# GKE Ingress: Some backend services are in UNHEALTHY state / 502 Server Error from the load balancer

**Code:** `GKE Ingress: backends marked UNHEALTHY (502)` · **Category:** Google Cloud / Firebase · **Seen on:** Google Cloud, Kubernetes

The Google load balancer's health checks fail for the Ingress backends, so it returns 502 or 'no healthy upstream'.

## Meaning

GKE creates a health check from the readiness probe or the `/` path. If the app returns non-200 on `/`, listens on a different port, or the firewall blocks Google's health-check ranges (130.211.0.0/22, 35.191.0.0/16), the backend stays unhealthy. Configure a `BackendConfig` with the correct path/port and ensure the Service is NEG-enabled.

## Common causes

- App returns 301/404 on the health check path
- Readiness probe path/port differs from the app
- Firewall blocking health check ranges
- Service port/targetPort mismatch
- Pods not Ready

## Quick fix

1. Add a `BackendConfig` with `healthCheck.requestPath`
2. Fix readiness probe and Service ports
3. Allow 130.211.0.0/22 and 35.191.0.0/16 in firewall rules

## Detailed fix by platform

### kubectl

1. `kubectl describe ingress NAME` shows `ingress.kubernetes.io/backends: {"k8s1-...":"UNHEALTHY"}`

## Code examples

### Custom health check

```yaml
apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata: { name: app-backendconfig }
spec:
  healthCheck:
    type: HTTP
    requestPath: /healthz
    port: 8080
```

## How to diagnose

1. **Backends** — UNHEALTHY annotation?
2. **Path** — Returns 200?
3. **Firewall** — Ranges allowed?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/gcp/gke-ingress-backend-unhealthy)