Google Cloud Load Balancing

• Cloud Load Balancing distributes user traffic across multiple instances of applications, reducing the risk of performance issues by spreading the load.
• Cloud Load Balancing helps serve content as close as possible to users on a system that can respond to over one million queries per second.
• Cloud Load Balancing is a fully distributed, software-defined managed service. It isn’t hardware-based and there is no need to manage a physical load balancing infrastructure.
• Google Cloud load balancers are built on the same frontend-serving infrastructure that powers Google’s own services (Search, Gmail, YouTube).

Cloud Load Balancing — Current Product Family (Updated Naming)

Load Balancer Type	Previous Name	Layer	Proxy/Passthrough
Application Load Balancer	HTTP(S) Load Balancing	Layer 7	Proxy
Proxy Network Load Balancer	SSL Proxy / TCP Proxy Load Balancing	Layer 4	Proxy
Passthrough Network Load Balancer	TCP/UDP Network Load Balancing	Layer 4	Passthrough

Cloud Load Balancing Features

External versus Internal Load Balancing

• External load balancing
  • for internet-facing applications
  • Types
    • External Application Load Balancer (formerly External HTTP/S LB) — Global, Classic, or Regional modes
    • External Proxy Network Load Balancer (formerly SSL Proxy & TCP Proxy LB) — Global, Classic, or Regional modes
    • External Passthrough Network Load Balancer (formerly External TCP/UDP Network LB) — Regional only
• Internal load balancing
  • for internal clients inside of Google Cloud VPC networks
  • Types
    • Internal Application Load Balancer (formerly Internal HTTP/S LB) — Cross-region or Regional modes
    • Internal Proxy Network Load Balancer (formerly Internal TCP Proxy) — Cross-region or Regional modes
    • Internal Passthrough Network Load Balancer (formerly Internal TCP/UDP Network LB) — Regional only

Global versus Regional Load Balancing

• Regional load balancing
  • for single-region applications
  • supports IPv4 and IPv6 (Preview for some types)
  • Types
    • Regional External Application Load Balancer
    • Regional Internal Application Load Balancer
    • Regional External Proxy Network Load Balancer
    • Regional Internal Proxy Network Load Balancer
    • External Passthrough Network Load Balancer
    • Internal Passthrough Network Load Balancer
• Global load balancing
  • for globally distributed applications
  • provides access using a single anycast IP address
  • supports IPv4 and IPv6 termination
  • requires Premium Tier of Network Service Tiers
  • Types
    • Global External Application Load Balancer (Premium Tier)
    • Classic Application Load Balancer (Premium Tier, global; Standard Tier, regional)
    • Global External Proxy Network Load Balancer (Premium Tier)
    • Cross-region Internal Application Load Balancer
    • Cross-region Internal Proxy Network Load Balancer

Passthrough vs Proxy-based Load Balancing

• Proxy-based load balancing
  • acts as a proxy performing address and port translation and terminating the request before forwarding to the backend service
  • clients and backends interact with the load balancer
  • original client IP, port, and protocol is forwarded using X-Forwarded-For headers
  • automatically all proxy-based external load balancers inherit DDoS protection from Google Front Ends (GFEs)
  • Google Cloud Armor can be configured for Application Load Balancers
  • Types
    • Application Load Balancers (all modes — external and internal)
    • Proxy Network Load Balancers (all modes — external and internal)
• Passthrough load balancing
  • does not terminate client connections; packets are passed unchanged to the backend
  • preserves client source IP address
  • supports additional protocols like UDP, ESP, and ICMP
  • Types
    • External Passthrough Network Load Balancer
    • Internal Passthrough Network Load Balancer

Layer 4 vs Layer 7

• Layer 4-based load balancing
  • directs traffic based on data from network and transport layer protocols, such as IP address and TCP or UDP port
  • Types: Proxy Network Load Balancers and Passthrough Network Load Balancers
• Layer 7-based load balancing
  • adds content-based routing decisions based on attributes, such as the HTTP header, URL path, cookies, and query parameters
  • Types: Application Load Balancers

