Question

You configured an external Application Load Balancer (global) with a backend service pointing to a managed instance group of Compute Engine VMs. The load balancer's HTTP health check is configured correctly to probe port 80 at path /healthz, and the application is confirmed running and responding on the VMs. However, all backends are shown as UNHEALTHY in the console and no traffic is served. Egress rules are set to allow-all. What is the most likely cause?

Accepted Answer

There is no ingress firewall rule allowing traffic from the Google health check probe source ranges 35.191.0.0/16 and 130.211.0.0/22 to the backend VMs.

Answer

The backend service protocol is set to HTTPS but the health check uses HTTP, so the probe cannot complete.

Answer

The instances lack external IP addresses, so the global load balancer cannot reach them for health probing.

Answer

A global external Application Load Balancer requires a regional health check, and the configured health check is global.