Feat: support for internal cross-regional load balancer

build/int.cloudbuild.yaml

@@ -127,6 +127,22 @@ steps:
     - verify lb-http-separate-frontend-and-backend
   name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
   args: ['/bin/bash', '-c', 'cft test run TestSeparateFrontendAndBackend --stage teardown --verbose']
+  # Internal cross regional http load balancer with cloud-run
+- id: apply internal-lb-http
+  waitFor:
+    - create
+  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
+  args: ['/bin/bash', '-c', 'cft test run TestInternalLbCloudRun --stage apply --verbose']
+- id: verify internal-lb-http
+  waitFor:
+    - apply internal-lb-http
+  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
+  args: ['/bin/bash', '-c', 'sleep 360 && cft test run TestInternalLbCloudRun --stage verify --verbose']
+- id: teardown internal-lb-http
+  waitFor:
+    - verify internal-lb-http
+  name: 'gcr.io/cloud-foundation-cicd/$_DOCKER_IMAGE_DEVELOPER_TOOLS:$_DOCKER_TAG_VERSION_DEVELOPER_TOOLS'
+  args: ['/bin/bash', '-c', 'cft test run TestInternalLbCloudRun --stage teardown --verbose']
 tags:
 - 'ci'
 - 'integration'

examples/internal-lb-cloud-run/main.tf

@@ -0,0 +1,172 @@
+/**
+ * Copyright 2025 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+provider "google" {
+  project = var.project_id
+}
+
+provider "google-beta" {
+  project = var.project_id
+}
+
+resource "google_compute_network" "internal_lb_network" {
+  name                    = "int-lb-network"
+  auto_create_subnetworks = "false"
+  project                 = var.project_id
+}
+
+resource "google_compute_subnetwork" "internal_lb_subnet_a" {
+  name          = "int-lb-subnet-a"
+  ip_cidr_range = "10.1.2.0/24"
+  network       = google_compute_network.internal_lb_network.id
+  region        = "us-east1"
+  project       = var.project_id
+  depends_on    = [google_compute_network.internal_lb_network]
+}
+
+resource "google_compute_subnetwork" "internal_lb_proxy_only_a" {
+  name          = "int-lb-proxy-only-subnet-a"
+  ip_cidr_range = "10.129.0.0/23"
+  network       = google_compute_network.internal_lb_network.id
+  purpose       = "GLOBAL_MANAGED_PROXY"
+  region        = "us-east1"
+  project       = var.project_id
+  role          = "ACTIVE"
+  depends_on    = [google_compute_network.internal_lb_network]
+}
+
+resource "google_compute_subnetwork" "internal_lb_subnet_b" {
+  name          = "int-lb-subnet-b"
+  ip_cidr_range = "10.1.3.0/24"
+  network       = google_compute_network.internal_lb_network.id
+  region        = "us-south1"
+  project       = var.project_id
+  depends_on    = [google_compute_network.internal_lb_network]
+}
+
+resource "google_compute_subnetwork" "internal_lb_proxy_only_b" {
+  name          = "int-lb-proxy-only-subnet-b"
+  ip_cidr_range = "10.130.0.0/23"
+  network       = google_compute_network.internal_lb_network.id
+  purpose       = "GLOBAL_MANAGED_PROXY"
+  region        = "us-south1"
+  project       = var.project_id
+  role          = "ACTIVE"
+  depends_on    = [google_compute_network.internal_lb_network]
+}
+
+module "backend-service-region-a" {
+  source                        = "GoogleCloudPlatform/cloud-run/google//modules/v2"
+  version                       = "~> 0.16.3"
+  project_id                    = var.project_id
+  location                      = "us-central1"
+  service_name                  = "bs-a"
+  containers                    = [{ "container_name" = "", "container_image" = "gcr.io/cloudrun/hello" }]
+  members                       = ["allUsers"]
+  ingress                       = "INGRESS_TRAFFIC_INTERNAL_ONLY"
+  cloud_run_deletion_protection = false
+  enable_prometheus_sidecar     = false
+}
+
+module "backend-service-region-b" {
+  source                        = "GoogleCloudPlatform/cloud-run/google//modules/v2"
+  version                       = "~> 0.16.3"
