@spinnaker/google 2026.3.2 → 2026.4.1

package/src/loadBalancer/configure/http/GceHttpLoadBalancerEditor.tsx

@@ -26,8 +26,11 @@ export interface IGceHttpLoadBalancerEditorProps {
 
 interface IGceHttpLoadBalancerDataItem extends IGceLoadBalancerDataItem {
   account?: string;
+  address?: string;
+  addressType?: string;
   id?: string;
   network?: string;
+  purpose?: string;
   region?: string;
 }
 
@@ -63,11 +66,35 @@ export function buildGceHttpLoadBalancerOptions(
   data: IGceLoadBalancerData,
 ): IGceHttpLoadBalancerOptions {
   const internal = command.loadBalancerType === 'INTERNAL_MANAGED';
+  const externalManaged = command.loadBalancerType === 'EXTERNAL_MANAGED';
   const accountMatches = (item: IGceHttpLoadBalancerDataItem): boolean => item.account === command.credentials;
-  const locationMatches = (item: IGceHttpLoadBalancerDataItem): boolean =>
-    accountMatches(item) &&
-    (internal ? item.region === command.region : item.region === undefined || item.region === 'global');
+  const locationMatches = (item: IGceHttpLoadBalancerDataItem): boolean => {
+    if (!accountMatches(item)) {
+      return false;
+    }
+    if (internal || externalManaged) {
+      return item.region === command.region;
+    }
+    return item.region === undefined || item.region === 'global';
+  };
+  const addressMatches = (item: IGceHttpLoadBalancerDataItem): boolean =>
+    locationMatches(item) && (!externalManaged || item.addressType === 'EXTERNAL');
   const networks = (data.networks as IGceHttpLoadBalancerDataItem[]).filter(accountMatches);
+  const proxyNetworkIds = new Set(
+    (data.subnets as IGceHttpLoadBalancerDataItem[])
+      .filter(
+        (subnet) =>
+          accountMatches(subnet) && subnet.region === command.region && subnet.purpose === 'REGIONAL_MANAGED_PROXY',
+      )
+      .map((subnet) => subnet.network)
+      .filter(Boolean),
+  );
+  const eligibleNetworks = externalManaged
+    ? networks.filter(
+        (network) =>
+          isAccountLocalNetwork(network) && (proxyNetworkIds.has(network.id) || proxyNetworkIds.has(network.name)),
+      )
+    : networks;
   const selectedNetwork = networks.find(
     (network) => network.name === command.network?.name || network.id === command.network?.name,
   );
@@ -83,7 +110,7 @@ export function buildGceHttpLoadBalancerOptions(
   return {
     accounts: mergeGceResourceOptions(data.accounts, command.credentials ? [{ name: command.credentials }] : []),
     addresses: mergeGceResourceOptions(
-      (data.addresses as IGceHttpLoadBalancerDataItem[]).filter(locationMatches),
+      (data.addresses as IGceHttpLoadBalancerDataItem[]).filter(addressMatches),
       uniqueOptions(command.listeners.flatMap((listener) => (listener.address ? [listener.address] : []))),
     ),
     backendServices: mergeGceResourceOptions(
@@ -102,7 +129,7 @@ export function buildGceHttpLoadBalancerOptions(
       (data.healthChecks as IGceHttpLoadBalancerDataItem[]).filter(locationMatches),
       uniqueOptions([...command.healthChecks, ...backendHealthChecks]),
     ),
-    networks: mergeGceResourceOptions(networks, command.network ? [command.network] : []),
+    networks: mergeGceResourceOptions(eligibleNetworks, command.network ? [command.network] : []),
     regions: mergeGceResourceOptions(data.regions, command.region ? [{ name: command.region }] : []),
     subnets: mergeGceResourceOptions(
       internal
@@ -119,25 +146,51 @@ export function buildGceHttpLoadBalancerOptions(
 }
 
