An enterprise application hosted on Compute Engine backend instance groups in both `us-central1` and `europe-west1` requires HTTP/HTTPS traffic routing, SSL termination, and path-based URL mapping for global internet traffic. Additionally, corporate users on an on-premises network connected via Cloud Interconnect must resolve the application domain `app.example.com` to internal VPC endpoints, whereas external internet users must resolve `app.example.com` to the public-facing entry point. Which combination of load balancing and Cloud DNS configurations correctly implements this split-horizon architecture?
- Deploy a Global External Application Load Balancer configured with a global static IP address, frontend SSL certificate, and URL map. Configure a Cloud DNS public zone for app.example.com containing an A record pointing to the global public IP address. Create a Cloud DNS private zone for app.example.com authorized for the VPC network containing A records pointing to internal backend endpoints, and enable a Cloud DNS inbound server policy on the VPC network for on-premises resolution.Answer
- BDeploy an External Passthrough Network Load Balancer in each region configured with regional external IP addresses. Configure a Cloud DNS public zone with a weighted round-robin policy to perform path-based URL routing across the regional IP addresses, and configure Cloud DNS outbound peering zones to push private DNS records to on-premises DNS servers.
- CDeploy a Global External Application Load Balancer for internet traffic. Enable the Cloud DNS API directly within the on-premises Active Directory project configuration, and establish a Cloud DNS peering zone configured to sync private records directly into the on-premises DNS server.
- DDeploy a Global External Application Load Balancer. Create a Cloud DNS private zone for app.example.com at the GCP Organization resource hierarchy level, relying on organization-level inheritance to automatically intercept and override external public DNS queries for all internet clients.
Answer
Deploy a Global External Application Load Balancer with a public static IP address, a Cloud DNS public zone pointing to the public IP for internet clients, a Cloud DNS private zone bound to the VPC for internal endpoints, and a Cloud DNS inbound server policy to allow on-premises systems to resolve the private DNS zone over Cloud Interconnect.
The correct solution uses a Global External Application Load Balancer to satisfy the Layer 7 HTTP/HTTPS features (path-based routing, SSL termination, multi-region backends). To achieve split-horizon DNS, internet clients use a Cloud DNS public zone resolving to the load balancer's external IP address, while on-premises users query the Cloud DNS private zone via a Cloud DNS Inbound Server Policy over Cloud Interconnect to receive internal IP addresses.
Step-by-Step Solution
Key Concept
Deploying Global External Application Load Balancers alongside Cloud DNS split-horizon private zones and inbound server policies for hybrid cloud environments.