Internal and external load balancers solve different trust problems

Choose the audience first. Internet clients need an external frontend and edge policy; private consumers need an internal address and routable VPC connectivity.

Dimension	External	Internal
Audience	Internet or globally distributed clients	VPC, peered networks or connected on-premises clients
Typical control	Cloud Armor, TLS, rate policy	Firewall, identity-aware application controls, private DNS
Gateway shape	Global or regional external	Regional or cross-regional internal
Common mistake	Exposing an admin surface publicly	Assuming internal means authenticated

Reachability and authorization are separate controls in both designs.

Exposure choice is easiest to understand by separating the Kubernetes contract from the Google Cloud implementation. GKE can create external and internal load balancers through Gateway, Ingress or Service APIs. The correct choice follows the client's network location and failure domain. The Kubernetes objects stay familiar, but GKE supplies controllers, infrastructure and safe defaults around them. This is why a team can move from an on-premises cluster without rewriting every workload, while still needing to redesign networking, identity and operational ownership for the cloud environment.

A useful inspection step is `kubectl get gateway,ingress,svc -A`. Read the output as evidence, not as a ritual: first confirm the desired object exists, then look at status conditions, events and the Google Cloud resource it represents. In production, capture the expected result in a runbook or automated check so an operator can distinguish slow reconciliation from a configuration error.

Production gotcha: An internal IP is not an identity boundary; a compromised workload in the VPC can still reach it unless application and network controls intervene. The safe habit is to verify quotas, regional availability and feature support against current Google Cloud documentation before rollout. Module 3 builds the Gateway API control plane on this data path.