Choose your multi-cluster load balancing API for GKE


This page helps you choose the most suitable API for deploying load balancers to distribute traffic across a fleet of Google Kubernetes Engine (GKE) clusters.

You can attach a load balancer to your fleet of GKE clusters in the following ways:

  1. Use the Multi Cluster Ingress APIs such as the Multi Cluster Ingress and MultiClusterService resources.

  2. Use the Gateway APIs ( GatewayClass , Gateway , HTTPRoute , Policy , ServiceExport , and ServiceImport resources).

  3. Set up the Application Load Balancer using Google Cloud console, gcloud CLI, API, Terraform, Config Connector and attach Standalone NEGs to the user-managed backend services.

The following table lists the different ways in which you can attach a load balancer to your fleet of GKE clusters. Any features listed in the Load balancer feature comparison page that aren't listed in the following table should work with a user-managed load balancer with Standalone NEGs, instead of relying on the Kubernetes-native API for load balancing.

Solution
Multi Cluster Ingress
Multi-cluster Gateway
User-managed load balancer with Standalone NEGs
GKE platform support
Enterprise / Standard
Enterprise / Standard
Enterprise / Standard
Standard / Autopilot
Standard / Autopilot
Standard / Autopilot
GKE Version
1.18 and later
GKE 1.24 and later for Standard and 1.26 and later for Autopilot
1.18 and later
Architecture and components
Google-managed Kubernetes controller
Controller location
Off-cluster

(Google Cloud infrastructure)

Off-cluster

(Google Cloud infrastructure)

-
API
Kubernetes-native API
Kubernetes-native API
Google Cloud API (gcloud CLI)
API resources
MultiClusterIngress, MultiClusterService
GatewayClass, Gateway, HTTPRoute, *Policy
-
API launch stage
GA (v1)
GA (v1)
-
API enablement on GKE
Cluster setting on Autopilot / Standard
Default on Autopilot

Cluster setting on Standard

-
Multi-cluster Services support
Multi-cluster Services (MCS) required
Resource type
MultiClusterService
ServiceExport
-
License
Proprietary
Open source
-
Cloud Networking resources lifecycle management (excluding Shared VPC)
Automated frontend IP address management
Automated Cloud Load Balancer management
  • Forwarding rule
  • Target proxy
  • URL map
  • Backend services
  • Health checks
Automated Network Endpoint Groups (NEGs) management

( Zonal NEGs only)

( Zonal NEGs only)

( Zonal NEGs only, annotation required on the Kubernetes Service)

Cloud NGFW management
Shared VPC support
Clusters and fleet (Hub) in the host project
Clusters and fleet (Hub) in the same service project

(with firewall rules permissions in host project)

Clusters and fleet (Hub) in different projects
Load balancers support
Classic
Global external
Regional external
Regional internal
Cross-region internal
Classic
Global external
Regional external
Internal (Always regional)
External (Always regional)
Internal (Always regional)
Client-to-Load-balancer protocols support
HTTP, HTTPS, HTTP/2
HTTP/3 (based on IETF QUIC)
SSL (TLS) or TCP
Load Balancer backends support
Pods (Zonal NEGs)
Virtual Machines (including GKE nodes)
Other backends:
  • Cloud Storage
  • Public external endpoints (Internet NEGs)
  • Private external endpoints (Hybrid NEGs)
  • Private Service Connect (PSC NEGs)
  • Cloud Run (Serverless NEGs)
Load balancer-to-backends protocols support
HTTP, HTTPS, HTTP/2 (One of)
SSL (TLS) or TCP (One of)
IP addressing and protocols
Dynamic IP address assignment
Static IP address assignment
Same IP address for multiple ports (HTTP, HTTPS)
IPv6

(Load balancer-to-backend traffic remains IPv4)

(Load balancer-to-backend traffic remains IPv4)

(Load balancer-to-backend traffic remains IPv4)

Routing and traffic management
Global access
Cross-project load balancing
Host/Path routing

(Prefix, Exact match)

(Prefix, Exact match)

Header-based routing

(Exact match)

Path redirects
URL rewrites
Traffic splitting
Traffic mirroring
Traffic cut over
Traffic-based autoscaling
Custom request headers
Custom response headers
Cross-namespace routing
Frontend Security
SSL policy
HTTP-to-HTTPS redirect
Multiple TLS certificates support
Kubernetes Secrets-based certificates
Self-managed SSL certificates
Google-managed SSL certificates
Certificate Manager support
Backend service properties
Connection draining timeout
Session affinity
HTTP access logging configuration
Backend service timeout
TLS to backend services
Custom default backend

(Not all features)

(All features)

What's next