Service আর cluster DNS — ClusterIP, NodePort আর LoadBalancer

$ kubectl get pods -l app=api -o custom-columns=NAME:.metadata.name,IP:.status.podIP
NAME                   IP
api-7d66f59445-7x6sx   10.1.0.10
api-7d66f59445-fb2fb   10.1.0.13
api-7d66f59445-th48x   10.1.0.11

$ kubectl exec client -- curl -s --max-time 3 http://10.1.0.10:8080/
api-7d66f59445-7x6sx

$ kubectl delete pod api-7d66f59445-7x6sx
pod "api-7d66f59445-7x6sx" deleted from abcl-ks namespace

$ kubectl get pods -l app=api -o custom-columns=NAME:.metadata.name,IP:.status.podIP
NAME                   IP
api-7d66f59445-9bm9z   10.1.0.16
api-7d66f59445-fb2fb   10.1.0.13
api-7d66f59445-th48x   10.1.0.11

$ kubectl exec client -- curl -sS --max-time 3 http://10.1.0.10:8080/
curl: (28) Connection timed out after 3002 milliseconds
command terminated with exit code 28

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
  namespace: abcl-ks
spec:
  replicas: 3
  selector:
    matchLabels:
      app: api
  template:
    metadata:
      labels:
        app: api
    spec:
      containers:
        - name: web
          image: nginx:1.27-alpine
          imagePullPolicy: IfNotPresent
          command: ["sh", "-c"]
          args:
            - |
              sed -i 's/listen  *80;/listen 8080;/' /etc/nginx/conf.d/default.conf
              echo "$HOSTNAME" > /usr/share/nginx/html/index.html
              echo ok > /usr/share/nginx/html/ready.html
              exec nginx -g 'daemon off;'
          ports:
            - name: http
              containerPort: 8080
          readinessProbe:
            httpGet:
              path: /ready.html
              port: http
            periodSeconds: 2
            failureThreshold: 1
          resources:
            requests:
              cpu: 10m
              memory: 16Mi
            limits:
              memory: 48Mi

apiVersion: v1
kind: Service
metadata:
  name: api
  namespace: abcl-ks
spec:
  type: ClusterIP
  selector:
    app: api
  ports:
    - name: http
      port: 80
      targetPort: http

$ kubectl get svc api
NAME   TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)   AGE
api    ClusterIP   10.105.249.110   <none>        80/TCP    2s

$ kubectl get endpointslices
NAME        ADDRESSTYPE   PORTS   ENDPOINTS                       AGE
api-k4nqn   IPv4          8080    10.1.0.10,10.1.0.13,10.1.0.11   2s

$ kubectl exec api-7d66f59445-fb2fb -- rm /usr/share/nginx/html/ready.html

$ kubectl get pods -l app=api
NAME                   READY   STATUS    RESTARTS   AGE
api-7d66f59445-fb2fb   0/1     Running   0          81s
api-7d66f59445-mn4r9   1/1     Running   0          7s
api-7d66f59445-th48x   1/1     Running   0          81s

$ kubectl get endpointslices -l kubernetes.io/service-name=api
NAME        ADDRESSTYPE   PORTS   ENDPOINTS                       AGE
api-k4nqn   IPv4          8080    10.1.0.13,10.1.0.11,10.1.0.40   81s

$ kubectl exec client -- sh -c 'for i in $(seq 1 30); do curl -s http://api/; done | sort | uniq -c'
     14 api-7d66f59445-mn4r9
     16 api-7d66f59445-th48x

$ kubectl get endpointslices -l kubernetes.io/service-name=api -o yaml
…
  endpoints:
  - addresses:
    - 10.1.0.13
    conditions:
      ready: false
      serving: false
      terminating: false
    nodeName: docker-desktop
    targetRef:
      kind: Pod
      name: api-7d66f59445-fb2fb
…
  ports:
  - name: http
    port: 8080
    protocol: TCP

# Shorter: one column per field (a later run, other names and IPs)
$ kubectl get endpointslices -l kubernetes.io/service-name=api \
    -o custom-columns='NAME:.metadata.name,ADDRESS:.endpoints[*].addresses[0],READY:.endpoints[*].conditions.ready'
NAME        ADDRESS                            READY
api-4rcrm   10.1.0.140,10.1.0.138,10.1.0.139   true,false,true

