Search code examples
google-cloud-platformgoogle-cloud-load-balancer

Google Cloud Load Balancer + GKE ingress

I've configured a Google Cloud Load Balancer as follows:

  • GFE (frontend) listening on :443, https only
  • Host matching + path matching on /*
  • A single NEG (Network Endpoint Group) as a backend service for the load balancer

What I don't understand, is why an instance group is linked as a backend service to this Load Balancer (see below): enter image description here

The instance group backend service links to the VM instances configured for my Kubernetes cluster. Also, if I remove the instance group backend service from this Load Balancer, my-app is still reachable over the global ip address. However, after a few minutes, the instance group backend service is back and is linked to the Load Balancer again.

I can't seem to find anything about this behavior when using Network Endpoint Groups with a Google Cloud Load Balancer in the documentation or in any of the examples.

If you know why the instance group backend service is linked and why it returns after being removed, please reply.

Solution

  • When creating a GKE ingress there are a couple of options that can be defined on the yaml, one of these options is to have a Default Backend defined where requests not matching any Host or path are sent to it.

    By default when there is no Default Backend specified GKE automatically adds it’s own small web application to reply 404 to any unmatched requests, based on your screenshot the additional Instance group you see is this default backend not having been manually specified on creation.

    Additionally deleting the Backend manually does not work since GKE always tries to keep all the resources in sync with what is described in the YAML, if you want to remove it instead you need to specify your own default backend for unmatched requests.