Set up regional external Application Load Balancers with Shared VPC

Console

1. In the Google Cloud console, go to the VPC networks page.

   Go to VPC networks

2. Click Create VPC network.
3. For Name, enter lb-network.

4. In the Subnets section:

   1. Set the Subnet creation mode to Custom.

   2. In the New subnet section, enter the following information:

      • Name: lb-frontend-and-backend-subnet

      • Region: us-west1

      • IP address range: 10.1.2.0/24

   3. Click Done.

5. Click Create.

gcloud

1. Create a VPC network with the gcloud compute networks create command:

   gcloud compute networks create lb-network --subnet-mode=custom
   

2. Create a subnet in the lb-network network in the us-west1 region:

   gcloud compute networks subnets create lb-frontend-and-backend-subnet 
   
       --network=lb-network 
   
       --range=10.1.2.0/24 
   
       --region=us-west1
   

Terraform

1. Create a VPC network:

   # Shared VPC network
   resource "google_compute_network" "lb_network" {
     name                    = "lb-network"
     provider                = google-beta
     project                 = "my-host-project-id"
     auto_create_subnetworks = false
   }

2. Create a subnet in the us-west1 region:

   # Shared VPC network - backend subnet
   resource "google_compute_subnetwork" "lb_frontend_and_backend_subnet" {
     name          = "lb-frontend-and-backend-subnet"
     provider      = google-beta
     project       = "my-host-project-id"
     region        = "us-west1"
     ip_cidr_range = "10.1.2.0/24"
     role          = "ACTIVE"
     network       = google_compute_network.lb_network.id
   }

Console

1. In the Google Cloud console, go to the VPC networks page.

   Go to VPC networks

2. Click the name of the Shared VPC network: lb-network.
3. Click Add subnet.
4. For Name, enter proxy-only-subnet.
5. For Region, select us-west1.
6. Set Purpose to Regional Managed Proxy.
7. For IP address range, enter 10.129.0.0/23.
8. Click Add.

gcloud

Create the proxy-only subnet with the gcloud compute networks subnets create command:

gcloud compute networks subnets create proxy-only-subnet \
    --purpose=REGIONAL_MANAGED_PROXY \
    --role=ACTIVE \
    --region=us-west1 \
    --network=lb-network \
    --range=10.129.0.0/23

Terraform

Create the proxy-only subnet:

# Shared VPC network - proxy-only subnet
resource "google_compute_subnetwork" "proxy_only_subnet" {
  name          = "proxy-only-subnet"
  provider      = google-beta
  project       = "my-host-project-id"
  region        = "us-west1"
  ip_cidr_range = "10.129.0.0/23"
  role          = "ACTIVE"
  purpose       = "REGIONAL_MANAGED_PROXY"
  network       = google_compute_network.lb_network.id
}

Console

1. In the Google Cloud console, go to the Firewall policies page.

   Go to Firewall policies

2. Click Create firewall rule to create the rule to allow Google Cloud health checks:
• Name: fw-allow-health-check
• Network: lb-network
• Direction of traffic: Ingress
• Action on match: Allow
• Targets: Specified target tags
• Target tags: load-balanced-backend
• Source filter: IPv4 ranges
• Source IPv4 ranges: 130.211.0.0/22 and 35.191.0.0/16
• Protocols and ports:
  • Choose Specified protocols and ports.
  • Check TCP and enter 80 for the port number.

  As a best practice, limit this rule to just the protocols and ports that match those used by your health check. If you use tcp:80 for the protocol and port, Google Cloud can use HTTP on port 80 to contact your VMs, but it cannot use HTTPS on port 443 to contact them.

3. Click Create.
4. Click Create firewall rule to create the rule to allow Google Cloud health checks:
• Name: fw-allow-proxies
• Network: lb-network
• Direction of traffic: Ingress
• Action on match: Allow
• Targets: Specified target tags
• Target tags: load-balanced-backend
• Source filter: IPv4 ranges
• Source IPv4 ranges: 10.129.0.0/23
• Protocols and ports:
  • Choose Specified protocols and ports.
  • Check TCP and enter 80, 443, 8080 for the port numbers.
5. Click Create.

gcloud

1. Create the fw-allow-health-check firewall rule to allow Google Cloud health checks. This example allows all TCP traffic from health check probers. However, you can configure a narrower set of ports to meet your needs.

   gcloud compute firewall-rules create fw-allow-health-check \
      --network=lb-network \
      --action=allow \
      --direction=ingress \
      --source-ranges=130.211.0.0/22,35.191.0.0/16 \
      --target-tags=load-balanced-backend \
      --rules=tcp
   

