Load Balancers & TLS

Create a Load Balancer

A Load Balancer spreads incoming traffic across several servers so no one server carries everything and the loss of one does not take you down. You build it in layers: the load balancer itself, a listener, a pool of servers, and a health check. Step 1 — Create the load balancer 1. Open Networking, then Load Balancers, and click Create Load Balancer. 2. Set: - Name: for example web-lb. - Subnet: the subnet your backend servers are on. - Availability Zone: match your servers' region. Step 2 — Add a listener The listener is what the load balancer listens for. - Protocol and Port: for a website, HTTP on 80, or HTTPS on 443. For HTTPS, attach a certificate (see TLS Certificates). Step 3 — Create a pool The pool is the group of backend servers and how traffic is shared. - Algorithm: Round Robin sends requests to each server in turn and suits most cases. Step 4 — Add members The members are the actual servers. - Add each backend server and the port its application listens on (for example 80). Step 5 — Add a health monitor The health check quietly removes an unhealthy server from rotation until it recovers. - Choose a type (an HTTP check on a health URL, or a simple TCP check) and the interval. Finish Give the load balancer a public IP and open the listener's port in your security rules. For real redundancy, put the backend servers in an anti-affinity Placement Group so they never share a host.

Add a TLS certificate (for HTTPS)

A TLS certificate turns http into https and shows the padlock in the browser. If your load balancer serves HTTPS, it needs one. What you need Two things, kept together: the certificate itself (usually with its intermediate chain) and its private key. Get a certificate for your domain from any certificate authority first. Add it 1. Open Networking, then TLS Certificates, and add a certificate. 2. Fill in: - Name: for example www-cert. - Certificate: paste the certificate, followed by any intermediate/chain certificates. - Private Key: paste the matching private key. 3. Save it. The key is stored securely by the platform's secrets service. Use it When you create an HTTPS listener on your load balancer, select this certificate. The load balancer then handles encryption, so your backend servers can speak plain HTTP internally while visitors get a secure connection. Track the expiry date and replace the certificate before it lapses, or visitors will see security warnings.