Create an HTTPS load balancer

Use an HTTPS listener to terminate TLS at the load balancer and route HTTP requests to your application's backend service.

Prerequisites

An installed and authenticated evroc CLI, with the project and region selected
An existing virtual machine (VM), myvm, serving HTTP on port 8080
Network access from the load balancer to the VM's backend port; see Configure security groups
A PEM certificate chain for web.example.com and its matching private key

Replace web.example.com with your application's hostname, and fullchain.pem and privkey.pem with the paths to your certificate chain and private key. The chain must contain the leaf certificate followed by the required intermediates, without the root CA certificate. See Manage load balancer certificates for supported keys and renewal instructions.

For reference flags such as --backend-service-ref, short names resolve in the selected project and region. These flags also accept full resource references.

Create the backend pool and service

Add your VM to a backend pool:

evroc loadbalancer backendpool create web-pool \
  --backend-ref=myvm

Create a service for the application's HTTP port. Backend IP selection defaults to IPv4:

evroc loadbalancer backendservice create web-backend \
  --backend-pool-ref=web-pool \
  --port=8080

Configure an HTTP health check using a path your application serves:

evroc loadbalancer backendservice sethealthcheckhttp web-backend \
  --path=/ready

Create and upload the certificate

Create the empty certificate resource, then upload its content:

evroc loadbalancer certificate create web-cert
evroc loadbalancer certificate upload web-cert \
  --certificate-file=fullchain.pem \
  --private-key-file=privkey.pem

The service validates the certificate and key. Check that the certificate's Ready condition is True:

evroc loadbalancer certificate get web-cert -o yaml

Create an HTTP route

Create a route restricted to your hostname:

evroc loadbalancer httproute create web-route \
  --hostname=web.example.com \
  --backend-service-ref=web-backend

This creates one catch-all rule named default that sends requests for web.example.com to web-backend.

Create the load balancer and HTTPS listener

This example uses the default VPC and subnets. To use a different VPC, select it and its subnets when you create the load balancer; you can't change its network configuration afterward. See Attach the load balancer to a specific VPC before running the creation command.

Allocate a public IP and create the load balancer:

evroc networking publicip create web-ip
evroc loadbalancer loadbalancer create web-lb \
  --public-ip-ref=web-ip

Attach the HTTP route and certificate to an HTTPS listener on port 443. HTTPS requires a certificate reference:

evroc loadbalancer loadbalancer addlistener web-lb \
  --listener-name=https \
  --listener-port=443 \
  --listener-protocol=HTTPS \
  --listener-route-ref=web-route \
  --listener-certificate-ref=web-cert

For plaintext HTTP routing, use --listener-protocol=HTTP with an HTTP route and omit the certificate reference.

Check readiness and verify an HTTPS request

Inspect the certificate, route, backend service, and load balancer:

evroc loadbalancer certificate get web-cert -o yaml
evroc loadbalancer httproute get web-route -o yaml
evroc loadbalancer backendservice get web-backend -o yaml
evroc loadbalancer loadbalancer get web-lb -o yaml

Wait for the resources' Ready conditions to be True. Read the load balancer's public IPv4 address from status.networking.publicIPv4Address. Replace <public-ipv4> below with that address:

curl --resolve web.example.com:443:<public-ipv4> \
  https://web.example.com/

The request uses your hostname for TLS and HTTP routing while connecting directly to the load balancer's IP. Verify that the response comes from your application. For a certificate issued by a private CA, add --cacert with that CA's PEM file. For normal access, configure your hostname's DNS record to point to the public IP.

evroc User Documentation