2. Create the fw-allow-proxies firewall rule to allow traffic from the Envoy proxy-only subnet to reach your backends.

   gcloud compute firewall-rules create fw-allow-proxies \
      --network=lb-network \
      --action=allow \
      --direction=ingress \
      --source-ranges=10.129.0.0/23 \
      --target-tags=load-balanced-backend \
      --rules=tcp:80,tcp:443,tcp:8080
   

Terraform

1. Create a firewall rule to allow Google Cloud health checks.

   resource "google_compute_firewall" "fw_allow_health_check" {
     name          = "fw-allow-health-check"
     provider      = google-beta
     project       = "my-host-project-id"
     direction     = "INGRESS"
     network       = google_compute_network.lb_network.id
     source_ranges = ["130.211.0.0/22", "35.191.0.0/16"]
     allow {
       protocol = "tcp"
     }
     target_tags = ["load-balanced-backend"]
   }

2. Create a firewall rule to allow traffic from the Envoy proxy-only subnet to reach your backends.

   resource "google_compute_firewall" "fw_allow_proxies" {
     name          = "fw-allow-proxies"
     provider      = google-beta
     project       = "my-host-project-id"
     direction     = "INGRESS"
     network       = google_compute_network.lb_network.id
     source_ranges = ["10.129.0.0/23"]
     allow {
       protocol = "tcp"
       ports    = ["80", "443", "8080"]
     }
     target_tags = ["load-balanced-backend"]
   }

Console

1. Create an instance template. In the Google Cloud console, go to the Instance templates page.

   Go to Instance templates

   1. Click Create instance template.
   2. For Name, enter l7-xlb-backend-template.
   3. Ensure that the Boot disk is set to a Debian image, such as Debian GNU/Linux 12 (bookworm). These instructions use commands that are only available on Debian, such as apt-get. If you need to change the Boot disk, click Change.
      1. For Operating System, select Debian.
      2. For Version, select one of the available Debian images such as Debian GNU/Linux 12 (bookworm).
      3. Click Select.
   4. Click Advanced options, and then click Networking.
   5. Enter the following Network tags: load-balanced-backend.
   6. For Network interfaces, select Networks shared with me (from host project: HOST_PROJECT_ID).
   7. Select the lb-frontend-and-backend-subnet subnet from the lb-network network.

   8. Click Management. For Management, insert the following script into the Startup script field.

      #! /bin/bash
      apt-get update
      apt-get install apache2 -y
      a2ensite default-ssl
      a2enmod ssl
      vm_hostname="$(curl -H "Metadata-Flavor:Google" \
      http://metadata.google.internal/computeMetadata/v1/instance/name)"
      echo "Page served from: $vm_hostname" | \
      tee /var/www/html/index.html
      systemctl restart apache2
      

   9. Click Create.

2. Create a managed instance group. In the Google Cloud console, go to the Instance groups page.
   

   Go to Instance groups

   1. Click Create instance group.
   2. Choose New managed instance group (stateless). For more information, see Stateless or stateful MIGs.
   3. For Name, enter l7-xlb-backend-example.
   4. For Location, select Single zone.
   5. For Region, select us-west1.
   6. For Zone, select us-west1-a.
   7. For Instance template, select l7-xlb-backend-template.

   8. Specify the number of instances that you want to create in the group.

      For this example, specify the following options for Autoscaling:

      • For Autoscaling mode, select Off:do not autoscale.
      • For Maximum number of instances, enter 2.

      Optionally, in the Autoscaling section, you can configure the instance group to automatically add or remove instances based on instance CPU usage.

   9. Click Create.

gcloud

The gcloud instructions in this guide assume that you are using Cloud Shell or another environment with bash installed.

1. Create a VM instance template with HTTP server with the gcloud compute instance-templates create command.

   gcloud compute instance-templates create l7-xlb-backend-template \
   --region=us-west1 \
   --network=projects/HOST_PROJECT_ID/global/networks/lb-network \
   --subnet=projects/HOST_PROJECT_ID/regions/us-west1/subnetworks/lb-frontend-and-backend-subnet \
   --tags=load-balanced-backend \
   --image-family=debian-12 \
   --image-project=debian-cloud \
   --metadata=startup-script='#! /bin/bash
   apt-get update
   apt-get install apache2 -y
   a2ensite default-ssl
   a2enmod ssl
   vm_hostname="$(curl -H "Metadata-Flavor:Google" \
   http://metadata.google.internal/computeMetadata/v1/instance/name)"
   echo "Page served from: $vm_hostname" | \
   tee /var/www/html/index.html
   systemctl restart apache2' \
   --project=SERVICE_PROJECT_ID
   

2. Create a managed instance group in the zone with the gcloud compute instance-groups managed create command.

   gcloud compute instance-groups managed create l7-xlb-backend-example \
       --zone=us-west1-a \
       --size=2 \
       --template=l7-xlb-backend-template \
       --project=SERVICE_PROJECT_ID
   

Console

1. In the Google Cloud console, go to the Reserve a static address page.

   Go to Reserve a static address

2. Enter a name for the new address.

3. For Network Service Tier, select Standard.

4. For IP version, select IPv4. IPv6 addresses can only be global and can only be used with global load balancers.

5. For Type, select Regional.

6. For Region, select us-west1.

7. Leave the Attached to option set to None. After you create the load balancer, this IP address is attached to the load balancer's forwarding rule.

