GKE Ingress: Some backend services are in UNHEALTHY state / 502 Server Error from the load balancer
The Google load balancer's health checks fail for the Ingress backends, so it returns 502 or 'no healthy upstream'.
Some backend services are in UNHEALTHY stateingress.kubernetes.io/backends UNHEALTHY502 Server Error The server encountered a temporary error and could not complete your request GKE ingressbackend_service UNHEALTHY GKEGKE Ingress health check failing Meaning
GKE creates a health check from the readiness probe or the / path. If the app returns non-200 on /, listens on a different port, or the firewall blocks Google's health-check ranges (130.211.0.0/22, 35.191.0.0/16), the backend stays unhealthy. Configure a BackendConfig with the correct path/port and ensure the Service is NEG-enabled.
Common causes
- App returns 301/404 on the health check path
- Readiness probe path/port differs from the app
- Firewall blocking health check ranges
- Service port/targetPort mismatch
- Pods not Ready
⚡ Quick fix
- Add a
BackendConfigwithhealthCheck.requestPath - Fix readiness probe and Service ports
- Allow 130.211.0.0/22 and 35.191.0.0/16 in firewall rules
Detailed fix by platform
kubectl
kubectl describe ingress NAMEshowsingress.kubernetes.io/backends: {"k8s1-...":"UNHEALTHY"}
Code examples
Custom health check
apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata: { name: app-backendconfig }
spec:
healthCheck:
type: HTTP
requestPath: /healthz
port: 8080How to diagnose
- Backends — UNHEALTHY annotation?
- Path — Returns 200?
- Firewall — Ranges allowed?
🔧 Still not fixed?
Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:
Similar errors
- 502 Bad Gateway: failed_to_connect_to_backend Google Cloud Load Balancing: 502 Bad Gateway — jsonPayload.statusDetails: failed_to_connect_to_backend / backend_connection_closed_before_data_sent_to_client
- admission webhook denied the request Error from server: admission webhook "validate.nginx.ingress.kubernetes.io" denied the request
- Cloud Run 503: The request failed because the instance had an error Cloud Run: 503 Service Unavailable — The request was aborted because there was no available instance
Most viewed in Google Cloud / Firebase
- Missing or insufficient permissions Firestore: FirebaseError: [code=permission-denied]: Missing or insufficient permissions
- Container failed to start Cloud Run: The user-provided container failed to start and listen on the port defined provided by the PORT=8080 environment variable
- Could not load the default credentials Google Cloud: Error: Could not load the default credentials. Browse to https://cloud.google.com/docs/authentication/getting-started
Other ways to find it
Where this error sits
Origin: Platform & cloud. Errors that are often confused with or caused by this one (click to open):
🧠 Still stuck? Analyze your error
Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.
💬 What worked for others
No tips yet — did something else fix this for you?
Share what worked for you
Tips are checked by an editor before they appear. Links are removed.
Report a correction or suggest an improvement
Last updated 4 Nov 2026