Configuring Kubernetes Ingress

I’m trying to configure Google Kubernetes Engine Ingress properly to a load balanced Docker application which runs on port 3000. I’m clearly making an obvious mistake somewhere, but I have no idea where. Ingress always says machines are not healthy, but I am able to verify that the web app is running and listening on 0.0.0.0:3000.

Any other clear gotchas in my configuration is also appreciated, outside of the stated problem.

Current setup looks like:

deployment.yml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
spec:
  replicas: 1
  selector:
    matchLabels:
      app: web
  strategy:
    rollingUpdate:
      maxSurge: 1
      maxUnavailable: 1
  minReadySeconds: 5
  template:
    metadata:
      labels:
        app: web
    spec:
      containers:
      - name: cloud-sql-proxy
        image: gcr.io/cloudsql-docker/gce-proxy:1.17
        command:
          - "/cloud_sql_proxy"
          - "-ip_address_types=PRIVATE"
          - "-instances=project:us-central1:postgres=tcp:5432"
        securityContext:
          runAsNonRoot: true
      - name: web
        image: gcr.io/PROJECT_ID/IMAGE:TAG
        ports:
        - containerPort: 3000
        env:
        - name: MASTER_KEY
          valueFrom:
            secretKeyRef:
              name: masterkey
              key: MASTER_KEY
        resources:
          requests:
            cpu: 100m
          limits:
            cpu: 100m

web-service.yml

apiVersion: v1
kind: Service
metadata:
  name: web-service
spec:
  selector:
    app: web
  type: NodePort
  ports:
    - port: 3000
      targetPort: 443
      protocol: TCP
      name: https

web-ingress.yml

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: web-ingress
  annotations:
    kubernetes.io/ingress.global-static-ip-name: staging-cluster
    networking.gke.io/managed-certificates: cloudflare-origin
spec:
  rules:
  - host: staging.mydomain.com
    http:
      paths:
      - backend:
        serviceName: web-service
        servicePort: 443

cloudflare-origin.yml*

apiVersion: networking.gke.io/v1beta2
kind: ManagedCertificate
metadata:
  name: cloudflare-origin
spec:
  domains:
    - staging.mydomain.com

compute-address.yml

apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeAddress
metadata:
  name: staging-cluster
spec:
  location: global

kustomization.yml

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- gke/deployment.yml
- gke/config-connector.yml
- gke/compute-address.yml
- gke/cloudflare-origin.yml
- gke/web-service.yml
- gke/web-ingress.yml

apiVersion: v1
kind: Service
metadata:
  name: web-service
spec:
  selector:
    app: web
  type: NodePort
  ports:
    - port: 443
      targetPort: 3000
      protocol: TCP
      name: https