8. To reserve the IP address, click Reserve.

gcloud

To reserve a static external IP address, use the compute addresses create command.

gcloud compute addresses create IP_ADDRESS_NAME  \
    --region=us-west1 \
    --network-tier=STANDARD \
    --project=SERVICE_PROJECT_ID

Replace the following:

• IP_ADDRESS_NAME: the name that you want to call this address.
• SERVICE_PROJECT_ID: the project ID for the service project where the load balancer is being created.

Console

Switch context to the service project

1. In the Google Cloud console, go to the Dashboard page.

   Go to Dashboard

2. Click the Select from list at the top of the page. In the Select from window that appears, select the service project where you want to create the load balancer.

Start your configuration

1. In the Google Cloud console, go to the Load balancing page.

   Go to Load balancing

2. Click Create load balancer.
3. For Type of load balancer, select Application Load Balancer (HTTP/HTTPS) and click Next.
4. For Public facing or internal, select Public facing (external) and click Next.
5. For Global or single region deployment, select Best for regional workloads and click Next.
6. Click Configure.

Basic configuration

1. For the Name of the load balancer, enter l7-xlb-shared-vpc.
2. For the Region, select us-west1.

3. For the Network, select lb-network (from Project: HOST_PROJECT_ID).

   If you see a Proxy-only subnet required in Shared VPC network warning, confirm that the host project admin has created the proxy-only-subnet in the us-west1 region in the lb-network Shared VPC network. Load balancer creation will succeed even if you do not have permission to view the proxy-only subnet on this page.

4. Keep the page open to continue.

Configure the frontend

For HTTP:

1. Click Frontend configuration.
2. Click Add frontend IP and port.
3. Set the Name to l7-xlb-forwarding-rule.
4. Set the Protocol to HTTP.
5. Set the Port to 80.

6. For the IP address that you created in Reserving the load balancer's IP address.

7. Click Done.

For HTTPS:

If you are using HTTPS between the client and the load balancer, you need one or more SSL certificate resources to configure the proxy. For information about how to create SSL certificate resources, see SSL certificates. Google-managed certificates aren't currently supported with regional external Application Load Balancers.

1. Click Frontend configuration.
2. Click Add frontend IP and port.
3. In the Name field, enter l7-xlb-forwarding-rule.
4. In the Protocol field, select HTTPS (includes HTTP/2).
5. Ensure that the Port is set to 443, to allow HTTPS traffic.
6. Select the IP address that you created in Reserving the load balancer's IP address.
7. Click the Certificate list.
   1. If you already have a self-managed SSL certificate resource you want to use as the primary SSL certificate, select it from the menu.
   2. Otherwise, select Create a new certificate.
      1. Fill in a Name of l7-xlb-cert.
      2. In the appropriate fields upload your PEM-formatted files:
         • Public key certificate
         • Certificate chain
         • Private key
      3. Click Create.
8. To add certificate resources in addition to the primary SSL certificate resource:
   1. Click Add certificate.
   2. Select a certificate from the Certificates list or click Create a new certificate and follow the instructions above.
9. Click Done.

Configure the backend

1. Click Backend configuration.
2. From the Create or select backend services menu, select Create a backend service.
3. Set the Name of the backend service to l7-xlb-backend-service.
4. Set the Backend type to Instance groups.
5. In the New backend section:
   1. Set the Instance group to l7-xlb-backend-example.
   2. Set the Port numbers to 80.
   3. Set the Balancing mode to Utilization.
   4. Click Done.
6. In the Health check section, choose Create a health check with the following parameters:
   1. Name: l7-xlb-basic-check
   2. Protocol: HTTP
   3. Port: 80
7. Click Save and Continue.
8. Click Create.

Configure the routing rules

• Click Routing rules. Ensure that the l7-xlb-backend-service is the only backend service for any unmatched host and any unmatched path.

For information about traffic management, see Setting up traffic management.