+  project_id                    = var.project_id
+  location                      = "us-west1"
+  service_name                  = "bs-b"
+  containers                    = [{ "container_name" = "", "container_image" = "gcr.io/cloudrun/hello" }]
+  members                       = ["allUsers"]
+  ingress                       = "INGRESS_TRAFFIC_INTERNAL_ONLY"
+  cloud_run_deletion_protection = false
+  enable_prometheus_sidecar     = false
+}
+
+module "internal-lb-http-backend" {
+  source  = "terraform-google-modules/lb-http/google//modules/backend"
+  version = "~> 12.0"
+
+  project_id            = var.project_id
+  name                  = "int-lb-http-backend"
+  enable_cdn            = false
+  load_balancing_scheme = "INTERNAL_MANAGED"
+  locality_lb_policy    = "RANDOM"
+  serverless_neg_backends = [
+    { region : "us-central1", type : "cloud-run", service_name : module.backend-service-region-a.service_name },
+    { region : "us-west1", type : "cloud-run", service_name : module.backend-service-region-b.service_name }
+  ]
+}
+
+module "internal-lb-http-frontend" {
+  source  = "terraform-google-modules/lb-http/google//modules/frontend"
+  version = "~> 12.0"
+
+  project_id            = var.project_id
+  name                  = "int-lb-http-frontend"
+  url_map_input         = module.internal-lb-http-backend.backend_service_info
+  network               = google_compute_network.internal_lb_network.name
+  load_balancing_scheme = "INTERNAL_MANAGED"
+  internal_forwarding_rule_subnetworks = [
+    google_compute_subnetwork.internal_lb_subnet_a.id,
+    google_compute_subnetwork.internal_lb_subnet_b.id
+  ]
+  depends_on = [google_compute_subnetwork.internal_lb_proxy_only_a, google_compute_subnetwork.internal_lb_proxy_only_b]
+}
+
+resource "google_vpc_access_connector" "internal_lb_vpc_connector" {
+  provider       = google-beta
+  project        = var.project_id
+  name           = "int-lb-vpc-connector"
+  region         = "us-east1"
+  ip_cidr_range  = "10.8.0.0/28"
+  network        = google_compute_network.internal_lb_network.name
+  max_throughput = 500
+  min_throughput = 300
+}
+
+module "frontend-service-a" {
+  source       = "GoogleCloudPlatform/cloud-run/google//modules/v2"
+  version      = "~> 0.16.3"
+  project_id   = var.project_id
+  location     = "us-east1"
+  service_name = "fs-a"
+  containers   = [{ "env_vars" : { "TARGET_IP" : module.internal-lb-http-frontend.ip_address_internal_managed_http[0] }, "ports" = { "container_port" = 80, "name" = "http1" }, "container_name" = "", "container_image" = "gcr.io/design-center-container-repo/redirect-traffic:latest-2002" }]
+  members      = ["allUsers"]
+  vpc_access = {
+    connector = google_vpc_access_connector.internal_lb_vpc_connector.id
+    egress    = "ALL_TRAFFIC"
+  }
+  ingress                       = "INGRESS_TRAFFIC_ALL"
+  cloud_run_deletion_protection = false
+  enable_prometheus_sidecar     = false
+  depends_on                    = [google_vpc_access_connector.internal_lb_vpc_connector]
+}
+
+module "frontend-service-b" {
+  source       = "GoogleCloudPlatform/cloud-run/google//modules/v2"
+  version      = "~> 0.16.3"
+  project_id   = var.project_id
+  location     = "us-east1"
+  service_name = "fs-b"
+  containers   = [{ "env_vars" : { "TARGET_IP" : module.internal-lb-http-frontend.ip_address_internal_managed_http[1] }, "ports" = { "container_port" = 80, "name" = "http1" }, "container_name" = "", "container_image" = "gcr.io/design-center-container-repo/redirect-traffic:latest-2002" }]
+  members      = ["allUsers"]
+  vpc_access = {
+    connector = google_vpc_access_connector.internal_lb_vpc_connector.id
+    egress    = "ALL_TRAFFIC"
+  }
+  ingress                       = "INGRESS_TRAFFIC_ALL"
+  cloud_run_deletion_protection = false
+  enable_prometheus_sidecar     = false
+}

