Load balancing: Services, Ingress & Gateway API

The options

No controller to install: GKE runs the load-balancer integration for you.

L4: Services

apiVersion: v1
kind: Service
metadata:
  name: ledger
  namespace: payments
  annotations:
    networking.gke.io/load-balancer-type: "Internal"   # omit for an external load balancer
spec:
  type: LoadBalancer
  selector: { app: ledger }
  ports:
    - port: 443
      targetPort: 8443

• Internal load balancers get an IP from the subnet's primary range: reachable from the VPC, Shared VPC and hybrid links.
• externalTrafficPolicy: Local keeps the client IP and avoids a second hop, at the cost of uneven spreading.

Container-native load balancing (NEGs)

For L7, GKE creates network endpoint groups that contain Pod IPs, so the load balancer health-checks and sends traffic to Pods directly. It's the default for Ingress and Gateway in VPC-native clusters. Make sure readiness probes reflect real readiness, and use terminationGracePeriodSeconds plus a short preStop sleep so Pods leave the NEG before they stop serving.

L7: the Gateway API

Enable the Gateway API on the cluster (--gateway-api standard), then choose a GatewayClass:

The platform team owns the Gateway in an infra namespace; application teams attach routes from their own namespaces:

apiVersion: gateway.networking.k8s.io/v1
kind: Gateway
metadata:
  name: web
  namespace: infra
spec:
  gatewayClassName: gke-l7-global-external-managed
  listeners:
    - name: https
      protocol: HTTPS
      port: 443
      tls:
        mode: Terminate
        options:
          networking.gke.io/cert-manager-certs: shop-example-com   # Certificate Manager certificate
      allowedRoutes:
        namespaces:
          from: Selector
          selector:
            matchLabels: { gateway-access: "true" }
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: shop
  namespace: shop
spec:
  parentRefs:
    - name: web
      namespace: infra
  hostnames: [ "shop.example.com" ]
  rules:
    - matches:
        - path: { type: PathPrefix, value: /api }
      backendRefs:
        - name: shop-api
          port: 8080
          weight: 90
        - name: shop-api-canary
          port: 8080
          weight: 10

Per-backend settings use GKE policy CRDs attached to Services: HealthCheckPolicy (path, port, interval), GCPBackendPolicy (timeouts, connection draining, Cloud Armor policy, IAP), GCPGatewayPolicy (SSL policy on the Gateway).

Ingress (for existing setups)

Ingress with class gce builds an external Application Load Balancer; gce-internal an internal one. Settings live in BackendConfig (health checks, Cloud Armor, timeouts) and FrontendConfig (SSL policy, HTTP→HTTPS redirect) CRDs; certificates come from the ManagedCertificate CRD or pre-shared certificates. It works and is widely deployed; plan new routing on Gateway.

Certificates, TLS and protection

• Certificate Manager (works with Gateway): Google-managed certificates with DNS authorisation, wildcard support and certificate maps for many hostnames.
• Google-managed certificates (ManagedCertificate) for Ingress: simple, but the DNS record must already point at the load balancer.
• SSL policies set the minimum TLS version and cipher profile.
• Cloud Armor on external Application Load Balancers: WAF rules (preconfigured OWASP rule sets), rate limiting, geo and IP allow/deny, adaptive protection against L7 DDoS.
• Internal-only apps behind Identity-Aware Proxy (IAP) get Google sign-in in front of them without code changes.

Choosing

1. HTTP(S) to the internet? Gateway, global external class, Certificate Manager, Cloud Armor.
2. HTTP(S) for internal clients? Gateway, gke-l7-rilb.
3. TCP/UDP, or the client IP must reach the Pod? Service LoadBalancer (internal or external).
4. Several clusters behind one address? Multi-cluster Gateway (lesson 14).

Recap

• Service LoadBalancer gives L4 passthrough (external or internal); Ingress and Gateway give L7 Application Load Balancers.
• Container-native load balancing (NEGs) sends traffic straight to Pods; readiness and graceful shutdown matter.
• The Gateway API separates platform-owned Gateways from team-owned Routes and supports weights and multi-cluster.
• Use Certificate Manager, SSL policies, Cloud Armor and IAP at the edge.