Review and finalize the configuration

• Click Create.

gcloud

1. Define the HTTP health check with the gcloud compute health-checks create http command.

   gcloud compute health-checks create http l7-xlb-basic-check \
      --region=us-west1 \
      --use-serving-port \
      --project=SERVICE_PROJECT_ID
   

2. Define the backend service with the gcloud compute backend-services create command.

   gcloud compute backend-services create l7-xlb-backend-service \
     --load-balancing-scheme=EXTERNAL_MANAGED \
     --protocol=HTTP \
     --health-checks=l7-xlb-basic-check \
     --health-checks-region=us-west1 \
     --region=us-west1 \
     --project=SERVICE_PROJECT_ID
   

3. Add backends to the backend service with the gcloud compute backend-services add-backend command.

   gcloud compute backend-services add-backend l7-xlb-backend-service \
     --balancing-mode=UTILIZATION \
     --instance-group=l7-xlb-backend-example \
     --instance-group-zone=us-west1-a \
     --region=us-west1 \
     --project=SERVICE_PROJECT_ID
   

4. Create the URL map with the gcloud compute url-maps create command.

   gcloud compute url-maps create l7-xlb-map \
     --default-service=l7-xlb-backend-service \
     --region=us-west1 \
     --project=SERVICE_PROJECT_ID
   

5. Create the target proxy.

   For HTTP:

   For an HTTP load balancer, create the target proxy with the gcloud compute target-http-proxies create command.

   gcloud compute target-http-proxies create l7-xlb-proxy \
     --url-map=l7-xlb-map \
     --url-map-region=us-west1 \
     --region=us-west1 \
     --project=SERVICE_PROJECT_ID
   

   For HTTPS:

   For information about how to create SSL certificate resources, see SSL certificates. Google-managed certificates aren't currently supported with regional external Application Load Balancers.

   Assign your filepaths to variable names.

   export LB_CERT=path to PEM-formatted file
   

   export LB_PRIVATE_KEY=path to PEM-formatted file
   

   Create a regional SSL certificate using the gcloud compute ssl-certificates create command.

   gcloud compute ssl-certificates create l7-xlb-cert \
     --certificate=$LB_CERT \
     --private-key=$LB_PRIVATE_KEY \
     --region=us-west1
   

   Use the regional SSL certificate to create a target proxy with the gcloud compute target-https-proxies create command.

   gcloud compute target-https-proxies create l7-xlb-proxy \
     --url-map=l7-xlb-map \
     --region=us-west1 \
     --ssl-certificates=l7-xlb-cert \
     --project=SERVICE_PROJECT_ID
   

6. Create the forwarding rule.

   For custom networks, you must reference the subnet in the forwarding rule.

   For the forwarding rule's IP address, use the lb-frontend-and-backend-subnet. If you try to use the proxy-only subnet, forwarding rule creation fails.

   For HTTP:

   Use the gcloud compute forwarding-rules create command with the correct flags.

   gcloud compute forwarding-rules create l7-xlb-forwarding-rule \
     --load-balancing-scheme=EXTERNAL_MANAGED \
     --network=projects/HOST_PROJECT_ID/global/networks/lb-network \
     --address=IP_ADDRESS_NAME \
     --ports=80 \
     --region=us-west1 \
     --target-http-proxy=l7-xlb-proxy \
     --target-http-proxy-region=us-west1 \
     --network-tier=STANDARD \
     --project=SERVICE_PROJECT_ID
   

   For HTTPS:

   Create the forwarding rule with the gcloud compute forwarding-rules create command with the correct flags.

   gcloud compute forwarding-rules create l7-xlb-forwarding-rule \
     --load-balancing-scheme=EXTERNAL_MANAGED \
     --network=projects/HOST_PROJECT_ID/global/networks/lb-network \
     --address=IP_ADDRESS_NAME \
     --ports=443 \
     --region=us-west1 \
     --target-https-proxy=l7-xlb-proxy \
     --target-https-proxy-region=us-west1 \
     --network-tier=STANDARD \
     --project=SERVICE_PROJECT_ID
   

Console

1. In the Google Cloud console, go to the Load balancing page.

   Go to Load balancing

2. Click the load balancer that you just created.
3. Note the load balancer's IP address. This IP address is referred to as LB_IP_ADDRESS in the following steps.
4. In the Backend section, confirm that the VMs are healthy. The Healthy column should be populated, indicating that both VMs are healthy (2/2). If you see otherwise, first try reloading the page. It can take a few moments for the Google Cloud console to indicate that the VMs are healthy. If the backends do not appear healthy after a few minutes, review the firewall configuration and the network tag assigned to your backend VMs.
5. After the Google Cloud console shows that the backend instances are healthy, you can test your load balancer using a web browser by going to https://LB_IP_ADDRESS (or http://LB_IP_ADDRESS). Replace LB_IP_ADDRESS with the load balancer's IP address.
6. If you used a self-signed certificate for testing HTTPS, your browser displays a warning. You must explicitly instruct your browser to accept a self-signed certificate.
7. Your browser should render a page with content showing the name of the instance that served the page, along with its zone (for example, Page served from: lb-backend-example-xxxx). If your browser doesn't render this page, review the configuration settings in this guide.

gcloud

Note the IP address that was reserved:

gcloud compute addresses describe IP_ADDRESS_NAME \
    --format="get(address)" \
    --region=us-west1

You can test your load balancer using a web browser by going to https://IP_ADDRESS_NAME (or http://IP_ADDRESS_NAME). Replace IP_ADDRESS_NAME with the load balancer's IP address.

