Search code examples
google-cloud-platformcloudcdngoogle-cloud-load-balancer

How to add Cloud CDN to GCP VM? Always no load balancer available


I have a running Web server on Google Cloud. It's a Debian VM serving a few sites with low-ish traffic, but I don't like Cloudflare. So, Cloud CDN it is.

I created a load balancer with static IP.

I do all the items from the guides I've found. But when it comes time to Add origin to Cloud CDN, no load balancer is available because it's "unhealthy", as seen by rolling over the yellow triangle in the LB status page: "1 backend service is unhealthy".

At this point, the only option is to choose Create a Load Balancer.

I've created several load balancers with different attributes, thinking that might be it, but no luck. They all get the "1 backend service is unhealthy" tag, and thus are unavailable.

---Edit below---

During LB creation, I don't see anywhere that causes the LB to know about the VM, except in cert issue (see below). Nowhere does it ask for any field that would point to the VM.

I created another LB just now, and here are those settings. It finishes, then it's marked unhealthy.

Type HTTP(S) Load Balancing

Internet facing or internal only? From Internet to my VMs

(my VM is not listed in backend services, so I create one... is this the problem?)

Create backend service

  • Backend type: Instanced group
  • Port numbers: 80,443
  • Enable Cloud CDN: checked
  • Health check: create new: https, check /

Simple host and path rule: checked

New Frontend IP and port

  • Protocol: HTTPS
  • IP: v4, static reserved and issued
  • Port: 443
  • Certificate: Create New: Create Google-managed certificate, mydomain.com and www.mydomain.com

Solution

  • Load balancer's unhealthy state could mean that your LB's healthcheck probe is unable to reach your backend service(Your Debian VM in this case).

    If your backend service looks good now, I think there is a problem with your firewall configuration.

    Check your firewall rules whether it allows healthcheck probe's IP address range or not.

    Refer to the docoment below to get more detailed information.

    Required firewall rule