 export function constrainGceHttpLoadBalancerCommand(command: IGceLoadBalancerCommand): IGceLoadBalancerCommand {
-  const constrainListener = ({ subnet, ...listener }: IGceLoadBalancerListener, keepSubnet: boolean) => {
+  const constrainListener = (
+    { subnet, networkTier, ...listener }: IGceLoadBalancerListener,
+    keepSubnet: boolean,
+    keepNetworkTier: boolean,
+  ) => {
+    const constrainedNetworkTier =
+      keepNetworkTier && (networkTier || (listener.address?.networkTier as string | undefined) || 'PREMIUM');
     if (listener.protocol === 'HTTPS') {
-      return { ...listener, portRange: '443', protocol: 'HTTPS' as const, ...(keepSubnet && subnet ? { subnet } : {}) };
+      return {
+        ...listener,
+        portRange: '443',
+        protocol: 'HTTPS' as const,
+        ...(keepSubnet && subnet ? { subnet } : {}),
+        ...(constrainedNetworkTier ? { networkTier: constrainedNetworkTier } : {}),
+      };
     }
-    const { certificate: _certificate, ...plaintextListener } = listener;
-    return { ...plaintextListener, protocol: 'HTTP' as const, ...(keepSubnet && subnet ? { subnet } : {}) };
+    const { certificate: _certificate, certificateMap: _certificateMap, ...plaintextListener } = listener;
+    return {
+      ...plaintextListener,
+      protocol: 'HTTP' as const,
+      ...(keepSubnet && subnet ? { subnet } : {}),
+      ...(constrainedNetworkTier ? { networkTier: constrainedNetworkTier } : {}),
+    };
   };
 
   if (command.loadBalancerType === 'INTERNAL_MANAGED') {
     return {
       ...command,
-      listeners: command.listeners.map((listener) => constrainListener(listener, true)),
+      listeners: command.listeners.map((listener) => constrainListener(listener, true, false)),
       region: command.region === 'global' ? '' : command.region,
     };
   }
 
+  if (command.loadBalancerType === 'EXTERNAL_MANAGED') {
+    return {
+      ...command,
+      listeners: command.listeners.map((listener) => constrainListener(listener, false, true)),
+      region: command.region === 'global' ? '' : command.region,
+      subnet: undefined,
+    };
+  }
+
   return {
     ...command,
-    listeners: command.listeners.map((listener) => constrainListener(listener, false)),
+    listeners: command.listeners.map((listener) => constrainListener(listener, false, false)),
     loadBalancerType: 'HTTP',
     network: undefined,
     region: 'global',
@@ -148,15 +201,21 @@ export function constrainGceHttpLoadBalancerCommand(command: IGceLoadBalancerCom
 export function validateGceHttpLoadBalancerCommand(command: IGceLoadBalancerCommand): string[] {
   const errors = new Set<string>();
   const internal = command.loadBalancerType === 'INTERNAL_MANAGED';
+  const externalManaged = command.loadBalancerType === 'EXTERNAL_MANAGED';
 