If you used a self-signed certificate for testing HTTPS, your browser displays a warning. You must explicitly instruct your browser to accept a self-signed certificate.

Your browser should render a page with minimal information about the backend instance. If your browser doesn't render this page, review the configuration settings in this guide.

Console

1. In the Google Cloud console, go to the Reserve a static address page.

   Go to Reserve a static address

2. For the name of the new address, enter cross-ref-ip-address.

3. For Network Service Tier, select Standard.

4. For IP version, select IPv4. IPv6 addresses can only be global and can only be used with global load balancers.

5. For Type, select Regional.

6. For Region, select us-west1.

7. Leave the Attached to option set to None. After you create the load balancer, this IP address is attached to the load balancer's forwarding rule.

8. To reserve the IP address, click Reserve.

gcloud

To reserve a static external IP address, use the compute addresses create command.

gcloud compute addresses create IP_ADDRESS_CROSS_REF  \
    --region=us-west1 \
    --network-tier=STANDARD \
    --project=SERVICE_PROJECT_A_ID

Replace the following:

• IP_ADDRESS_CROSS_REF: the name that you want to call this IP address.
• SERVICE_PROJECT_A_ID: the project ID for service project A, where the load balancer's frontend is being created.

Console

1. Create an instance template. In the Google Cloud console, go to the Instance templates page.

   Go to Instance templates

   1. Click Create instance template.
   2. Enter a Name for the instance template: cross-ref-backend-template.
   3. Ensure that the Boot disk is set to a Debian image, such as Debian GNU/Linux 12 (bookworm). These instructions use commands that are only available on Debian, such as apt-get. If you need to change the Boot disk, click Change.
      1. For Operating System, select Debian.
      2. For Version, select one of the available Debian images such as Debian GNU/Linux 12 (bookworm).
      3. Click Select.
   4. Click Advanced options, and then click Networking.
   5. Enter the following Network tags: load-balanced-backend.
   6. For Network interfaces, select Networks shared with me (from host project: HOST_PROJECT_ID).
   7. Select the lb-frontend-and-backend-subnet subnet from the lb-network network.

   8. Click Management. For Management, insert the following script into the Startup script field:

      #! /bin/bash
      apt-get update
      apt-get install apache2 -y
      a2ensite default-ssl
      a2enmod ssl
      vm_hostname="$(curl -H "Metadata-Flavor:Google" \
      http://metadata.google.internal/computeMetadata/v1/instance/name)"
      echo "Page served from: $vm_hostname" | \
      tee /var/www/html/index.html
      systemctl restart apache2
      

   9. Click Create.

2. Create a managed instance group. In the Google Cloud console, go to the Instance groups page.

   Go to Instance groups

   1. Click Create instance group.
   2. Choose New managed instance group (stateless). For more information, see Stateless or stateful MIGs.
   3. Enter a Name for the instance group: cross-ref-ig-backend.
   4. For Location, select Single zone.
   5. For Region, select us-west1.
   6. For Zone, select us-west1-a.
   7. For Instance template, select cross-ref-backend-template.

   8. Specify the number of instances that you want to create in the group.

      For this example, specify the following options for Autoscaling:

      • For Autoscaling mode, select Off:do not autoscale.
      • For Maximum number of instances, enter 2.

      Optionally, in the Autoscaling section, you can configure the instance group to automatically add or remove instances based on instance CPU usage.

   9. Click Create.

3. Create a regional backend service. As a part of this step, we also create the health check and add backends to the backend service. In the Google Cloud console, go to the Backends page.

   Go to Backends

   1. Click Create regional backend service.
   2. Enter a Name for the backend service: cross-ref-backend-service.
   3. For Region, select us-west1.
   4. For Load balancer type, select Regional external Application Load Balancer (EXTERNAL_MANAGED).
   5. Set Backend type to Instance groups.
   6. In the Backends section, set Network to lb-network.
   7. Click Add backend and set the following fields:
      1. Set Instance group to cross-ref-ig-backend.
      2. Set Port numbers to 80.
      3. Set Balancing mode to Utilization.
      4. Click Done.
   8. In the Health check section, choose Create a health check with the following parameters:
      1. Name: cross-ref-http-health-check
      2. Protocol: HTTP
      3. Port: 80
      4. Click Save.

   9. Optional: In the Add permissions section, enter the IAM principals (typically an email address) of Load Balancer Admins from other projects so that they can use this backend service for load balancers in their own projects. Without this permission, you cannot use cross-project service referencing.

