Help Center> Cloud Container Instance (CCI)> FAQ> Network Management FAQs> What Do I Do If Error 504 Is Reported When I Access a Workload?
View PDF

What Do I Do If Error 504 Is Reported When I Access a Workload?

Error 504 is reported generally when the security group between the port bound to the load balancer and the CCI workload pod is not bypassed. Check the security group used by the CCI workload pod and ensure that the security group rule permits the port bound to the load balancer.

The security group bound to the pod can be obtained by reading the network corresponding to the workload. You can call the API to read the network. For details, see Help Center > Cloud Container Instance > API Reference > Proprietary APIs > Network > Reading a Network. In a response, network.alpha.kubernetes.io/default-security-group in metadata.annotations is the security group ID.

{
    "kind": "Network",
    "apiVersion": "networking.cci.io/v1beta1",
    "metadata": {
        "name": "namespace-test-dc1-default-network",
        "namespace": "namespace-test",
        "selfLink": "/apis/networking.cci.io/v1beta1/namespaces/namespace-test/networks/namespace-test-dc1-default-network",
        "uid": "6fb85414-af6b-11e8-b6ef-f898ef6c78b4",
        "resourceVersion": "5016899",
        "creationTimestamp": "2018-09-03T11:21:00Z",
        "annotations": {
            "network.alpha.kubernetes.io/project-id": "51bf52609f2a49c68bfda3398817b376",
            "network.alpha.kubernetes.io/default-security-group": "19c5d024-aed5-4856-b958-c0f65ce70855",
            "network.alpha.kubernetes.io/domain-id": "aadb43c0b14c4cafbccfff483d075987"
        },
        "enable": true
    },
    "spec": {
        "cidr": "192.168.244.0/23",
        "attachedVPC": "0d4080e5-546a-46c4-86fe-f3e26d685177",
        "networkType": "underlay_neutron",
        "physicalNetwork": "phy_net0",
        "networkID": "0022e356-f730-4226-802e-9cdaa6e7da17",
        "subnetID": "1ffd839d-e534-4fa8-a59d-42356335bf74",
        "availableZone": "cnnorth1a"
    },
    "status": {
        "state": "Active"
    }
}

Log in to the Network Console, and search for the security group based on the obtained security group ID.

Click the security group name, and add the rules shown in the following figure on the Inbound Rules tab page.

If you access the workload from the public network through UDP, an ICMP rule must be added, which will be used during health check.

Parent topic: Network Management FAQs