   if (!command.name.trim()) errors.add('Name is required.');
   if (!command.credentials) errors.add('Account is required.');
-  if (internal) {
+  if (internal || externalManaged) {
     if (!command.region || command.region === 'global') {
-      errors.add('Region is required for INTERNAL_MANAGED load balancers.');
+      errors.add(`Region is required for ${internal ? 'INTERNAL_MANAGED' : 'EXTERNAL_MANAGED'} load balancers.`);
+    }
+    if (!command.network?.name) {
+      errors.add(`Network is required for ${internal ? 'INTERNAL_MANAGED' : 'EXTERNAL_MANAGED'} load balancers.`);
     }
-    if (!command.network?.name) errors.add('Network is required for INTERNAL_MANAGED load balancers.');
-    if (!command.subnet?.name) errors.add('Subnet is required for INTERNAL_MANAGED load balancers.');
+    if (externalManaged && command.network && !isAccountLocalNetwork(command.network)) {
+      errors.add('Shared VPC networks are not supported for EXTERNAL_MANAGED load balancers.');
+    }
+    if (internal && !command.subnet?.name) errors.add('Subnet is required for INTERNAL_MANAGED load balancers.');
   } else if (command.region !== 'global') {
     errors.add('HTTP load balancers must use the global location.');
   }
@@ -176,6 +235,24 @@ export function validateGceHttpLoadBalancerCommand(command: IGceLoadBalancerComm
     if (listener.protocol === 'HTTPS' && listener.portRange !== '443') {
       errors.add('HTTPS listeners must use port 443.');
     }
+    if (externalManaged && listener.certificateMap) {
+      errors.add('Certificate maps are not supported for EXTERNAL_MANAGED load balancers.');
+    }
+    if (externalManaged && listener.address?.networkTier && listener.networkTier !== listener.address.networkTier) {
+      errors.add('Reserved IP address network tier must match the listener network tier.');
+    }
+    if (externalManaged && command.mode === 'edit') {
+      const original = command.original?.listeners.find(({ name }) => name === listener.name);
+      if (
+        original &&
+        (listener.portRange !== original.portRange ||
+          referenceIdentity(listener.address) !== referenceIdentity(original.address) ||
+          listener.networkTier !== original.networkTier ||
+          listener.protocol !== original.protocol)
+      ) {
+        errors.add('Rename the listener to change its port, address, network tier, or HTTP/HTTPS protocol.');
+      }
+    }
   });
 
   if (!command.backendServices.length) errors.add('At least one backend service is required.');
@@ -183,6 +260,9 @@ export function validateGceHttpLoadBalancerCommand(command: IGceLoadBalancerComm
     if (!backendService.name.trim()) errors.add('Backend service name is required.');
     if (!backendService.healthCheck?.name) errors.add('Each backend service requires a health check.');
     if (!backendService.portName) errors.add('Backend service port name is required.');
+    if (externalManaged && !['HTTP', 'HTTPS'].includes(String(backendService.protocol || 'HTTP'))) {
+      errors.add('Backend service protocol must be HTTP or HTTPS.');
+    }
     if (negative(backendService.connectionDrainingTimeoutSec)) {
       errors.add('Connection draining timeout must be zero or greater.');
     }
@@ -240,6 +320,14 @@ function validPort(value: unknown): boolean {
   return Number.isInteger(port) && port >= 1 && port <= 65535;
 }
 
+function isAccountLocalNetwork(reference: { id?: unknown; name?: unknown; selfLink?: unknown }): boolean {
+  return !/^[^/]+\/[^/]+$/.test(String(reference.id || reference.selfLink || reference.name || ''));
+}
+
+function referenceIdentity(reference: IGceResourceReference | undefined): string {
+  return String(reference?.selfLink || reference?.name || '');
+}
+
 function negative(value: unknown): boolean {
   return value !== undefined && Number(value) < 0;
 }
@@ -268,6 +356,13 @@ export function GceHttpLoadBalancerEditor({ command, data, onChange }: IGceHttpL
   const update = (updates: Partial<IGceLoadBalancerCommand>): void => {
     onChange(constrainGceHttpLoadBalancerCommand({ ...command, ...updates } as IGceLoadBalancerCommand));
   };
+  // EXTERNAL_MANAGED reserved addresses belong to one account and region, so a scope change drops them.
+  const updateScope = (updates: Partial<IGceLoadBalancerCommand>): void =>
+    update(
+      command.loadBalancerType === 'EXTERNAL_MANAGED'
+        ? { ...updates, listeners: command.listeners.map((listener) => ({ ...listener, address: undefined })) }
+        : updates,
+    );
 