      If you don't have permission to set access control policies for backend services in this project, you can still create the backend service now, and an authorized user can perform this step later as described in the section, Grant permissions to the Load Balancer Admin to use the backend service. That section also describes how to grant access to all the backend services in this project, so that you don't have to grant access every time you create a new backend service.

   10. Click Create.

gcloud

1. Create a VM instance template with an HTTP server with the gcloud compute instance-templates create command.

   gcloud compute instance-templates create BACKEND_IG_TEMPLATE \
       --region=us-west1 \
       --network=projects/HOST_PROJECT_ID/global/networks/lb-network \
       --subnet=projects/HOST_PROJECT_ID/regions/us-west1/subnetworks/lb-frontend-and-backend-subnet \
       --tags=load-balanced-backend \
       --image-family=debian-12 \
       --image-project=debian-cloud \
       --metadata=startup-script='#! /bin/bash
       apt-get update
       apt-get install apache2 -y
       a2ensite default-ssl
       a2enmod ssl
       vm_hostname="$(curl -H "Metadata-Flavor:Google" \
       http://metadata.google.internal/computeMetadata/v1/instance/name)"
       echo "Page served from: $vm_hostname" | \
       tee /var/www/html/index.html
       systemctl restart apache2' \
       --project=SERVICE_PROJECT_B_ID
   

   Replace the following:

   • BACKEND_IG_TEMPLATE: the name for the instance group template.
   • SERVICE_PROJECT_B_ID: the project ID for service project B, where the load balancer's backends and the backend service are being created.
   • HOST_PROJECT_ID: the project ID for the Shared VPC host project.

2. Create a managed instance group in the zone with the gcloud compute instance-groups managed create command.

   gcloud compute instance-groups managed create BACKEND_MIG \
       --zone=us-west1-a \
       --size=2 \
       --template=BACKEND_IG_TEMPLATE \
       --project=SERVICE_PROJECT_B_ID
   

   Replace the following:

   • BACKEND_MIG: the name for the backend instance group.

3. Define the HTTP health check with the gcloud compute health-checks create http command.

   gcloud compute health-checks create http HTTP_HEALTH_CHECK_NAME \
     --region=us-west1 \
     --use-serving-port \
     --project=SERVICE_PROJECT_B_ID
   

   Replace the following:

   • HTTP_HEALTH_CHECK_NAME: the name for the HTTP health check.

4. Define the backend service with the gcloud compute backend-services create command.

   gcloud compute backend-services create BACKEND_SERVICE_NAME \
     --load-balancing-scheme=EXTERNAL_MANAGED \
     --protocol=HTTP \
     --health-checks=HTTP_HEALTH_CHECK_NAME \
     --health-checks-region=us-west1 \
     --region=us-west1 \
     --project=SERVICE_PROJECT_B_ID
   

   Replace the following:

   • BACKEND_SERVICE_NAME: the name for the backend service created in service project B.

5. Add backends to the backend service with the gcloud compute backend-services add-backend command.

   gcloud compute backend-services add-backend BACKEND_SERVICE_NAME \
     --balancing-mode=UTILIZATION \
     --instance-group=BACKEND_MIG \
     --instance-group-zone=us-west1-a \
     --region=us-west1 \
     --project=SERVICE_PROJECT_B_ID
   

Console

Start your configuration

1. In the Google Cloud console, go to the Load balancing page.

   Go to Load balancing

2. Click Create load balancer.
3. For Type of load balancer, select Application Load Balancer (HTTP/HTTPS) and click Next.
4. For Public facing or internal, select Public facing (external) and click Next.
5. For Global or single region deployment, select Best for regional workloads and click Next.
6. Click Configure.

Prepare the load balancer

1. Enter the Name of the load balancer: cross-ref-l7-xlb-shared-vpc.
2. For the Region, select us-west1.

3. For the Network, select lb-network (from Project: HOST_PROJECT_ID).

   If you see a Proxy-only subnet required in Shared VPC network warning, confirm that the host project administrator has created the proxy-only-subnet in the us-west1 region in the lb-network Shared VPC network. Load balancer creation will succeed even if you don't have permission to view the proxy-only subnet on this page.

4. Keep the page open to continue.

Configure the frontend

For cross-project service referencing to work, the frontend must use the same network (lb-network) from the Shared VPC host project that was used to create the backend service.

For HTTP:

1. Click Frontend configuration.
2. Enter a Name for the forwarding rule: cross-ref-http-forwarding-rule.
3. Set the Protocol to HTTP.

4. Set the Subnetwork to lb-frontend-and-backend-subnet.

   Don't select the proxy-only subnet for the frontend even if it is an option in the list.