Traffic type

• For HTTP and HTTPS traffic, use:
  • External Application Load Balancer
  • Internal Application Load Balancer
• For TCP traffic (with proxy), use:
  • External Proxy Network Load Balancer
  • Internal Proxy Network Load Balancer
• For TCP/UDP traffic (passthrough), use:
  • External Passthrough Network Load Balancer
  • Internal Passthrough Network Load Balancer
• For SSL offload, use:
  • External Proxy Network Load Balancer (with SSL)

Application Load Balancer Modes

• Global External Application Load Balancer
  • Implemented on Google Front Ends (GFEs) using Envoy proxy
  • Supports advanced traffic management (traffic mirroring, weight-based splitting, header transformations)
  • Uses EXTERNAL_MANAGED load balancing scheme
  • Premium Tier only
  • Supports Cloud CDN, Cloud Armor, and Service Extensions
• Classic Application Load Balancer
  • The legacy external Application Load Balancer on GFEs
  • Global in Premium Tier, regional in Standard Tier
  • Uses EXTERNAL load balancing scheme
  • Fewer advanced traffic management features than the global variant
  • Google recommends migrating to the Global External Application Load Balancer
• Regional External Application Load Balancer
  • Implemented on open-source Envoy proxy
  • Supports advanced traffic management
  • Requires proxy-only subnet
  • Uses EXTERNAL_MANAGED load balancing scheme
  • Available in Premium or Standard Tier
• Cross-region Internal Application Load Balancer
  • Distributes traffic to globally distributed internal backends
  • Supports global access and global backends
• Regional Internal Application Load Balancer
  • Distributes Layer 7 traffic to backends within a single region in a VPC
  • Requires proxy-only subnet

Google Cloud Load Balancing Types

Refer blog post @ Google Cloud Load Balancing Types

Load Balancing Components

Backend Services

• A backend service distributes requests to healthy backends.
• Google Cloud supports several types of backends:
  • Instance groups — managed or unmanaged groups of VM instances
  • Zonal NEGs (GCE_VM_IP_PORT) — network endpoint groups in a single zone
  • Serverless NEGs — Cloud Run, App Engine, or Cloud Run functions
  • Internet NEGs — external endpoints outside Google Cloud
  • Hybrid NEGs — on-premises or other cloud backends via hybrid connectivity
  • Private Service Connect NEGs — access published services
  • Cloud Storage buckets — as backend buckets
• A backend service is either global or regional in scope.
• Backend service protocol options: HTTP, HTTPS, HTTP/2, H2C (cleartext HTTP/2), gRPC

Forwarding Rules

• A forwarding rule and its corresponding IP address represent the frontend configuration of a Google Cloud load balancer.
• Each forwarding rule provides a single IP address (IPv4 or IPv6) for DNS configuration.
• Forwarding rules can be global or regional depending on the load balancer type.

Health Checks

• Google Cloud provides health checking mechanisms that determine if backends are healthy and properly respond to traffic.
• Health checks are global or regional depending on the load balancer type.
• Each connection attempt is called a probe, and each health check system is called a prober.
• Backends that respond successfully for the configured number of times are considered healthy; those that fail are marked unhealthy.
• Supported health check protocols: HTTP, HTTPS, HTTP/2, TCP, SSL, gRPC

IPv6 Termination

• Application Load Balancers and Proxy Network Load Balancers support IPv6 clients.
• The load balancer accepts IPv6 connections from users and proxies those connections to backends.
• Cross-region, regional external, and regional internal Application Load Balancers support terminating IPv6 traffic (Preview).

SSL Certificates

• Load balancers that use HTTPS or SSL require SSL certificates.
• Two configuration methods:
  • Compute Engine SSL certificates — self-managed or Google-managed
  • Certificate Manager — recommended approach for advanced certificate management, supports certificate maps, DNS/LB authorization, and wildcard certificates
• Certificate Manager (2nd gen) — released in 2024/2025, provides centralized management, deployment, and automation of SSL/TLS certificates across organizations
• Supports multiple SSL certificates per load balancer for multi-domain serving

SSL Policies

• SSL policies control the SSL features (versions and ciphers) that the load balancer negotiates with clients.
• Supported on Application Load Balancers and Proxy Network Load Balancers.
• Predefined profiles: COMPATIBLE, MODERN, RESTRICTED, or CUSTOM

URL Maps

• URL maps direct requests to a destination based on defined rules.
• Supports routing based on host, path, headers, cookies, and query parameters.
• Advanced traffic management: traffic mirroring, weight-based traffic splitting, URL rewrites, URL redirects, header-based routing.

