IBM VPC Load Balancer Config Builder

NetworkingIBM Cloud

Build VPC Application and Network Load Balancer configs with listeners, pools, and health monitors.

Last verified: May 2026

IBM Cloud VPC Load Balancer Configuration

Build VPC Application and Network Load Balancer configs with listeners, pools, health monitors, and routing policies.

Required Fields

nametypesubnetslistenerspools

{
  "name": "prod-web-alb",
  "type": "application",
  "isPublic": true,
  "resourceGroup": "prod-resources",
  "subnets": [
    { "id": "subnet-us-south-1-web", "zone": "us-south-1" },
    { "id": "subnet-us-south-2-web", "zone": "us-south-2" }
  ],
  "securityGroups": ["web-lb-sg"],
  "listeners": [
    {
      "protocol": "https",
      "port": 443,
      "certificateInstance": "crn:v1:bluemix:public:secrets-manager:us-south:a/acct-id:sm-instance:secret:cert-id",
      "defaultPool": "web-pool",
      "policies": [
        {
          "name": "api-route",
          "action": "forward",
          "priority": 1,
          "rules": [
            { "type": "path", "condition": "starts_with", "value": "/api" }
          ],
          "targetPool": "api-pool"
        }
      ]
    },
    {
      "protocol": "http",
      "port": 80,
      "defaultPool": "redirect-pool",
      "httpsRedirect": {
        "statusCode": 301,
        "targetListener": "https-443"
      }
    }
  ],
  "pools": [
    {
      "name": "web-pool",
      "algorithm": "round_robin",
      "protocol": "http",
      "healthMonitor": {
        "type": "http",
        "delay": 5,
        "maxRetries": 2,
        "timeout": 2,
        "urlPath": "/health"
      },
      "sessionPersistence": { "type": "app_cookie", "cookieName": "SERVERID" },
      "members": [
        { "address": "10.240.0.10", "port": 8080, "weight": 50 },
        { "address": "10.240.64.10", "port": 8080, "weight": 50 }
      ]
    },
    {
      "name": "api-pool",
      "algorithm": "least_connections",
      "protocol": "http",
      "healthMonitor": {
        "type": "http",
        "delay": 10,
        "maxRetries": 3,
        "timeout": 5,
        "urlPath": "/api/health"
      },
      "members": [
        { "address": "10.240.1.10", "port": 3000, "weight": 50 },
        { "address": "10.240.65.10", "port": 3000, "weight": 50 }
      ]
    }
  ]
}

Generated Output

Output will appear here...

How It Helps

IBM Cloud VPC Load Balancers come in two flavors — Application Load Balancer (HTTP/HTTPS, layer 7) and Network Load Balancer (TCP/UDP, layer 4) — each with their own listener, pool, and health monitor primitives. The IBM Load Balancer Config Builder produces a complete config for either type, with listeners, backend pools, health monitors, and routing policies, output as `ibm_is_lb` Terraform resources with all dependent objects in correct creation order.

Things Engineers Ask

When should I choose ALB versus NLB?

Choose ALB for HTTP/HTTPS services where you want host-based or path-based routing, TLS termination, or per-request load balancing. Choose NLB for non-HTTP protocols, when you need the source IP preserved natively (NLB is layer 4 and doesn't proxy), or when extreme throughput matters more than layer-7 features.

Can the load balancer terminate TLS with a managed certificate?

Yes — IBM Cloud integrates with the Secrets Manager service for TLS certificates. You provision a certificate (Let's Encrypt, imported, or issued by a managed CA) into Secrets Manager, then reference it from the LB listener. Renewal is handled by Secrets Manager and the LB picks up the new cert automatically.

In Practice

A new microservice deployment behind an ALB is showing 502 responses during deploys, even though the deploy runs one pod at a time and PodDisruptionBudgets are in place. The cause turns out to be the health monitor's strict 5-second interval and 3-retry threshold — backends get marked unhealthy faster than new ones come ready. You regenerate the LB config with a 15-second interval and 5-retry threshold, redeploy, and the 502s disappear.

Practical Applications

1Standing up an HTTPS-terminating ALB in front of a new web service with health-checked backend pools and a redirect from HTTP.
2Configuring an NLB for a non-HTTP protocol (database proxy, custom TCP service) where layer-7 features are not needed.
3Tuning health monitor thresholds for a service whose startup is slow, where default thresholds would mark healthy backends as down during deploys.
4Migrating an AWS ALB or Azure Application Gateway configuration into an equivalent IBM Cloud ALB without retyping every listener.

Behind the Scenes

The builder collects LB type (ALB or NLB), region, VPC, subnet placement, and a list of listeners (port, protocol, certificate, default pool). Each pool is defined with members (backend IPs or VPC instance references), a health monitor (interval, timeout, retries), and a load balancing algorithm. Output is `ibm_is_lb`, `ibm_is_lb_listener`, `ibm_is_lb_pool`, `ibm_is_lb_pool_member`, and `ibm_is_lb_health_monitor` Terraform resources with proper dependencies.

Things the Docs Don’t Tell You

TIP

Set the connection limit per listener explicitly for production. The default ceiling is high but accepting unbounded connections during a traffic spike can starve backend pools.

TIP

Use weighted backend pools when rolling out a new version. Start the new pool at 10% weight, watch error rates and latency, ramp up. Far safer than an all-or-nothing DNS flip.

Was this tool helpful?

Disclaimer: This tool runs entirely in your browser. No data is sent to our servers. Always verify outputs before using them in production. AWS, Azure, and GCP are trademarks of their respective owners.