WebSocket closed unexpectedly

I have a binderhub/jupyterhub setup on GKE. When I launch a notebook and create a kernel, I keep getting disconnected about every 30s, with this behaviour:

18:25:17.829 main.min.js[..] Session: kernel_created (56dcd51a-5384-42b9-980d-6c0126fa10fa)
18:25:17.830 main.min.js[..] Starting WebSockets: wss://<jupyterhub_url>/api/kernels/2c4b8f7f-6eed-43f4-990f-75f62ea37534
[..]
18:25:18.296 extension.js?v=20220127172111:1 Setting requirejs-esri-loader's config:
18:25:18.296 extension.js?v=20220127172111:1 Object
18:25:18.296 extension.js?v=20220127172111:1 Initializing esriLoader for quicker load times...
18:25:18.326 main.min.js[..] Kernel: kernel_connected (2c4b8f7f-6eed-43f4-990f-75f62ea37534)
18:25:18.435 main.min.js[..] Kernel: kernel_ready (2c4b8f7f-6eed-43f4-990f-75f62ea37534)
18:25:22.949 extension.js?v=20220127172111:1 esriLoader initialization completed successfully!
[..]
18:25:48.452 main.min.js[..] WebSocket closed unexpectedly CloseEvent {isTrusted: true, wasClean: false, code: 1006, reason: '', type: 'close', …}
18:25:48.453 main.min.js[..] Kernel: kernel_disconnected (2c4b8f7f-6eed-43f4-990f-75f62ea37534)
18:25:48.454 main.min.js[..] Connection lost, reconnecting in 1 seconds.
18:25:49.466 main.min.js[..] Kernel: kernel_reconnecting (2c4b8f7f-6eed-43f4-990f-75f62ea37534)
18:25:49.467 main.min.js[..] Starting WebSockets: wss://<jupyterhub_url>/api/kernels/2c4b8f7f-6eed-43f4-990f-75f62ea37534
18:25:49.724 main.min.js[..] Kernel: kernel_connected (2c4b8f7f-6eed-43f4-990f-75f62ea37534)
18:25:49.839 main.min.js[..] Kernel: kernel_ready (2c4b8f7f-6eed-43f4-990f-75f62ea37534)
18:26:19.720 main.min.js[..] WebSocket closed unexpectedly CloseEvent {isTrusted: true, wasClean: false, code: 1006, reason: '', type: 'close', …}
...

and it keeps repeating. Funny enough, I can use the kernel and compute ok.

My image was actually built with a previous jupyterhub deployment that was working fine, so I don’t think that is the culprit. I have read around that it could be a proxy problem, but I don’t know how to investigate.

My GKE setup involves an ingress (https, uses google managed-certificate) directing to the proxy-public LoadBalancer service as created by the deployment. It’s a recent helm chart from earlier this month.

Any ideas what this could be or how I could debug into it?