Pods can be replaced, moved, or scaled, so their IP addresses are not dependable application entry points. A Service provides a consistent IP address and DNS name for reaching a selected set of Pods and distributes traffic among them. kube-proxy runs on each worker node and handles Service communication. section 6.4 section 1.6
A Service selector associates it with Pods by label. For a Deployment whose Pods carry app=nginx, generate a declarative starting point with kubectl expose deploy nginx --name nginx-svc --port 80 --type ClusterIP --dry-run=client -o yaml > nginx-svc.yaml. Inspect the selector before applying the file: the Service must select the intended Pods. section 5.1.4
Choose the type according to where traffic must enter:
- ClusterIP serves clients inside the cluster. Use it, for example, for communication from a frontend Pod to a backend Pod. section 6.4 section 6.4.1
- NodePort exposes a port on a node’s IP address and also provides ClusterIP access. section 6.4
- LoadBalancer lets an external load balancer direct traffic into the cluster through node ports. section 6.4
- ExternalName creates a CNAME record in cluster DNS rather than allocating a cluster IP. section 6.4
In a Service manifest, spec.ports[].port is the Service-facing port; targetPort identifies the container port. A selector such as app: internal-svc binds the Service to Pods with that label. A Service can define more than one port. Its endpoints show the Pod addresses and ports available as targets; check them with kubectl get ep. section 6.4.1 section 6.4
Verify access across namespaces
Create a Deployment and expose it in a namespace with kubectl -n c01383 create deploy nginx --image nginx followed by kubectl -n c01383 expose deploy nginx --name nginx-svc --port 80. Confirm both objects with kubectl -n c01383 get deploy,svc. From a Pod in c01383, curl apache-svc cannot resolve a Service in default, but curl apache-svc.default reaches it. Service DNS names include the namespace; the full form is <service-name>.<namespace-name>.svc.cluster.local. section 6.2.4
Troubleshoot a Service that cannot reach its Pods
First compare the Service selector with Pod labels using kubectl get svc -o yaml and kubectl get po --show-labels. Check the Service port and the application’s port, then test with curl. In one nginx task, the Service exposed port 3306 while curl used port 80; editing the Service port to 80 made the nginx welcome page reachable. section 8.3.2
