🌐
Fix 502 behind Nginx + K8s Ingress
Upstream unreachable — trace from browser to pod through ingress and service.
Reviewed: ·Tested on: Kubernetes 1.29, Terraform 1.8, Ubuntu 22.04
Symptoms
- Browser shows 502 Bad Gateway
- Nginx or ingress controller logs mention upstream timeout or connection refused
- Works locally with port-forward but not via ingress
1Confirm where the 502 originates
Hit the service directly (port-forward or NodePort) to see if the app is healthy before blaming ingress.
kubectl get ingress -A
kubectl get svc -n <namespace>
kubectl port-forward svc/<service> 8080:80 -n <namespace>
curl -I http://localhost:80802Check ingress backend and endpoints
502 often means the ingress has no healthy endpoints — pods not ready or wrong service port.
kubectl describe ingress <name> -n <namespace>
kubectl get endpoints -n <namespace>
kubectl get pods -n <namespace> -o wide
kubectl describe pod <pod> -n <namespace>3Verify nginx / ingress controller logs
Look for connect() failed, upstream timed out, or no live upstreams.
# Ingress-NGINX controller pod
kubectl logs -n ingress-nginx -l app.kubernetes.io/name=ingress-nginx --tail=100
# Standalone nginx on VM
sudo tail -f /var/log/nginx/error.log
sudo nginx -t && sudo systemctl reload nginx4Fix common causes
Match service port to container port, ensure readiness probes pass, and check NetworkPolicy or firewall rules.
kubectl edit svc <service> -n <namespace>
kubectl rollout restart deploy/<name> -n <namespace>
kubectl rollout status deploy/<name> -n <namespace>