Kubernetes Services

Published on:

Most important commands to remember

  • kubectl get service — inspect the Service’s intended endpoint.
  • kubectl get endpointslices — inspect the backend addresses associated with it.
  • kubectl exec … -- curl — request the Service from inside the cluster.

Commands and flags

Command or option Meaning
config current-context Print the selected cluster context.
-n lab Select the test namespace.
get … -o yaml Read the named resource or matching resources as YAML.
-l kubernetes.io/service-name=web Select EndpointSlices labeled for Service web.
exec dns-lab -- curl … Run curl inside the existing diagnostic Pod.
--silent --show-error --max-time 5 Hide curl progress, retain errors, and bound transfer time to five seconds.
-i http://web:8080/ Include HTTP headers in a GET to the Service port.

The Service port is 8080 by prerequisite; the backend targetPort may differ. This is a read-only test endpoint, not an action-triggering URL.

The concepts that matter

1. A Service separates a client endpoint from Pod lifetime

A Kubernetes Service supplies a stable way to reach a logical group of backends. Clients can use a Service name and port while Pods are replaced or moved.

A normal ClusterIP Service has a virtual address. It is not itself a Pod running your application. Cluster networking implements traffic forwarding toward eligible endpoints, using kube-proxy or another supported dataplane implementation.

2. Selectors and EndpointSlices connect intent to addresses

For a selector-based Service, controllers find matching Pods and maintain EndpointSlices describing addresses, ports, and conditions. A correct Service object with a wrong selector can therefore have no useful backends.

Readiness usually influences whether endpoints are eligible for normal traffic, with exceptions such as explicit publish-not-ready configuration. Service existence, matching Pods, ready endpoints, and functioning applications are separate facts to verify.

3. Service port and target port are different

The Service’s port is what a client addresses. targetPort identifies the backend port, directly or through a named port. A container declaring a port does not by itself make a process listen there.

Traffic commonly stays associated with a backend for a connection. Repeated HTTP requests over one persistent connection do not necessarily rotate among Pods. Do not infer per-request round-robin behavior from having several endpoints.

4. Service type controls exposure, not application correctness

ClusterIP, NodePort, and LoadBalancer describe different exposure arrangements. A LoadBalancer Service depends on a supporting implementation; creating the object does not guarantee that an external address is immediately available.

Network policy, routing, listener configuration, and the application can still fail behind a correctly configured Service. DNS can resolve its name even when no backend can answer. Debug from declared configuration through endpoints to an actual request.

One small example

Optional: verify the current context before reading or executing in the existing test resources. Use the stated namespace, Service, and diagnostic Pod. This example creates or changes no cluster objects.

kubectl config current-context
kubectl -n lab get service web -o yaml
kubectl -n lab get endpointslices -l kubernetes.io/service-name=web -o yaml
kubectl -n lab exec dns-lab -- curl --silent --show-error --max-time 5 -i http://web:8080/

Compare the Service’s selector, ClusterIP, port, and targetPort with EndpointSlice addresses, ports, and readiness conditions. Then inspect the HTTP status and response body returned from the diagnostic Pod.

An HTTP response demonstrates one request path at that moment, not every backend’s health or failover behavior. A 5xx response is an application-level finding even if DNS and connection setup worked. No EndpointSlices can indicate selector or controller/configuration issues; it is not uniquely a DNS failure. No cleanup is needed.

Keep this idea: A Service is a stable route to changing endpoints; verify its selection, ports, and actual backend response separately.