Set up Cloud Run, Cloud Functions, or App Engine

This page shows you how to create an external Application Load Balancer to route requests to serverless backends. Here the term serverless refers to the following serverless compute products:

  • App Engine
  • Cloud Run functions
  • Cloud Run

Serverless NEGs allow you to use Google Cloud serverless apps with external Application Load Balancers. After you configure a load balancer with the serverless NEG backend, requests to the load balancer are routed to the serverless app backend.

To learn more about serverless NEGs, read the Serverless NEGs overview.

Before you begin

  1. Deploy an App Engine, Cloud Run functions, or Cloud Run service.
  2. If you haven't already done so, install the Google Cloud CLI.
  3. Configure permissions.
  4. Add an SSL certificate resource.

Deploy an App Engine, Cloud Run functions, or Cloud Run service

The instructions on this page assume you already have a Cloud Run, Cloud Run functions, or App Engine service running.

For the example on this page, we have used the Cloud Run Python quickstart to deploy a Cloud Run service in the us-central1 region. The rest of this page shows you how to set up an external Application Load Balancer that uses a serverless NEG backend to route requests to this service.

If you haven't already deployed a serverless app, or if you want to try a serverless NEG with a sample app, use one of the following quickstarts. You can create a serverless app in any region, but you must use the same region later on to create the serverless NEG and load balancer.

Cloud Run

To create a simple Hello World application, package it into a container image, and then deploy the container image to Cloud Run, see Quickstart: Build and Deploy.

If you already have a sample container uploaded to the Container Registry, see Quickstart: Deploy a Prebuilt Sample Container.

Cloud Run functions

See Cloud Run functions: Python Quickstart.

App Engine

See the following App Engine quickstart guides for Python 3:

Install the Google Cloud CLI

Install the Google Cloud CLI. See gcloud Overview for conceptual and installation information about the tool.

If you haven't run the gcloud CLI previously, first run gcloud init to initialize your gcloud directory.

Configure permissions

To follow this guide, you need to create a serverless NEG and create an external HTTP(S) load balancer in a project. You should be either a project owner or editor, or you should have the following Compute Engine IAM roles:

Task Required Role
Create load balancer and networking components Network Admin
Create and modify NEGs Compute Instance Admin
Create and modify SSL certificates Security Admin

Optional: Use BYOIP addresses

With bring your own IP (BYOIP), you can import your own public addresses to Google Cloud to use the addresses with Google Cloud resources. For example, if you import your own IPv4 addresses, you can assign one to the forwarding rule when you configure your load balancer. When you follow the instructions in this document to create the load balancer, provide the BYOIP address as the IP address.

For more information about using BYOIP, see Bring your own IP addresses.

Reserve an external IP address

Now that your services are up and running, set up a global static external IP address that your customers use to reach your load balancer.

Console

  1. In the Google Cloud console, go to the External IP addresses page.

    Go to External IP addresses

  2. Click Reserve external static IP address.

  3. For Name, enter example-ip.

  4. For Network service tier, select Premium.

  5. For IP version, select IPv4.

  6. For Type, select Global.

  7. Click Reserve.

gcloud 

gcloud compute addresses create EXAMPLE_IP \
    --network-tier=PREMIUM \
    --ip-version=IPV4 \
    --global

Note the IPv4 address that was reserved:

gcloud compute addresses describe EXAMPLE_IP \
    --format="get(address)" \
    --global

Replace EXAMPLE_IP with the name of the IP address.

Create an SSL certificate resource

To create the load balancer, you must have an SSL certificate resource that can be attached to the target proxy. The SSL certificate resource can be either a certificate map or a Compute Engine SSL certificate (classic certificate).

Certificate map

You can create a certificate map as described in one of the following documents:

Compute Engine SSL certificate

For an HTTPS load balancer, create a Compute Engine SSL certificate resource as described in one of the following documents:

We recommend using a Google-managed certificate.

Create the load balancer

In the following diagram, the load balancer uses a serverless NEG backend to direct requests to a serverless Cloud Run service. For this example, we have used the Cloud Run Python quickstart to deploy a Cloud Run service.

External Application Load Balancer architecture for a Cloud Run application.
External Application Load Balancer architecture for a Cloud Run application (click to enlarge).

Because health checks are not supported for backend services with serverless NEG backends, you don't need to create a firewall rule allowing health checks if the load balancer has only serverless NEG backends.

Console

Select the load balancer type

  1. In the Google Cloud console, go to the Load balancing page.

    Go to Load balancing

  2. Click Create load balancer.
  3. For Type of load balancer, select Application Load Balancer (HTTP/HTTPS) and click Next.
  4. For Public facing or internal, select Public facing (external) and click Next.
  5. For Global or single region deployment, select Best for global workloads and click Next.
  6. For Load balancer generation, select Classic Application Load Balancer and click Next.
  7. Click Configure.

Basic configuration

  1. For the name of the load balancer, enter serverless-lb.
  2. Keep the window open to continue.

Frontend configuration

  1. Click Frontend configuration.
  2. For Name, enter a name.
  3. To create an HTTPS load balancer, you must have an SSL certificate (gcloud compute ssl-certificates list).

    We recommend using a Google-managed certificate as described previously.

    4. To configure an external Application Load Balancer, fill in the fields as follows.

    Verify the following options are configured with these values:

    Property Value (type a value or select an option as specified)
    Protocol HTTPS
    Network Service Tier Premium
    IP version IPv4
    IP address example-ip
    Port 443
    Certificate For Choose certificate repository, select Use certificate map or Use classic certificates. Depending on your selection, select a certificate map or a classic certificate.
    Optional: Enable HTTP to HTTPS Redirect Use this checkbox to enable HTTP to HTTPS redirects.

    Enabling this checkbox creates an additional partial HTTP load balancer that uses the same IP address as your HTTPS load balancer and redirects HTTP requests to your load balancer's HTTPS frontend.

    This checkbox can only be selected when the HTTPS protocol is selected and a reserved IP address is used.

  4. Click Done.

Backend configuration

  1. Click Backend configuration.
  2. In the Backend services & backend buckets list, click Create a backend service.
  3. For Name, enter a name.
  4. In Backend type, select Serverless network endpoint group.
  5. Leave Protocol unchanged. This parameter is ignored.
  6. In the Backends section, for New backend, select Create Serverless network endpoint group.
  7. For Name, enter a name.
  8. Click Create.
  9. In the New backend section, click Done.
  10. Select Enable Cloud CDN.
  11. Optional: Modify the cache mode and TTL settings.
  12. Click Create.

Routing rules

Routing rules determine how your traffic is directed. To configure routing, you'll set up host rules and path matchers, which are configuration components of an external Application Load Balancer's URL map.

  1. Click Host and path rules.

  2. Retain the default hosts and paths. For this example, all requests go to the backend service created in the previous step.

Reviewing the configuration

  1. Click Review and finalize.
  2. Review all the settings.
  3. Optional: Click Equivalent Code to view the REST API request that will be used to create the load balancer.
  4. Click Create.
  5. Wait for the load balancer to be created.
  6. Click the name of the load balancer (serverless-lb).
  7. Note the IP address of the load balancer for the next task. It's referred to as IP_ADDRESS.