Google Identity Aware Proxy with Internal load balancer - kubernetes

Question

Is it possible to add IAP on top of the internal load balancer?
In my setup I have:
Published and configured oauth screen as per https://cloud.google.com/iap/docs/enabling-kubernetes-howto#enabling_iap
Certificates for my internal domain
Kubernetes service setup with the backendConfig (as per https://cloud.google.com/iap/docs/enabling-kubernetes-howto#add-iap-to-backendconfig)
Application running in kubernetes
Kubernetes Ingress that creates internal load balancer with the proper ssl certificates
On my local machine i have /etc/hosts pointing to the load balancer.
I am able to authenticate when accessing the app but then i get "You don't have access" page instead of my application.
In my GCP console I can't see the internal load balancer listed on the IAP page. I can only see external load balancers.
As per this documentation https://cloud.google.com/iap/docs/concepts-overview#your_responsibilities it looks like IAP is supported with HTTPS ILB.
Is iLB with IAP supported on GCP?
My k8s config
apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
name: config-default
namespace: default
spec:
iap:
enabled: true
oauthclientCredentials:
secretName: my-secret
-------------------------------
apiVersion: v1
kind: Service
metadata:
name: ilb-service
annotations:
cloud.google.com/backend-config: '{"default": "config-default"}'
cloud.google.com/neg: '{"ingress": true}'
labels:
app: hello
spec:
type: NodePort
selector:
app: hello
ports:
- port: 80
targetPort: 8080
protocol: TCP
name: host1
- port: 443
targetPort: 8080
protocol: TCP
name: host2
--------------------------------
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: ilb-demo-ingress
namespace: default
annotations:
kubernetes.io/ingress.class: "gce-internal"
kubernetes.io/ingress.allow-http: "false"
ingress.gcp.kubernetes.io/pre-shared-cert: "titan-testing-ilb"
kubernetes.io/ingress.regional-static-ip-name: "my-internal-address"
spec:
defaultBackend:
service:
name: ilb-service
port:
number: 443
-------------------------------------------
apiVersion: apps/v1
kind: Deployment
metadata:
name: hello-app
spec:
selector:
matchLabels:
app: hello
replicas: 3
template:
metadata:
labels:
app: hello
spec:
containers:
- name: hello
image: "us-docker.pkg.dev/google-samples/containers/gke/hello-app:2.0"
ports:
- containerPort: 8080
protocol: TCP

Answer 1

User Type:
I have experienced the same issue at some point and it turned out that I had forgotten to set the user type to "external".
This is if you have managed to get past the login screen of OAuth.