examples/internal-lb-cloud-run/outputs.tf

@@ -0,0 +1,20 @@
+/**
+ * Copyright 2025 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+output "external_cloudrun_uris" {
+  description = "List of URIs for the frontend Cloud Run services"
+  value       = [module.frontend-service-a.service_uri, module.frontend-service-b.service_uri]
+}

examples/internal-lb-cloud-run/readme.md

@@ -0,0 +1,20 @@
+# HTTP Internal Regional Load Balancer Example
+
+This example creates a simple application with below components.
+
+* *Frontend Service*: Two cloud-run services to send request to internal cross-regional load balancers. The cloud-run service uses VPC access connector to send the request to the internal load balancer.
+* *Internal Load Balancer*: An internal cross-regional load balancer to distribute traffic to internal cloud run services.
+* *Backend Service*: Two cloud-run services to run the actual application code. These can be accessed within internal traffic. The internal Application Load Balancer is considered internal traffic.
+
+
+The `google_compute_backend_service` and its dependencies are created as part of `backend` module.
+The forwarding rules and its dependecies are created as part of `frontend` module.
+
+<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| project\_id | n/a | `string` | n/a | yes |
+
+<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

examples/internal-lb-cloud-run/variables.tf

@@ -0,0 +1,19 @@
+/**
+ * Copyright 2025 Google LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+variable "project_id" {
+  type = string
+}

metadata.yaml

@@ -58,6 +58,8 @@ spec:
         location: examples/https-gke
       - name: https-redirect
         location: examples/https-redirect
+      - name: internal-lb-cloud-run
+        location: examples/internal-lb-cloud-run
       - name: lb-http-separate-frontend-and-backend
         location: examples/lb-http-separate-frontend-and-backend
       - name: mig-nat-http-lb
@@ -338,6 +340,7 @@ spec:
           - roles/run.admin
           - roles/iam.serviceAccountUser
           - roles/certificatemanager.owner
+          - roles/owner
     services:
       - cloudresourcemanager.googleapis.com
       - storage-api.googleapis.com
@@ -346,6 +349,7 @@ spec:
       - run.googleapis.com
       - iam.googleapis.com
       - certificatemanager.googleapis.com
+      - vpcaccess.googleapis.com
     providerVersions:
       - source: hashicorp/google
         version: ">= 6.0, < 7"

modules/backend/main.tf

@@ -28,7 +28,7 @@ resource "google_compute_backend_service" "default" {
   description                     = var.description
   connection_draining_timeout_sec = var.connection_draining_timeout_sec
   enable_cdn                      = var.enable_cdn
-  compression_mode                = var.compression_mode
+  compression_mode                = var.load_balancing_scheme == "INTERNAL_SELF_MANAGED" || var.load_balancing_scheme == "INTERNAL_MANAGED" ? null : var.compression_mode
   custom_request_headers          = var.custom_request_headers
   custom_response_headers         = var.custom_response_headers
   session_affinity                = var.session_affinity

modules/backend/metadata.yaml

@@ -50,6 +50,8 @@ spec:
         location: examples/https-gke
       - name: https-redirect
         location: examples/https-redirect
+      - name: internal-lb-cloud-run
+        location: examples/internal-lb-cloud-run
       - name: lb-http-separate-frontend-and-backend
         location: examples/lb-http-separate-frontend-and-backend
       - name: mig-nat-http-lb
@@ -305,6 +307,7 @@ spec:
           - roles/run.admin
           - roles/iam.serviceAccountUser
           - roles/certificatemanager.owner
+          - roles/owner
     services:
       - cloudresourcemanager.googleapis.com
       - storage-api.googleapis.com
@@ -313,6 +316,7 @@ spec:
       - run.googleapis.com
       - iam.googleapis.com
       - certificatemanager.googleapis.com
+      - vpcaccess.googleapis.com
     providerVersions:
       - source: hashicorp/google
         version: ">= 6.0, < 7"

