TopolearnA global load balancer gives one anycast IP, managed TLS, autoscaled backends in many regions and an edge cache.
Google Cloud load balancers are software-defined, not appliances. Pick by layer and reach:
- Application Load Balancer (HTTP/S, L7): global external, regional external, or internal. URL routing, managed certificates, Cloud Armor, Cloud CDN, IAP.
- Network Load Balancer: proxy (TCP/SSL) or passthrough (TCP/UDP, preserves client IP), external or internal.
An HTTPS Application LB is a chain of resources:
- forwarding rule: external IP and port;
- target HTTPS proxy: terminates TLS with your certificates;
- URL map: host and path rules choosing a backend;
- backend service: balancing mode, timeouts, health check, CDN and Cloud Armor settings;
- backends: MIGs, zonal NEGs (e.g. GKE Pods), or serverless NEGs for Cloud Run and functions.
The global external LB announces one anycast IP from Google's edge, terminates TLS close to the user and sends traffic to the nearest healthy backend with capacity, across regions.
Cloud CDN is a switch on a backend service (or backend bucket for Cloud Storage). The cache mode CACHE_ALL_STATIC caches static content types by default; USE_ORIGIN_HEADERS follows your Cache-Control; FORCE_CACHE_ALL caches everything (beware of private responses). Invalidate with gcloud compute url-maps invalidate-cdn-cache.
Remember to allow health-check ranges in firewall rules for VM backends.
Example
# Global HTTPS load balancer with CDN in front of a Cloud Run service
gcloud compute network-endpoint-groups create api-neg --region=europe-west1 \
--network-endpoint-type=serverless --cloud-run-service=orders-api
gcloud compute backend-services create api-be --global \
--load-balancing-scheme=EXTERNAL_MANAGED --enable-cdn
gcloud compute backend-services add-backend api-be --global \
--network-endpoint-group=api-neg --network-endpoint-group-region=europe-west1
gcloud compute url-maps create api-map --default-service=api-be
gcloud compute ssl-certificates create api-cert --domains=api.example.com --global
gcloud compute target-https-proxies create api-proxy --url-map=api-map --ssl-certificates=api-cert
gcloud compute addresses create api-ip --global
gcloud compute forwarding-rules create api-fr --global --load-balancing-scheme=EXTERNAL_MANAGED \
--address=api-ip --target-https-proxy=api-proxy --ports=443Remember
- Forwarding rule -> proxy -> URL map -> backend service -> backends
- Serverless NEGs put Cloud Run behind a load balancer
- CDN is enabled per backend service; choose the cache mode deliberately
Watch out for
- Forgetting the health-check firewall ranges, so every VM backend shows unhealthy.
- Using FORCE_CACHE_ALL on responses that contain per-user data.