Taking a TFE backup with the API gives "502 Bad Gateway" error – HashiCorp Help Center

Introduction and details of the problem

Take a Backup using the API Backup:

curl \
--header "Authorization: Bearer $TOKEN" \
--request POST \
--data @payload.json \
--output backup.blob \
https://<TFE HOSTNAME>/_backup/api/v1/backup

Now check the backup.blobfile:

cat backup.blob

The response is a 502 Bad Gateway:

<html>
<head><title>502 Bad Gateway</title></head>
<body>
<center><h1>502 Bad Gateway</h1></center>
<hr><center>nginx</center>
</body>
</html>

Cause

In the application configuration file, the attribute s3_endpoint is setup to a value like the following example: https://<bucket-name>.s3.eu-west-1.amazonaws.com

This can be checked with the following command:

replicatedctl app-config export --hidden

The s3_endpoint is only needed when a VPC endpoint or S3-compatible service (e.g. Minio) is used.
By default, the s3_endpointshould be left blank.

Solutions:

Please see the steps below on how to fix this and take the backup successfully:

Reset the s3_endpoint to an empty value:

# for an active-active installation
$ tfe-admin app-config -k s3_endpoint -v ''

# for standalone installation
$ replicatedctl app-config set s3_endpoint --value ''

Restart TFE:

$ replicatedctl app stop
App is stopping
$ replicatedctl app start
App is starting
$ replicatedctl app status

Proceed with the Backup API, it should work now:

curl \
  --header "Authorization: Bearer $TOKEN" \
  --request POST \
  --data @payload.json \
  --output backup.blob \
  https://<TFE HOSTNAME>/_backup/api/v1/backup

Where $TOKEN is the value of backup_token from the app configuration:

backup_token": {
        "value": "e3740a79c89dff3c08b570175f0061c8284be6950629080a82a9d6bf1e96a680"

Additional Information

Introduction and details of the problem

Cause

Solutions:

Additional Information

Articles in this section

Related articles