New Features (2023-2026)

HTTP/3 Support (IETF QUIC)

• HTTP/3 is supported between external Application Load Balancers and clients.
• Built on IETF QUIC — provides faster connection initiation, eliminates head-of-line blocking, supports connection migration.
• Advertised via Alt-Svc HTTP response header.
• Clients automatically fall back to HTTP/2 or HTTPS if HTTP/3 is unavailable.
• Supported on Global External ALB, Classic ALB (Premium), and Regional External ALB.

Service Extensions (Plugins and Callouts)

• Service Extensions lets you insert custom logic into the load balancing data path.
• Plugins — run custom code (e.g., Rust/Wasm) directly in the request/response path with minimal latency.
• Callouts — send gRPC callouts from the load balancer to external backend services for custom processing.
• Use cases: custom authentication, header manipulation, request validation, A/B testing logic.
• Supported on Application Load Balancers.

Authorization Policies

• Authorization policies (AuthzPolicy) enforce access control on traffic entering load balancers.
• Define rules specifying source of incoming traffic and permitted/restricted operations.
• Applied on the forwarding rule of Application Load Balancers.
• Can delegate authorization to IAP (Identity-Aware Proxy) and IAM.

Backend mTLS and Managed Workload Identity

• Frontend mTLS — load balancer requests client certificates for mutual authentication.
• Backend authenticated TLS — load balancer verifies backend server certificates.
• Backend mTLS — mutual authentication between load balancer and backends.
• Managed workload identity — automates certificate provisioning and rotation for backend mTLS.

Post-Quantum TLS

• Google Cloud load balancers support quantum-safe key exchange (X25519MLKEM768 hybrid).
• Combines NIST ML-KEM standard with traditional encryption for forward-secure TLS connections.
• Protects against future quantum computing threats (harvest-now, decrypt-later attacks).

TLS 1.3 Early Data (0-RTT)

• Reduces latency for resumed TLS connections by allowing clients to send data with the initial handshake.
• Modes: STRICT (safe methods only, no query params), PERMISSIVE (safe methods with query params), DISABLED, UNRESTRICTED.
• Supported on Global and Classic External Application Load Balancers.
• Backends must handle potential replay risks with appropriate checks (HTTP 425 Too Early response).

Advanced Load Balancing Optimizations (Service LB Policy)

• Auto-capacity draining — quickly drains traffic from unhealthy backends.
• Failover threshold — configurable threshold to determine when failover triggers.
• Traffic isolation — prevents cascading failures by limiting cross-region traffic overflow.
• Load balancing algorithms — Waterfall by Region, Waterfall by Zone, Spray to Region.

Cloud Service Mesh Integration

• Traffic Director has been rebranded to Cloud Service Mesh (GA June 2024).
• Provides a managed service mesh with Envoy proxies or proxyless gRPC clients.
• Integrates with Cloud Load Balancing for advanced traffic management.

GCP Certification Exam Practice Questions

• Questions are collected from Internet and the answers are marked as per my knowledge and understanding (which might differ with yours).
• GCP services are updated everyday and both the answers and questions might be outdated soon, so research accordingly.
• GCP exam questions are not updated to keep up the pace with GCP updates, so even if the underlying feature has changed the question might not be updated
• Open to further feedback, discussion and correction.

References:

• Cloud Load Balancing Overview
• Choose a Load Balancer
• External Application Load Balancer Overview
• Load Balancer Feature Comparison
• Application Load Balancer Overview
• Passthrough Network Load Balancer Overview
• Proxy Network Load Balancer Overview
• Service Extensions Overview