5. Select the IP address that you created in Reserving the load balancer's IP address, called cross-ref-ip-address.

6. Set the Port to 80.

7. Click Done.

For HTTPS:

If you are using HTTPS between the client and the load balancer, you need one or more SSL certificate resources to configure the proxy. For information about how to create SSL certificate resources, see SSL certificates. Google-managed certificates aren't currently supported with regional external Application Load Balancers.

1. Click Frontend configuration.
2. Enter a Name for the forwarding rule: cross-ref-https-forwarding-rule.
3. In the Protocol field, select HTTPS (includes HTTP/2).

4. Set the Subnetwork to lb-frontend-and-backend-subnet.

   Don't select the proxy-only subnet for the frontend even if it is an option in the list.

5. Select the IP address that you created in Reserving the load balancer's IP address, called cross-ref-ip-address.

6. Ensure that the Port is set to 443 to allow HTTPS traffic.

7. Click the Certificate list.

   1. If you already have a self-managed SSL certificate resource that you want to use as the primary SSL certificate, select it from the menu.
   2. Otherwise, select Create a new certificate.
      1. Enter a Name for the SSL certificate.
      2. In the appropriate fields upload your PEM-formatted files:
         • Public key certificate
         • Certificate chain
         • Private key
      3. Click Create.

8. To add certificate resources in addition to the primary SSL certificate resource:

   1. Click Add certificate.
   2. Select a certificate from the Certificates list or click Create a new certificate and follow the previous instructions.

9. Click Done.

Configure the backend

1. Click Backend configuration.
2. Click Cross-project backend services.
3. For Project ID, enter the project ID for service project B.
4. From the Select backend services list, select the backend services from service project B that you want to use. For this example, you enter cross-ref-backend-service.
5. Click OK.

Configure the routing rules

• Click Routing rules. Ensure that the cross-ref-backend-service is the only backend service for any unmatched host and any unmatched path.

For information about traffic management, see Setting up traffic management.

Review and finalize the configuration

• Click Create.

Test the load balancer

After the load balancer is created, test the load balancer by using the steps described in Test the load balancer.

gcloud

1. Optional: Before creating a load balancer with cross-referencing backend services, find out whether the backend services you want to refer to can be referenced using a URL map:

   gcloud compute backend-services list-usable \
       --region=us-west1 \
       --project=SERVICE_PROJECT_B_ID
   

2. Create the URL map and set the default service to the backend service created in service project B.

   gcloud compute url-maps create URL_MAP_NAME \
       --default-service=projects/SERVICE_PROJECT_B_ID/regions/us-west1/backendServices/BACKEND_SERVICE_NAME \
       --region=us-west1 \
       --project=SERVICE_PROJECT_A_ID
   

   Replace the following:

   • URL_MAP_NAME: the name for the URL map.
   • BACKEND_SERVICE_NAME: the name for the backend service created in service project B.
   • SERVICE_PROJECT_B_ID: the project ID for service project B, where the load balancer's backends and the backend service are created.
   • SERVICE_PROJECT_A_ID: the project ID for service project A, where the load balancer's frontend is being created.

   URL map creation fails if you don't have the compute.backendServices.use permission for the backend service in service project B.

3. Create the target proxy.

   For HTTP:

   gcloud compute target-http-proxies create HTTP_TARGET_PROXY_NAME \
     --url-map=URL_MAP_NAME \
     --url-map-region=us-west1 \
     --region=us-west1 \
     --project=SERVICE_PROJECT_A_ID
   

   Replace the following:

   • HTTP_TARGET_PROXY_NAME: the name for the target HTTP proxy.

   For HTTPS:

   Create a regional SSL certificate using the gcloud compute ssl-certificates create command.

   gcloud compute ssl-certificates create SSL_CERTIFICATE_NAME \
     --certificate=PATH_TO_CERTIFICATE \
     --private-key=PATH_TO_PRIVATE_KEY \
     --region=us-west1 \
     --project=SERVICE_PROJECT_A_ID
   

   Replace the following:

   • SSL_CERTIFICATE_NAME: the name for the SSL certificate resource.
   • PATH_TO_CERTIFICATE: the path to the local SSL certificate file in PEM format.
   • PATH_TO_PRIVATE_KEY: the path to the local SSL certificate private key in PEM format.

   Use the regional SSL certificate to create a target proxy with the gcloud compute target-https-proxies create command.

   gcloud compute target-https-proxies create HTTPS_TARGET_PROXY_NAME \
     --url-map=URL_MAP_NAME \
     --region=us-west1 \
     --ssl-certificates=SSL_CERTIFICATE_NAME \
     --project=SERVICE_PROJECT_A_ID
   

   Replace the following:

   • HTTPS_TARGET_PROXY_NAME: the name for the target HTTPS proxy.

4. Create the forwarding rule. For cross-project service referencing to work, the forwarding rule must use the same network (lb-network) from the Shared VPC host project that was used to create the backend service.