   const updateBackendService = (
     index: number,
@@ -342,6 +437,7 @@ export function GceHttpLoadBalancerEditor({ command, data, onChange }: IGceHttpL
           >
             <option value="HTTP">HTTP(S)</option>
             <option value="INTERNAL_MANAGED">Internal managed HTTP</option>
+            <option value="EXTERNAL_MANAGED">External managed HTTP(S)</option>
           </select>
         </FormRow>
         <FormRow label="Account">
@@ -351,7 +447,7 @@ export function GceHttpLoadBalancerEditor({ command, data, onChange }: IGceHttpL
             disabled={editing}
             required
             value={command.credentials}
-            onChange={(event) => update({ credentials: event.target.value })}
+            onChange={(event) => updateScope({ credentials: event.target.value })}
           >
             <option value="">Select...</option>
             {options.accounts.map((account) => (
@@ -361,7 +457,7 @@ export function GceHttpLoadBalancerEditor({ command, data, onChange }: IGceHttpL
             ))}
           </select>
         </FormRow>
-        {command.loadBalancerType === 'INTERNAL_MANAGED' && (
+        {(command.loadBalancerType === 'INTERNAL_MANAGED' || command.loadBalancerType === 'EXTERNAL_MANAGED') && (
           <React.Fragment>
             <FormRow label="Region">
               <select
@@ -370,7 +466,7 @@ export function GceHttpLoadBalancerEditor({ command, data, onChange }: IGceHttpL
                 disabled={editing}
                 required
                 value={command.region}
-                onChange={(event) => update({ region: event.target.value })}
+                onChange={(event) => updateScope({ region: event.target.value })}
               >
                 <option value="">Select...</option>
                 {options.regions.map((region) => (
@@ -384,6 +480,7 @@ export function GceHttpLoadBalancerEditor({ command, data, onChange }: IGceHttpL
               <select
                 className="form-control input-sm"
                 data-testid="network"
+                disabled={editing && command.loadBalancerType === 'EXTERNAL_MANAGED'}
                 required
                 value={command.network?.name || ''}
                 onChange={(event) => update({ network: selectedReference(event.target.value, options.networks) })}
@@ -396,28 +493,30 @@ export function GceHttpLoadBalancerEditor({ command, data, onChange }: IGceHttpL
                 ))}
               </select>
             </FormRow>
-            <FormRow label="Subnet">
-              <select
-                className="form-control input-sm"
-                data-testid="subnet"
-                required
-                value={command.subnet?.name || ''}
-                onChange={(event) => {
-                  const subnet = selectedReference(event.target.value, options.subnets);
-                  update({
-                    subnet,
-                    listeners: command.listeners.map((listener) => ({ ...listener, subnet })),
-                  });
-                }}
-              >
-                <option value="">Select...</option>
-                {options.subnets.map((subnet) => (
-                  <option key={subnet.name} value={subnet.name}>
-                    {subnet.name}
-                  </option>
-                ))}
-              </select>
-            </FormRow>
+            {command.loadBalancerType === 'INTERNAL_MANAGED' && (
+              <FormRow label="Subnet">
+                <select
+                  className="form-control input-sm"
+                  data-testid="subnet"
+                  required
+                  value={command.subnet?.name || ''}
+                  onChange={(event) => {
+                    const subnet = selectedReference(event.target.value, options.subnets);
+                    update({
+                      subnet,
+                      listeners: command.listeners.map((listener) => ({ ...listener, subnet })),
+                    });
+                  }}
+                >
+                  <option value="">Select...</option>
+                  {options.subnets.map((subnet) => (
+                    <option key={subnet.name} value={subnet.name}>
+                      {subnet.name}
+                    </option>
+                  ))}
+                </select>
+              </FormRow>
+            )}
           </React.Fragment>
         )}
       </section>
@@ -479,7 +578,15 @@ export function GceHttpLoadBalancerEditor({ command, data, onChange }: IGceHttpL
           className="add-new btn btn-block"
           onClick={() =>
             update({
-              backendServices: [...command.backendServices, { name: '', portName: 'http', sessionAffinity: 'NONE' }],
+              backendServices: [
+                ...command.backendServices,
+                {
+                  name: '',
+                  portName: 'http',
+                  ...(command.loadBalancerType === 'EXTERNAL_MANAGED' ? { protocol: 'HTTP' as const } : {}),
+                  sessionAffinity: 'NONE',
+                },
+              ],
             })
           }
         >

package/src/loadBalancer/configure/http/GceHttpLoadBalancerListenerEditor.spec.tsx

