Networking · 2 steps

502 and 503 from the proxy

The two codes mean different things: 502 is a broken conversation with a backend, 503 is having no backend to talk to.

Every step

Separate the two codes

They are produced at different points. 503 usually means the proxy has no healthy backend at all. 502 means it reached one and the conversation broke. Treating them as the same failure wastes the first ten minutes.

$ curl -sv https://<host>/path 2>&1 | tail -20

$ kubectl get endpoints <service>

$ kubectl get pods -l <selector> -o wide

Look for: The status code, which server header produced it, and whether the Service has any endpoints at all.

Find where the conversation broke

A 502 means the proxy got something it could not use: a connection reset, a malformed response, or a closed keepalive. The proxy’s own error log names which.

$ kubectl logs -n ingress-nginx <controller-pod> --tail=50

$ kubectl logs <backend-pod> --tail=50

$ kubectl exec -it <debug-pod> -- curl -sv http://<pod-ip>:<port>/ # bypass the proxy

Look for: In the proxy log: "upstream prematurely closed connection", "connect() failed", or "recv() failed". Each names a different failure.