Question

Your team is deploying an internal HTTP(S) load balancer to expose services running in a VPC-native GKE cluster within a custom-mode VPC in region us-central1. When you attempt to create the internal Application Load Balancer's forwarding rule, the operation fails with an error indicating that no proxy-only subnet exists. The cluster subnet has a primary range and two secondary ranges already configured for Pods and Services. What must you do to allow the internal Application Load Balancer to be provisioned?

Accepted Answer

Create a subnet with purpose REGIONAL_MANAGED_PROXY and role ACTIVE in us-central1, reserved exclusively for Envoy-based proxies.

Answer

Add a third secondary IP range to the existing cluster subnet and designate it as the proxy range.

Answer

Convert the VPC from custom mode to auto mode so that a proxy-only subnet is created automatically in each region.

Answer

Enable Private Google Access on the cluster subnet so the load balancer proxies can reach backend Pods.