<p>I'm running into an issue:</p>
<p>Getting a health check to succeed for a .Net app running in an IIS Container when trying to use Container Native Load Balancing(CNLB).</p>
<p>I have a Network Endpoint Group(NEG) created by an Ingress resource definition in GKE with a VPC Native Cluster.</p>
<p>When I circumvent CNLB by either exposing the NodePort or making a service of type LoadBalancer, the site resolves without issue.</p>
<p>All the pod conditions from a describe look good:
<a href="https://i.stack.imgur.com/qwCM6.png" rel="nofollow noreferrer">pod readiness</a></p>
<p>The network endpoints show up when running <code>describe endpoints</code>: <a href="https://i.stack.imgur.com/hmJEw.png" rel="nofollow noreferrer">ready addresses</a></p>
<p>This is the health check that is generated by the load balancer: <a href="https://i.stack.imgur.com/3U33f.png" rel="nofollow noreferrer">GCP Health Check</a></p>
<p>When hitting these endpoints from other containers or VMs in the same VPC, /health.htm responds with a 200. Here's from a container in the same namespace, though I have reproduced this with a Linux VM, not in the cluster but in the same VPC: <a href="https://i.stack.imgur.com/8Iydz.png" rel="nofollow noreferrer">endpoint responds</a></p>
<p>But in spite of it all, the health check is reporting the pods in my NEG unhealthy: <a href="https://i.stack.imgur.com/7TVE6.png" rel="nofollow noreferrer">Unhealthy Endpoints</a></p>
<p>The stackdriver logs confirm the requests are timing out but I'm not sure why when the endpoints are responding to other instances but not the LB: <a href="https://i.stack.imgur.com/nTIx9.png" rel="nofollow noreferrer">Stackdriver Health Check Log</a></p>
<p>And I confirmed that GKE created what looks like the correct firewall rule that should allow traffic from the LB to the pods: <a href="https://i.stack.imgur.com/Jgcwu.png" rel="nofollow noreferrer">firewall</a></p>
<p>Here is the YAML I'm working with:</p>
<p>Deployment:</p>
<pre><code>apiVersion: apps/v1                                                  
kind: Deployment                                                     
metadata:                                                            
  labels:                                                            
    app: subdomain.domain.tld                                       
  name: subdomain-domain-tld                                       
  namespace: subdomain-domain-tld
spec:                                                                
  replicas: 3                                                        
  selector:                                                          
    matchLabels:                                                     
      app: subdomain.domain.tld                                     
  template:                                                          
    metadata:                                                        
      labels:                                                        
        app: subdomain.domain.tld
    spec:                                                            
      containers:                                                    
      - image: gcr.io/ourrepo/ourimage
        name: subdomain-domain-tld
        ports:                                                       
        - containerPort: 80                                          
        readinessProbe:                                              
          httpGet:                                                   
            path: /health.htm                                        
            port: 80                                                 
          initialDelaySeconds: 60                                    
          periodSeconds: 60                                          
          timeoutSeconds: 10                                         
        volumeMounts:                                                
        - mountPath: C:\some-secrets                                      
          name: some-secrets
      nodeSelector:                                                  
        kubernetes.io/os: windows                                    
      volumes:                                                       
      - name: some-secrets                                    
        secret:                                                      
          secretName: some-secrets

</code></pre>
<p>Service:</p>
<pre><code>apiVersion: v1                                                       
kind: Service                                                        
metadata:                                                            
  labels:                                                            
    app: subdomain.domain.tld                                     
  name: subdomain-domain-tld-service
  namespace: subdomain-domain-tld
spec:                                                                
  ports:                                                             
  - port: 80                                                         
    targetPort: 80                                                   
  selector:                                                          
    app: subdomain.domain.tld                                       
  type: NodePort                 
</code></pre>
<p>Ingress is extremely basic as we have no real need for multiple routes on this site, however, I'm suspecting whatever issues we're having are here.</p>
<pre><code>apiVersion: extensions/v1beta1                                       
kind: Ingress                                                        
metadata:                                                            
  annotations:                                                       
    kubernetes.io/ingress.class: gce
  labels:                                                            
    app: subdomain.domain.tld                                       
  name: subdomain-domain-tld-ingress
  namespace: subdomain-domain-tld
spec:                                                                
  backend:                                                           
    serviceName: subdomain-domain-tld-service
    servicePort: 80
</code></pre>
<p>Last somewhat relevant detail is I tried the steps present in this documentation and it worked but it's not identical to my situation as its not using Windows Containers nor Readiness Probes: <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/container-native-load-balancing#using-pod-readiness-feedback" rel="nofollow noreferrer">https://cloud.google.com/kubernetes-engine/docs/how-to/container-native-load-balancing#using-pod-readiness-feedback</a></p>
<p>Any suggestions would be greatly appreciated. I've spent two days stuck on this and I'm sure it's obvious but I just can't see the problem.</p>

<p>Apparently it's not documented but this functionality doesn't work with Windows containers at the time of writing. I was able to get in touch with a GCP Engineer and they provided the following:</p>
<blockquote>
<p>After further investigation, I have found that Windows containers using LoadBalancer service works but, Windows containers using Ingress with NEGS is a limitation so, I have opened an internal case for updating the public documentation [1].</p>
<p>Since, Ingress + NEG will not work (per the limitation), I suggest you to use any option you mentioned either exposing the NodePort or making a service of type LoadBalancer.</p>
</blockquote>
