with content showing the name of the instance that served the page, along with its zone (for example, Page served from: lb-backend-example-xxxx). If your browser doesn't render this page, review the configuration settings in this guide.

What's next

For a complex example with IPv6 and cross-regional, content-based load balancing, see Setting up an HTTPS load balancer.