<p>I've got this issue in Google cloud once tried to create an ingress resource.</p>
<p>Usually when ingress is created, other GCP resources are automatically created too (resources such as target-https-proxies-list , urlmap , forwarding-rules , etc. ). Nothing was created this time and the Ingress error is here:</p>
<pre><code>k describe ingress my-service-internal
Name:             my-service-internal
Namespace:        my-namespace
Address:
Default backend:  default-http-backend:80 (10.0.0.5:8080)
Rules:
  Host                                     Path  Backends
  ----                                     ----  --------
  my-service.example.com
                                           /*   my-service-internal:80 (10.251.1.108:8080,10.251.1.134:8080)
Annotations:                               ingress.gcp.kubernetes.io/pre-shared-cert: my-certificate-202107140101
                                           kubernetes.io/ingress.allow-http: false
                                           kubernetes.io/ingress.class: gce-internal
Events:
  Type     Reason  Age                 From                     Message
  ----     ------  ----                ----                     -------
  Normal   Sync    97s (x2 over 97s)   loadbalancer-controller  Scheduled for sync
  Warning  Sync    16s (x14 over 73s)  loadbalancer-controller  Error syncing to GCP: error running backend syncing routine: cloud armor security policies not supported for regional backend service k8s1-263259a6-my-namespace-my-service-in-8-151d5ee9
</code></pre>
<p>Any advice what to check first or any guesses what could be the issue?</p>

laimison
<p>To elaborate a bit more on Dawids answer:</p>
<p>The reason for this is that cloud armor policies are only usable by <strong>external HTTP</strong> loadBalancers
as explained on <a href="https://cloud.google.com/armor/docs/security-policy-overview?hl=en#requirements" rel="nofollow noreferrer">Google's documentation.</a></p>
<p>So if you are configuring an <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/internal-load-balance-ingress?hl=en#requirements" rel="nofollow noreferrer">internal ingress on GKE</a> this creates an <strong>Internal HTTP</strong> LoadBalancer, which is not compatible with Cloud armor security policies</p>
