The Google HTTP Load Balancer URL length limit

TL;DR Google Container Engine running Kubernetes v1.1 supports loadBalancerIP just mark the auto-assigned IP as static first.

Kubernetes v1.1 supports externalIPs:

apiVersion: v1
kind: Service
spec:
  type: LoadBalancer
  loadBalancerIP: 10.10.10.10
  ...

So far there isn't a really good consistent documentation on how to use it on GCE. What is sure is that this IP must first be one of your pre-allocated static IPs.

The cross-region load balancing documentation is mostly for Compute Engine and not Kubernetes/Container Engine, but it's still useful especially the part "Configure the load balancing service".

If you just create a Kubernetes LoadBalancer on GCE, it will create a network Compute Engine > Network > Network load balancing > Forwarding Rule pointing to a target pool made of your machines on your cluster (normally only those running the Pods matching the service selector). It looks like deleting a namespace doesn't nicely clean-up the those created rules.

Update

It is actually now supported (even though under documented):

1. Check that you're running Kubernetes 1.1 or later (under GKE edit your cluster and check "Node version")
2. Under Networking > External IP addresses you should have already some Ephemeral marked as pointing to your cluster's VM instance (if not or unsure, deploy once without loadBalancerIP, wait until you've an external IP allocated when you run kubectl get svc, and look up that IP in the list on that page). Mark one of them as static, let's say it External Address is 10.10.10.10.
3. Edit your LoadBalancer to have loadBalancerIP=10.10.10.10 as above (adapt to the IP that was given to you by Google).

Now if you delete your LoadBalancer or even your namespace, it should preserve that IP address upon re-reploying on that cluster. If you need to change the cluster, some manual fiddling should be possible:

1. Under “Network load balancing” section, “Target pools” tab, click “Create target pool” button:
   • Name: cluster-pool (or any other name)
   • Region: Select the region of one of your clusters
   • Health Check: Optional, if you wish
   • Select existing instance groups: Your Kubernetes cluster
2. Under “Network load balancing” section, “Forwarding rules” tab, click “Create forwarding rule” button:
   • Name: http-cross-region-gfr (or any other name)
   • Region: Select the region of one of your clusters
   • External IP: Select loadbalancer-ip-crossregion you just reserved
   • Target pool: Select cluster-pool you just created

On Google’s Global HTTP Load Balancer, each HTTPS target proxy is linked to a certificate. You can use the gcloud tool (pre-installed on GCE images) to update your target proxies with new certificates. But make sure that:

• Your version of gcloud is relatively recent. The target-https-proxies commands were only recently added, so they aren’t present in older versions of gcloud. (Not to be confused with target-http-proxies, which manges plaintext HTTP sites)
• Your renewal server has API access to Compute Engine resources. You can configure this in your GCE templates, or on a instance-by-instance basis.

You can query gcloud for the current certificate, to check if it’s about to expire. If it is, you can upload your new certificate, then use the target-https-proxies update command to switch over to the new certificate. You won’t see the changes immediately, but soon, the renewed certificate should be installed globally.

There’s a usage quota of 30 SSL certificates (at least on my account). But if you aren’t too aggressive with your renewals, you won’t have any problems even if your renewal script doesn’t clean out expired certificates. It’d be a good idea to keep around at least 1 old certificate, just in case something goes wrong and you need to revert.