@@ -1,12 +1,13 @@
+import { fireEvent, render, within } from '@testing-library/react';
 import React from 'react';
-import { shallow } from 'enzyme';
 
 import { GceHttpLoadBalancerListenerEditor } from './GceHttpLoadBalancerListenerEditor';
+import { buildGceLoadBalancerJobs } from '../common';
 
 describe('GceHttpLoadBalancerListenerEditor', () => {
   it('edits listener addresses and certificates without submitting the parent form', () => {
-    const onChange = jasmine.createSpy('onChange');
-    const wrapper = shallow(
+    const onChange = vi.fn();
+    const { getByTestId, getAllByRole } = render(
       <GceHttpLoadBalancerListenerEditor
         addresses={[{ name: 'removed-address', selfLink: 'https://compute/addresses/removed-address' }]}
         certificates={[{ name: 'removed-cert', selfLink: 'https://compute/certificates/removed-cert' }]}
@@ -19,27 +20,23 @@ describe('GceHttpLoadBalancerListenerEditor', () => {
         }}
         loadBalancerType="HTTP"
         onChange={onChange}
-        onRemove={jasmine.createSpy('onRemove')}
+        onRemove={vi.fn()}
         subnets={[]}
       />,
     );
 
-    expect(wrapper.find('[data-testid="listener-address"] option').map((option) => option.prop('value'))).toContain(
-      'removed-address',
-    );
-    expect(wrapper.find('[data-testid="listener-certificate"] option').map((option) => option.prop('value'))).toContain(
-      'removed-cert',
-    );
-    expect(wrapper.find('button').everyWhere((button) => button.prop('type') === 'button')).toBe(true);
+    expect(optionValues(getByTestId('listener-address'))).toContain('removed-address');
+    expect(optionValues(getByTestId('listener-certificate'))).toContain('removed-cert');
+    expect(getAllByRole('button').every((button) => button.getAttribute('type') === 'button')).toBe(true);
 
-    wrapper.find('[data-testid="listener-address"]').simulate('change', { target: { value: '' } });
+    fireEvent.change(getByTestId('listener-address'), { target: { value: '' } });
     expect(onChange).toHaveBeenCalledWith(
-      jasmine.objectContaining({ address: undefined, certificate: jasmine.any(Object), name: 'frontend' }),
+      expect.objectContaining({ address: undefined, certificate: expect.any(Object), name: 'frontend' }),
     );
   });
 
   it('supports HTTPS certificates for INTERNAL_MANAGED listeners', () => {
-    const wrapper = shallow(
+    const { getByTestId } = render(
       <GceHttpLoadBalancerListenerEditor
         addresses={[]}
         certificates={[{ name: 'regional-cert' }]}
@@ -51,44 +48,180 @@ describe('GceHttpLoadBalancerListenerEditor', () => {
           subnet: { name: 'subnet-a' },
         }}
         loadBalancerType="INTERNAL_MANAGED"
-        onChange={jasmine.createSpy('onChange')}
-        onRemove={jasmine.createSpy('onRemove')}
+        onChange={vi.fn()}
+        onRemove={vi.fn()}
         subnets={[{ name: 'subnet-a' }]}
       />,
     );
 
-    expect(wrapper.find('[data-testid="listener-protocol"] option').map((option) => option.prop('value'))).toEqual([
-      'HTTP',
-      'HTTPS',
-    ]);
-    expect(wrapper.find('[data-testid="listener-certificate"]').prop('value')).toBe('regional-cert');
+    expect(optionValues(getByTestId('listener-protocol'))).toEqual(['HTTP', 'HTTPS']);
+    expect(getByTestId('listener-certificate')).toHaveValue('regional-cert');
   });
 