$ kubectl get endpoints api
Warning: v1 Endpoints is deprecated in v1.33+; use discovery.k8s.io/v1 EndpointSlice
NAME   ENDPOINTS                         AGE
api    10.1.0.139:8080,10.1.0.140:8080   9s

// Service selection: selector + readiness = traffic. Edit and run.
const SELECTOR = { app: "api" };     // try { app: "apii" } or {}
const TARGET_PORT = "http";          // try 9090 or "web"
const PODS = [
  { name: "api-1", ip: "10.1.0.11", labels: { app: "api" }, ready: true, ports: { http: 8080 } },
  { name: "api-2", ip: "10.1.0.13", labels: { app: "api" }, ready: false, ports: { http: 8080 } },
  { name: "api-3", ip: "10.1.0.40", labels: { app: "api" }, ready: true, ports: { http: 8080 } },
  { name: "db-1", ip: "10.1.0.50", labels: { app: "db" }, ready: true, ports: { sql: 5432 } },
];
const keys = Object.keys(SELECTOR);
if (keys.length === 0) {
  console.log("No selector: Kubernetes manages no endpoints for this Service.");
} else {
  const members = PODS.filter(p => keys.every(k => p.labels[k] === SELECTOR[k]));
  for (const p of PODS) {
    const inSlice = members.includes(p);
    console.log(p.name.padEnd(6), p.ip.padEnd(10), inSlice ? "in slice" : "no match",
      inSlice ? "ready=" + p.ready : "");
  }
  const port = p => typeof TARGET_PORT === "number" ? TARGET_PORT : p.ports[TARGET_PORT];
  const ready = members.filter(p => p.ready);
  const shown = members.length ? port(members[0]) ?? "<unset>" : "<unset>";
  console.log("slice PORTS:", shown, "| addresses listed:", members.length);
  if (members.length === 0) console.log("Result: no endpoints, connection fails. Check the selector.");
  else if (ready.length === 0) console.log("Result: all listed, none ready. Check the probe.");
  else if (shown === "<unset>") console.log("Result: port name not found on the Pods.");
  else console.log("Traffic goes to:", ready.map(p => p.ip + ":" + port(p)).join(" "));
}

$ kubectl exec client -- cat /etc/resolv.conf
nameserver 10.96.0.10
search abcl-ks.svc.cluster.local svc.cluster.local cluster.local
options ndots:5

$ kubectl exec client -- getent hosts api
10.105.249.110    api.abcl-ks.svc.cluster.local  api.abcl-ks.svc.cluster.local api

$ kubectl exec client -- getent hosts api.abcl-ks
10.105.249.110    api.abcl-ks.svc.cluster.local  api.abcl-ks.svc.cluster.local api.abcl-ks

$ kubectl exec client -- getent hosts kubernetes.default
10.96.0.1         kubernetes.default.svc.cluster.local  kubernetes.default.svc.cluster.local kubernetes.default

$ kubectl exec client -- nslookup api.abcl-ks
Server:		10.96.0.10
Address:	10.96.0.10:53

Non-authoritative answer:

** server can't find api.abcl-ks: NXDOMAIN

# getent hosts shop.example.com     (2 dots, 2 < 5: search first)
AAAA shop.example.com.abcl-ks.svc.cluster.local.
AAAA shop.example.com.svc.cluster.local.
AAAA shop.example.com.cluster.local.
AAAA shop.example.com.
A shop.example.com.abcl-ks.svc.cluster.local.
A shop.example.com.svc.cluster.local.
A shop.example.com.cluster.local.
A shop.example.com.

