<p>i have a GKE cluster with FastAPI service, i tried to install certificate with &quot;google managed certificate&quot; so i can access it through https. Certificate installation is working as expected and i can access it with https, but i got problem when i try to access my api, it return me 502 with this error:</p>
<p>Error: Server Error
The server encountered a temporary error and could not complete your request.
Please try again in 30 seconds.</p>
<p>I already wait it for a long time but it just didn't fixed, i thing there is something wrong with the routing but i already tried many thing and still confused why it still didn't work. i also already tried documentation provide from google <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/managed-certs" rel="nofollow noreferrer">Using Google-managed SSL certificates</a> but still got 502.</p>
<p>Below is all my yaml files related to this case:</p>
<p>deployment.yaml</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: noctis-stg
spec:
  replicas: 1
  selector:
    matchLabels:
      app: noctis-stg
  template:
    metadata:
      labels:
        app: noctis-stg
    spec:
      containers:
      - name: noctis-stg
        image: asia-southeast1-docker.pkg.dev/#####/######/#######:#####
        ports:
        - containerPort: 80
        volumeMounts:
        - name: noctis-stg-env
          mountPath: /code/.env
          subPath: .env
      volumes:
      - name: noctis-stg-env
        configMap:
          name: noctis-stg-env

</code></pre>
<p>service.yaml</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: noctis-stg
spec:
  type: NodePort
  selector:
    app: noctis-stg
  ports:
  - protocol: TCP
    port: 80
    targetPort: 80

</code></pre>
<p>managed-cert.yaml</p>
<pre><code>apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
  name: managed-cert-stg
spec:
  domains:
    - stg.noctis.test-domain.com

</code></pre>
<p>managed-cert-ingress.yaml</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: managed-cert-ingress
  annotations:
    kubernetes.io/ingress.global-static-ip-name: global-noctis-stg
    networking.gke.io/managed-certificates: managed-cert-stg
    kubernetes.io/ingress.class: &quot;gce&quot;
spec:
  tls:
  - secretName: tls-secret-stg
  rules:
  - host: stg.noctis.test-domain.com
    http:
      paths:
      - path: /*
        pathType: ImplementationSpecific
        backend:
          service:
              name: noctis-stg
              port:
                number: 80

</code></pre>
<p>It would really great if anyone could help me to solve this.</p>

Akhdan Rasiq
<p>This error occurs mainly when Ingress backend is <code>unhealthy</code> or <code>failed to pick backend</code>, you can find then in logs,below troubleshooting steps can help to resolve your issue:</p>
<ol>
<li>When creating a GKE ingress, change the service type to <code>NodePort</code>.</li>
</ol>
<p>2.Check the firewall rule is configured correctly.</p>
<p>For ingress follow this <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/ingress" rel="nofollow noreferrer">documentation</a>,  If you are using external ingress follow <a href="https://cloud.google.com/kubernetes-engine/docs/troubleshooting/troubleshoot-load-balancing#ingress-502s" rel="nofollow noreferrer">External Ingress produces HTTP 502 errors</a>.</p>
<p>If you find logs with error <code>backend_connection_closed_before_data_sent_to_client</code>,</p>
<p>You must configure the web server software used by your backends so that its keepalive timeout is longer than 600 seconds to prevent connections from being closed prematurely by the backend. Refer to the <a href="https://cloud.google.com/load-balancing/docs/https#timeouts_and_retries" rel="nofollow noreferrer">documentation</a> which describes the External HTTP(S) Load Balancing has two distinct types of timeouts and this other <a href="https://cloud.google.com/load-balancing/docs/https/https-logging-monitoring#statusdetails_http_failure_messages" rel="nofollow noreferrer">documentation</a> regarding the messages we are having on your logs.</p>
<p>For more troubleshooting steps on 502 errors follow this <a href="https://cloud.google.com/load-balancing/docs/https/troubleshooting-ext-https-lbs#unexplained_5xx_errors" rel="nofollow noreferrer">official documentation</a>.</p>
