Apigee X Eval Org Stuck at 502? Check These 2 Things First

Apigee X evaluation organizations may occasionally display a 502 error even when all setup steps appear green in the console. This occurs when the load-balancer layer behind the HTTPS load-balancer is not effectively forwarding traffic to the Apigee runtime instances. The issue is separate from Apigee's own control plane, which shows as active.

To resolve this, first confirm that the health check shows unhealthy for the apigee-proxy-* instances using the gcloud compute backend-services list and gcloud compute backend-services get-health commands. If the healthState is UNHEALTHY, proceed with troubleshooting. The first possible cause is a missing service account on the instance template.

Check the boot log of an unhealthy instance using gcloud compute instances get-serial-port-output and look for the service account status. If it's missing, clone the instance template to attach a service account, then roll the instance group onto the modified template. Next, verify if the ENDPOINT metadata key is blank. Check this from within an instance using gcloud compute ssh and curl commands to fetch the ENDPOINT attribute.

If it's blank, patch the metadata with the runtime instance's internal IP address and force each VM to re-run its startup script via gcloud compute ssh. After ensuring the NAT rule has been applied correctly with sudo iptables -t nat -L -n -v, verify that both instances have a healthy state. Finally, test the fix by accessing the Apigee endpoint using curl https:// YOUR_HOSTNAME .nip.io/hello-world – if it returns a proper response instead of the 502 error, the issue has been resolved.