   (['HTTP', 'INTERNAL_MANAGED'] as const).forEach((loadBalancerType) => {
     it(`sets and locks port 443 for ${loadBalancerType} HTTPS listeners`, () => {
-      const onChange = jasmine.createSpy('onChange');
-      const wrapper = shallow(
+      const onChange = vi.fn();
+      const props = {
+        addresses: [],
+        certificates: [{ name: 'cert-a' }],
+        listener: { name: 'frontend', portRange: '80', protocol: 'HTTP' as const },
+        loadBalancerType,
+        onChange,
+        onRemove: vi.fn(),
+        subnets: [],
+      };
+      const { getByTestId, rerender } = render(<GceHttpLoadBalancerListenerEditor {...props} />);
+
+      fireEvent.change(getByTestId('listener-protocol'), { target: { value: 'HTTPS' } });
+
+      expect(onChange).toHaveBeenCalledWith(
+        expect.objectContaining({ name: 'frontend', portRange: '443', protocol: 'HTTPS' }),
+      );
+
+      rerender(
         <GceHttpLoadBalancerListenerEditor
-          addresses={[]}
-          certificates={[{ name: 'cert-a' }]}
+          {...props}
+          listener={{ certificate: { name: 'cert-a' }, name: 'frontend', portRange: '443', protocol: 'HTTPS' }}
+        />,
+      );
+      expect(getByTestId('listener-port')).toBeDisabled();
+    });
+  });
+
+  it('edits EXTERNAL_MANAGED listener addresses, certificates, and network tier', () => {
+    const onChange = vi.fn();
+    const { getByLabelText, getByTestId } = render(
+      <GceHttpLoadBalancerListenerEditor
+        addresses={[{ address: '203.0.113.10', name: 'external-address' }]}
+        certificates={[
+          {
+            name: 'regional-cert',
+            selfLink:
+              '//certificatemanager.googleapis.com/projects/test/locations/europe-west1/certificates/regional-cert',
+          },
+        ]}
+        listener={{
+          address: { name: 'external-address', address: '203.0.113.10' },
+          certificate: {
+            name: 'regional-cert',
+            selfLink:
+              '//certificatemanager.googleapis.com/projects/test/locations/europe-west1/certificates/regional-cert',
+          },
+          name: 'app-https',
+          networkTier: 'STANDARD',
+          portRange: '443',
+          protocol: 'HTTPS',
+        }}
+        loadBalancerType="EXTERNAL_MANAGED"
+        onChange={onChange}
+        onRemove={vi.fn()}
+        subnets={[]}
+      />,
+    );
+
+    expect(optionValues(getByTestId('listener-address'))).toContain('external-address');
+    expect(optionValues(getByTestId('listener-certificate'))).toContain('regional-cert');
+    const networkTier = getByLabelText('Network tier');
+    expect(networkTier).toHaveValue('STANDARD');
+
+    fireEvent.change(networkTier, { target: { value: 'PREMIUM' } });
+    expect(onChange).toHaveBeenCalledWith(expect.objectContaining({ networkTier: 'PREMIUM' }));
+  });
+
+  it('does not expose certificate map controls for EXTERNAL_MANAGED listeners', () => {
+    const { queryByLabelText, queryByTestId } = render(
+      <GceHttpLoadBalancerListenerEditor
+        addresses={[]}
+        certificates={[{ name: 'regional-cert' }]}
+        listener={{ name: 'frontend', portRange: '443', protocol: 'HTTPS' }}
+        loadBalancerType="EXTERNAL_MANAGED"
+        onChange={vi.fn()}
+        onRemove={vi.fn()}
+        subnets={[]}
+      />,
+    );
+
+    expect(queryByTestId('listener-certificate-map')).not.toBeInTheDocument();
+    expect(queryByLabelText('Certificate map')).not.toBeInTheDocument();
+  });
+
+  it('accepts a direct Certificate Manager URL while preserving selectable Compute certificates', () => {
+    const onChange = vi.fn();
+    const certificateUrl =
+      '//certificatemanager.googleapis.com/projects/test/locations/europe-west1/certificates/manager-cert';
+    const props = {
+      addresses: [],
+      certificates: [{ name: 'compute-cert', selfLink: 'https://compute/sslCertificates/compute-cert' }],