   For HTTP:

   gcloud compute forwarding-rules create HTTP_FORWARDING_RULE_NAME \
     --load-balancing-scheme=EXTERNAL_MANAGED \
     --network=projects/HOST_PROJECT_ID/global/networks/lb-network \
     --address=IP_ADDRESS_CROSS_REF \
     --ports=80 \
     --region=us-west1 \
     --target-http-proxy=HTTP_TARGET_PROXY_NAME \
     --target-http-proxy-region=us-west1 \
     --network-tier=STANDARD \
     --project=SERVICE_PROJECT_A_ID
   

   Replace the following:

   • HTTP_FORWARDING_RULE_NAME: the name for the forwarding rule that is used to handle HTTP traffic.

   For HTTPS:

   gcloud compute forwarding-rules create HTTPS_FORWARDING_RULE_NAME \
     --load-balancing-scheme=EXTERNAL_MANAGED \
     --network=projects/HOST_PROJECT_ID/global/networks/lb-network \
     --address=IP_ADDRESS_CROSS_REF \
     --ports=443 \
     --region=us-west1 \
     --target-https-proxy=HTTPS_TARGET_PROXY_NAME \
     --target-https-proxy-region=us-west1 \
     --network-tier=STANDARD \
     --project=SERVICE_PROJECT_A_ID
   

   Replace the following:

   • HTTPS_FORWARDING_RULE_NAME: the name for the forwarding rule that is used to handle HTTPS traffic.

5. To test the load balancer, use the steps described in Test the load balancer.

Console

Project-level permissions

Use the following steps to grant permissions to all backend services in your project.

You require the compute.regionBackendServices.setIamPolicy and the resourcemanager.projects.setIamPolicy permissions to complete this step.

1. In the Google Cloud console, go to the IAM page.

   Go to IAM

2. Select your project.

3. Click person_addGrant access.

4. In the New principals field, enter the principal's email address or other identifier.

5. In the Select a role list, select the Compute Load Balancer Services User.

6. Optional: Add a condition to the role.

7. Click Save.

Resource-level permissions for individual backend services

Use the following steps to grant permissions to individual backend services in your project.

You require the compute.regionBackendServices.setIamPolicy permission to complete this step.

1. In the Google Cloud console, go to the Backends page.

   Go to Backends

2. From the backends list, select the backend service that you want to grant access to and click person_addPermissions.

3. Click person_addAdd principal.

4. In the New principals field, enter the principal's email address or other identifier.

5. In the Select a role list, select the Compute Load Balancer Services User.

6. Click Save.

gcloud

Project-level permissions

Use the following steps to grant permissions to all backend services in your project.

You require the compute.regionBackendServices.setIamPolicy and the resourcemanager.projects.setIamPolicy permissions to complete this step.

gcloud projects add-iam-policy-binding SERVICE_PROJECT_B_ID \
    --member="user:LOAD_BALANCER_ADMIN" \
    --role="roles/compute.loadBalancerServiceUser"

Resource-level permissions for individual backend services

At the backend service level, Service Project Admins can use either of the following commands to grant the Compute Load Balancer Services User role (roles/compute.loadBalancerServiceUser).

You require the compute.regionBackendServices.setIamPolicy permission to complete this step.

gcloud projects add-iam-policy-binding SERVICE_PROJECT_B_ID \
    --member="user:LOAD_BALANCER_ADMIN" \
    --role="roles/compute.loadBalancerServiceUser" \
    --condition='expression=resource.name=="projects/SERVICE_PROJECT_B_ID/regions/us-west1/backend-services/BACKEND_SERVICE_NAME",title=Shared VPC condition'

or

gcloud compute backend-services add-iam-policy-binding BACKEND_SERVICE_NAME \
    --member="user:LOAD_BALANCER_ADMIN" \
    --role="roles/compute.loadBalancerServiceUser" \
    --project=SERVICE_PROJECT_B_ID \
    --region=us-west1

To use these commands, replace LOAD_BALANCER_ADMIN with the user's principal—for example, [email protected].

You can also configure IAM permissions so that they only apply to a subset of regional backend services by using conditions and specifying condition attributes.

gcloud

To see resources referencing a regional Shared VPC backend service, run the following command:

gcloud compute backend-services describe BACKEND_SERVICE_NAME \
    --region REGION

Replace the following:

• BACKEND_SERVICE_NAME: the name of the load balancer backend service
• REGION: the region of the load balancer

In the command output, review the usedBy field, which displays the resources referencing the backend service, as shown in the following example:

id: '123456789'
kind: compute#backendService
loadBalancingScheme: INTERNAL_MANAGED
...
usedBy:
-   reference: https://www.googleapis.com/compute/v1/projects/my-project/region/us-central1/urlMaps/my-url-map