MiddleDebuggingCommonNot answered yet
Clients get timeouts calling the web Service though the Pods are up — diagnose it.
Clients calling the web Service get connection timeouts, though the Pods are Running and Ready. Below is what you see. Explain why traffic never reaches the Pods and how you fix it.
$ kubectl get svc web
NAME TYPE CLUSTER-IP PORT(S) AGE
web ClusterIP 10.96.0.42 80/TCP 10m
$ kubectl get endpoints web
NAME ENDPOINTS AGE
web <none> 10m
$ kubectl get pods -l app=web --show-labels
No resources found in default namespace.
$ kubectl get pods --show-labels
NAME READY STATUS LABELS
web-abc-123 1/1 Running app=webapp,role=frontend
web-abc-456 1/1 Running app=webapp,role=frontend
$ kubectl describe svc web | grep Selector
Selector: app=webGive the diagnosis and the fix.
The endpoints list is empty, so the Service has no backends and requests time out. The Pods are Ready, but their label app=webapp does not match the Service selector app=web, so none is enrolled. Fix it by aligning the selector or relabelling the Pods.
- ✗Blaming kube-proxy or DNS instead of reading the empty Endpoints
- ✗Thinking a Service matches Pods by name prefix, not by label selector
- ✗Assuming more replicas or waiting will populate an empty Endpoints list
- →How would an empty Endpoints list look instead if readiness were failing?
- →Which command quickly confirms whether a selector matches any Pods?
Solution
The symptom is timeouts, not refusals: traffic reaches the ClusterIP 10.96.0.42, but nothing is behind it.
- The key clue is
kubectl get endpoints webshowing<none>. The Service has no backends, so kube-proxy has nowhere to send packets and the client waits until it times out. - Why Endpoints is empty: the Service selects Pods by
app=web, but the real Pods are labelledapp=webapp(see--show-labels).kubectl get pods -l app=webfinds nothing — the selector matches no Pod. - Fix the mismatch: either align the Service selector to
app=webapp, or relabel the Pods toapp=web. Usually you patch the Service:
kubectl patch svc web -p '{"spec":{"selector":{"app":"webapp"}}}'
kubectl get endpoints web # now lists IP:port of the two PodsRule of thumb: an empty Endpoints list almost always means the selector doesn't match the Pod labels — or that no Pod is Ready. Here the Pods are Ready, so it is the labels.