+      listener: { name: 'external-https', portRange: '443', protocol: 'HTTPS' as const },
+      loadBalancerType: 'EXTERNAL_MANAGED' as const,
+      onChange,
+      onRemove: vi.fn(),
+      subnets: [],
+    };
+    const { getByLabelText, getByTestId, rerender } = render(<GceHttpLoadBalancerListenerEditor {...props} />);
+
+    expect(optionValues(getByTestId('listener-certificate'))).toContain('compute-cert');
+    fireEvent.change(getByTestId('listener-certificate'), { target: { value: 'compute-cert' } });
+    const computeListener = onChange.mock.lastCall[0];
+    expect(computeListener.certificate).toEqual({
+      name: 'compute-cert',
+      selfLink: 'https://compute/sslCertificates/compute-cert',
+    });
+    rerender(<GceHttpLoadBalancerListenerEditor {...props} listener={computeListener} />);
+    expect(getByTestId('listener-certificate-manager-url')).toHaveValue('');
+
+    const certificateUrlInput = getByLabelText('Certificate Manager resource URL');
+    expect(certificateUrlInput).toBe(getByTestId('listener-certificate-manager-url'));
+    fireEvent.change(certificateUrlInput, { target: { value: '//certificate' } });
+    rerender(<GceHttpLoadBalancerListenerEditor {...props} listener={onChange.mock.lastCall[0]} />);
+    expect(getByTestId('listener-certificate-manager-url')).toHaveValue('//certificate');
+
+    fireEvent.change(getByTestId('listener-certificate-manager-url'), { target: { value: certificateUrl } });
+
+    const listener = onChange.mock.lastCall[0];
+    expect(listener.certificate).toEqual({ name: 'manager-cert', selfLink: certificateUrl });
+    expect(listener.certificateMap).toBeUndefined();
+
+    const operations = buildGceLoadBalancerJobs({
+      backendServices: [{ healthCheck: { name: 'check-a' }, name: 'backend-a', portName: 'http' }],
+      credentials: 'account-a',
+      defaultService: { name: 'backend-a' },
+      healthChecks: [{ healthCheckType: 'HTTPS', name: 'check-a', port: 443, requestPath: '/health' }],
+      hostRules: [],
+      listeners: [listener],
+      loadBalancerType: 'EXTERNAL_MANAGED',
+      mode: 'pipeline',
+      name: 'app-main',
+      network: { name: 'default' },
+      region: 'europe-west1',
+    } as any);
+    expect(operations[0].certificate).toBe(certificateUrl);
+    expect(operations[0].certificateMap).toBeUndefined();
+  });
+
+  (['HTTP', 'INTERNAL_MANAGED'] as const).forEach((loadBalancerType) => {
+    it(`does not propagate address networkTier for ${loadBalancerType} listeners`, () => {
+      const onChange = vi.fn();
+      const { getByTestId } = render(
+        <GceHttpLoadBalancerListenerEditor
+          addresses={[{ address: '203.0.113.10', name: 'external-address', networkTier: 'STANDARD' }]}
+          certificates={[]}
           listener={{ name: 'frontend', portRange: '80', protocol: 'HTTP' }}
           loadBalancerType={loadBalancerType}
           onChange={onChange}
-          onRemove={jasmine.createSpy('onRemove')}
+          onRemove={vi.fn()}
           subnets={[]}
         />,
       );
 
-      wrapper.find('[data-testid="listener-protocol"]').simulate('change', { target: { value: 'HTTPS' } });
-
-      expect(onChange).toHaveBeenCalledWith(
-        jasmine.objectContaining({ name: 'frontend', portRange: '443', protocol: 'HTTPS' }),
-      );
-
-      wrapper.setProps({
-        listener: { certificate: { name: 'cert-a' }, name: 'frontend', portRange: '443', protocol: 'HTTPS' },
-      });
-      expect(wrapper.find('[data-testid="listener-port"]').prop('disabled')).toBe(true);
+      fireEvent.change(getByTestId('listener-address'), { target: { value: 'external-address' } });
+      expect(onChange.mock.lastCall[0].networkTier).toBeUndefined();
     });
   });
 });
+
+function optionValues(select: HTMLElement): string[] {
+  return within(select)
+    .getAllByRole('option')
+    .map((option) => (option as HTMLOptionElement).value);
+}