Your engineering team is deploying an internal microservice on Compute Engine instances located in a Virtual Private Cloud (VPC) named `prod-vpc`. The service must be accessible privately from both `prod-vpc` and a peered VPC named `analytics-vpc` using the custom hostname `api.internal`. You plan to use an Internal Application Load Balancer. Which TWO actions must you perform to successfully deploy the load balancer and enable name resolution for both VPCs?
- Allocate a proxy-only subnet in the region where the Internal Application Load Balancer is deployed.Answer
- Create a Cloud DNS private zone for `api.internal`, add an A record pointing to the load balancer's IP address, and authorize both `prod-vpc` and `analytics-vpc` on the zone.Answer
- CDeploy a Global External Application Load Balancer and configure Google Cloud Armor policies to restrict access to internal VPC IP ranges.
- DEnable the Cloud DNS API in the project hosting `analytics-vpc` to automatically replicate private DNS zones across peered VPCs.
Answer
To deploy an Internal Application Load Balancer and enable DNS resolution across peered VPCs, you must create a regional proxy-only subnet for Envoy proxy allocation and configure a Cloud DNS private zone containing an A record that authorizes both VPC networks.
Deploying an Internal Application Load Balancer in Google Cloud requires a regional proxy-only subnet to deliver proxy connections to backends. Additionally, for private hostnames to resolve across multiple VPCs, the Cloud DNS private zone containing the A record must explicitly authorize all target VPC networks.
Step-by-Step Solution
Key Concept
Internal Application Load Balancer Proxy Subnets and Cloud DNS Multi-VPC Authorization