<p>I have a GKE cluster that I'm working to get going on https load balancing.</p>
<p>So far I have:</p>
<ul>
<li>deployment</li>
<li>service (x 2 -- see below)</li>
<li>ingress</li>
<li>SSL cert -- google managed version</li>
</ul>
<p>All of these seem to be working, but I'm getting a 502 error when connecting to the hostname via https:</p>
<pre><code>Error: Server Error
The server encountered a temporary error and could not complete your request.
Please try again in 30 seconds.
</code></pre>
<p>When trying to trace this down I found <a href="https://cameron-manavian.medium.com/how-to-debug-a-502-on-kubernetes-c2b0bc1f7490" rel="nofollow noreferrer">a debugging post</a> but when combing through it I found that his ingress shows ports <strong>80,443</strong> ... while I can never get mine to show anything but port <strong>80</strong>.</p>
<p>This is even after I split my service into two different services, one on port 443 and one on port 80, and now am only telling the ingress about the 443 service and it <strong>still</strong> shows up with just port 80 and I'm <strong>still</strong> getting the 502 error.</p>
<p>The YAML for the deployment (asked by the commenter below):</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp-deployment
  labels:
    app: myapp
spec:
  replicas: 2
  selector:
    matchLabels:
      app: myapp
  template:
    metadata:
      labels:
        app: myapp
    spec:
      containers:
      - name: myapp
        image: gcr.io/myapp-dev/myapp-container:latest
        ports:
        - containerPort: 8080

</code></pre>
<p>The YAML for the '443 service':</p>
<pre><code>apiVersion: v1
kind: Service
metadata:
  name: my-service443
spec:
  type: NodePort
  selector:
    app: myapp
  ports:
    - name: https
      protocol: TCP
      port: 443
      targetPort: 8080
</code></pre>
<p>And the Ingress:</p>
<pre><code>apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: my-ingress
  annotations:
    # If the class annotation is not specified it defaults to &quot;gce&quot;.
    kubernetes.io/ingress.global-static-ip-name: &quot;kubething&quot;
    networking.gke.io/managed-certificates: clearspring-cert
    kubernetes.io/ingress.class: &quot;gce&quot;
spec:
  defaultBackend:
    service:
      name: my-service443
      port:
        name: https
</code></pre>
<p>I don't understand (a) why the ingress is showing only port 80 and why I'm still getting 502 errors.</p>
<p>Thanks much for any help whatsoever!</p>

Mark McWiggins
<p>It looks like it was missing readiness and liveness probes; when I changed the deployment like this:</p>
<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: cleardev-deployment
  labels:
    app: clearspring
spec:
  replicas: 2
  selector:
    matchLabels:
      app: clearspring
  template:
    metadata:
      labels:
        app: clearspring
    spec:
      containers:
      - name: clearspring
        image: gcr.io/clearspring-dev/clearspring-container:latest
        ports:
        - containerPort: 8080
        readinessProbe:
          tcpSocket:
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 10
        livenessProbe:
          tcpSocket:
            port: 8080
          initialDelaySeconds: 15
          periodSeconds: 20
</code></pre>
<p>Then the status changed from <strong>UNHEALTHY</strong> to <strong>Unknown</strong> ... but I was still getting the 502 error.</p>
<p>The liveness probe did its job: the procedure was not running on port 8080 on all hosts, just on 127.0.0.1. I fixed that ... still not working but tried <strong>EXPOSE 8080</strong> in the Dockerfile and now I guess I need to look at firewall rules because liveness/readiness probes can't connect.</p>
<p>Note that I had to delete and recreate the cluster to get this far ... I think. I just tried first updating the deployment and I didn't get any change from <strong>UNHEALTHY</strong>.</p>
