LoadBalancer with argo tunnel "unknown" state

Zero Trust Cloudflare Tunnel
1

What is the name of the domain?

example.com

What is the issue you’re encountering

LoadBalancer’s pool wich points to argotunnel shows “unknown” state.

What steps have you taken to resolve the issue?

I’ve enabled logging for cloudflared and i see the requests are coming from monitor (cloudflare):

10.244.1.105 - - [15/Sep/2024:22:59:17 +0000] "GET /health HTTP/1.1" 200 0 "-" "Mozilla/5.0 (compatible; Cloudflare-Traffic-Manager/1.0; +https://www.cloudflare.com/traffic-manager/; pool-id: xxx)" 358 0.003 [app-8080] [] 10.245.169.245:8080 0 0.004 200 b643ea428ba69b10d35ad75f09a067e0

But the pool state is still “unknown”.

I’ve tried to add host headers for monitors, change monitoring locations with no luck.

What are the steps to reproduce the issue?

  1. Run cloudflared daemon to create tunnel.
  2. Create load balancer with pool which points to <tunnel_id>.cfargotunnel.com and with monitor with GET / every minute.
  3. Thats it.
2

Did you do this step:
To assign the virtual network to the tunnel:

  1. Go to Networks > Tunnels.
  2. Select the tunnel you created in the previous steps and select Configure.
  3. Under Private Network, select Add a private network.
  4. Specify an IP range under CIDR and select the virtual network under Additional settings.
  5. Select Save private network.
    Set up private IPs with Tunnel | Cloudflare Load Balancing docs

How an endpoint becomes unhealthy

Health checks are requests issued by a monitor at regular interval and — depending on the monitor settings — return a pass or fail value to make sure an endpoint is still able to receive traffic.

Each health monitor request is trying to answer two questions:

  1. Is the endpoint offline?: Does the endpoint respond to the health monitor request at all? If so, does it respond quickly enough (as specified in the monitor’s Timeout field)?
  2. Is the endpoint working as expected?: Does the endpoint respond with the expected HTTP response codes? Does it include specific information in the response body?

If the answer to either of these questions is “No”, then the endpoint fails the health monitor request.

For each option selected in a pool’s Health Monitor Regions, Cloudflare sends health monitor requests from three separate data centers in that region. Source: How endpoints and pools become unhealthy | Cloudflare Load Balancing docs