modules/dynamic_backends/metadata.yaml

@@ -50,6 +50,8 @@ spec:
         location: examples/https-gke
       - name: https-redirect
         location: examples/https-redirect
+      - name: internal-lb-cloud-run
+        location: examples/internal-lb-cloud-run
       - name: lb-http-separate-frontend-and-backend
         location: examples/lb-http-separate-frontend-and-backend
       - name: mig-nat-http-lb
@@ -330,6 +332,7 @@ spec:
           - roles/run.admin
           - roles/iam.serviceAccountUser
           - roles/certificatemanager.owner
+          - roles/owner
     services:
       - cloudresourcemanager.googleapis.com
       - storage-api.googleapis.com
@@ -338,6 +341,7 @@ spec:
       - run.googleapis.com
       - iam.googleapis.com
       - certificatemanager.googleapis.com
+      - vpcaccess.googleapis.com
     providerVersions:
       - source: hashicorp/google
         version: ">= 6.0, < 7"

modules/frontend/README.md

@@ -19,12 +19,13 @@ This module creates `HTTP(S) forwarding rule` and its dependencies. This modules
 | http\_port | The port for the HTTP load balancer | `number` | `80` | no |
 | https\_port | The port for the HTTPS load balancer | `number` | `443` | no |
 | https\_redirect | Set to `true` to enable https redirect on the lb. | `bool` | `false` | no |
+| internal\_forwarding\_rule\_subnetworks | List of fully-qualified subnetwork IDs (e.g., projects/my-project/regions/us-central1/subnetworks/my-subnet). | `list(string)` | `[]` | no |
 | ipv6\_address | An existing IPv6 address to use (the actual IP address value) | `string` | `null` | no |
 | labels | The labels to attach to resources created by this module | `map(string)` | `{}` | no |
 | load\_balancing\_scheme | Load balancing scheme type (EXTERNAL for classic external load balancer, EXTERNAL\_MANAGED for Envoy-based load balancer, and INTERNAL\_SELF\_MANAGED for traffic director) | `string` | `"EXTERNAL_MANAGED"` | no |
 | managed\_ssl\_certificate\_domains | Create Google-managed SSL certificates for specified domains. Requires `ssl` to be set to `true` | `list(string)` | `[]` | no |
 | name | Name for the forwarding rule and prefix for supporting resources | `string` | n/a | yes |
-| network | Network for INTERNAL\_SELF\_MANAGED load balancing scheme | `string` | `"default"` | no |
+| network | Network for INTERNAL\_SELF\_MANAGED/INTERNAL\_MANAGED load balancing scheme | `string` | `"default"` | no |
 | private\_key | Content of the private SSL key. Requires `ssl` to be set to `true` and `create_ssl_certificate` set to `true` | `string` | `null` | no |
 | project\_id | The project to deploy to, if not set the default provider project is used. | `string` | n/a | yes |
 | quic | Specifies the QUIC override policy for this resource. Set true to enable HTTP/3 and Google QUIC support, false to disable both. Defaults to null which enables support for HTTP/3 only. | `bool` | `null` | no |
@@ -44,6 +45,8 @@ This module creates `HTTP(S) forwarding rule` and its dependencies. This modules
 | external\_ipv6\_address | The external IPv6 assigned to the global fowarding rule. |
 | http\_proxy | The HTTP proxy used by this module. |
 | https\_proxy | The HTTPS proxy used by this module. |
+| ip\_address\_internal\_managed\_http | The internal/external IP addresses assigned to the HTTP forwarding rules. |
+| ip\_address\_internal\_managed\_https | The internal/external IP addresses assigned to the HTTPS forwarding rules. |
 | ipv6\_enabled | Whether IPv6 configuration is enabled on this load-balancer |
 | ssl\_certificate\_created | The SSL certificate create from key/pem |
 | url\_map | The default URL map used by this module. |