Trying out Apigee X Evaluation, finished onboarding process - But 502 Server Error

[razor]

Hi,

The target is: https://mocktarget.apigee.net/user (By default)

I can access this URL myself, but not via the API Proxy created while onboarding.

Steps I have taken to amend:

• Add Firewall rule (in VPC) INGRESS, Allow all from my External IP.
• Add Firewall rule (in VPC) Egress to 35.227.194.212 (mocktarget.apigee.net)

Would appreciate any help, Thanks.

[strebel · Accepted solution]

Hi @razor, for better pinning down the issue I'd recommend you try to start a debug session and see if your request is able to reach Apigee. 

If you see request entries in the Apigee debug UI then the 502 happens between Apigee and the mock server. Note that if you enabled VPC-SC (VPC service controls) the Apigee runtime can't reach the public internet directly.

If you don't see the requests coming in then the issue appears to be on the north bound path. In that case I would try to take a look at the load balancer's backends and check if there are any health check issues.

[strebel · Accepted solution]

Hi @razor, for better pinning down the issue I'd recommend you try to start a debug session and see if your request is able to reach Apigee. 

If you see request entries in the Apigee debug UI then the 502 happens between Apigee and the mock server. Note that if you enabled VPC-SC (VPC service controls) the Apigee runtime can't reach the public internet directly.

If you don't see the requests coming in then the issue appears to be on the north bound path. In that case I would try to take a look at the load balancer's backends and check if there are any health check issues.

[razor]

Thanks for your prompt reply, I think I may have accidentally chosen your reply as selected solution, no big deal, but I must say the problem still exists.

I performed a debug session as you suggested, I don't see any requests there. I always get 502 Server Error.

So I looked around a bit, found the instance group, with it's relevant health check.  Looks like a request to /healthz/ingress on port 443.
Looking at the instances in the instances group, I don't see any process listening on 443.

eitamd@apigee-proxy-8007:~$ netstat -l 
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 0.0.0.0:ssh             0.0.0.0:*               LISTEN  

That's the only listening tcp4 binding.

eitamd@apigee-proxy-8007:~$ curl https://127.0.0.1/healthz/ingress
curl: (7) Failed to connect to 127.0.0.1 port 443: Connection refused

I find it really odd that this evaluation onboarding experience results with a none working Apigee API Proxy.

I wish I could remove Apigee from the project, and enable it again...

EDIT: I searched the forums a bit, and found this:
https://www.googlecloudcommunity.com/gc/Apigee/Apigee-Backend-Unhealthy-Error-Server-Error/m-p/44932...

It almost looks like copy paste of my post... I think there is a bug on GCP side. Something with backend is not working. I will try recreating similar to what the user wrote.

[razor]

Recreating the Instance Group VMs did not help.

How do I clean all the resources created when I "Enabled Apigee X" for my gcp project, and re-create all of them?

As for VPC-SC, I think this means it is not enabled?

[strebel · Accepted solution]

---

@razor wrote:

I wish I could remove Apigee from the project, and enable it again...

---

That's where terraform (https://github.com/apigee/terraform-modules) come in very handy. 
With the easy path UI you'll unfortunately have to do the deletion steps manually.