# getent hosts shop.example.com.    (trailing dot: absolute)
AAAA shop.example.com.
A shop.example.com.

# getent hosts a.b.c.d.e.example    (5 dots, not less than 5)
AAAA a.b.c.d.e.example.
A a.b.c.d.e.example.

// Search-path expansion, musl-style. Edit NAME and NDOTS.
const NAME = "shop.example.com";     // try "api", "api.abcl-ks", "shop.example.com."
const NDOTS = 5;                     // try 1
const SEARCH = ["abcl-ks.svc.cluster.local", "svc.cluster.local", "cluster.local"];
const ZONE = {                       // names that really exist
  "api.abcl-ks.svc.cluster.local.": "10.105.249.110",
  "shop.example.com.": "203.0.113.10",
};
function candidates(name, ndots, search) {
  if (name.endsWith(".")) return [name];           // absolute name
  const dots = name.split(".").length - 1;
  if (dots >= ndots) return [name + "."];          // enough dots
  return [...search.map(s => name + "." + s + "."), name + "."];
}
let packets = 0, answer = "NXDOMAIN";
for (const q of candidates(NAME, NDOTS, SEARCH)) {
  packets += 2;                                    // one A + one AAAA
  const hit = ZONE[q];
  console.log((hit ? "HIT " : "miss"), q);
  if (hit) { answer = hit; break; }
}
const dots = NAME.split(".").length - 1;
console.log("dots:", dots, "| ndots:", NDOTS, "| packets (A+AAAA):", packets);
console.log("answer:", answer);

# Three Ready Pods, 30 separate connections
$ kubectl exec client -- sh -c 'for i in $(seq 1 30); do curl -s http://api/; done | sort | uniq -c'
      8 api-7d66f59445-9bm9z
     10 api-7d66f59445-fb2fb
     12 api-7d66f59445-th48x

# Same again
      8 api-7d66f59445-9bm9z
     11 api-7d66f59445-fb2fb
     11 api-7d66f59445-th48x

# One curl, six URLs: one TCP connection is reused
$ kubectl exec client -- curl -s http://api/ http://api/ http://api/ http://api/ http://api/ http://api/
api-7d66f59445-fb2fb
api-7d66f59445-fb2fb
api-7d66f59445-fb2fb
api-7d66f59445-fb2fb
api-7d66f59445-fb2fb
api-7d66f59445-fb2fb

// iptables-mode pick: one random choice per NEW connection.
const PODS = ["api-a", "api-b", "api-c"];  // add or remove Pods
const CONNECTIONS = 3000;
const REQUESTS_PER_CONN = 1;               // try 100: keep-alive
function mulberry32(a) {
  return function () {
    a |= 0; a = a + 0x6D2B79F5 | 0;
    let t = Math.imul(a ^ a >>> 15, 1 | a);
    t = t + Math.imul(t ^ t >>> 7, 61 | t) ^ t;
    return ((t ^ t >>> 14) >>> 0) / 4294967296;
  };
}
const rand = mulberry32(45);
const n = PODS.length;
PODS.forEach((p, i) => {
  const left = n - i;
  console.log("rule", i + 1, "->", p, "probability 1/" + left);
});
const conns = Array(n).fill(0);
for (let c = 0; c < CONNECTIONS; c++) {
  for (let i = 0; i < n; i++) {
    if (i === n - 1 || rand() < 1 / (n - i)) { conns[i]++; break; }
  }
}
PODS.forEach((p, i) => console.log(p, "connections:", conns[i],
  "requests:", conns[i] * REQUESTS_PER_CONN));

$ kubectl patch svc api -p '{"spec":{"sessionAffinity":"ClientIP"}}'
service/api patched

$ kubectl get svc api -o jsonpath='{.spec.sessionAffinity} {.spec.sessionAffinityConfig}{"\n"}'
ClientIP {"clientIP":{"timeoutSeconds":10800}}

$ kubectl exec client -- sh -c 'for i in $(seq 1 20); do curl -s http://api/; done | sort | uniq -c'
     20 api-7d66f59445-mn4r9

$ kubectl patch svc api -p '{"spec":{"sessionAffinity":"None"}}'
service/api patched

$ kubectl exec client -- sh -c 'for i in $(seq 1 20); do curl -s http://api/; done | sort | uniq -c'
      7 api-7d66f59445-fb2fb
      6 api-7d66f59445-mn4r9
      7 api-7d66f59445-th48x

apiVersion: v1
kind: Service
metadata:
  name: api-np
  namespace: abcl-ks
spec:
  type: NodePort
  selector:
    app: api
  ports:
    - name: http
      port: 80
      targetPort: http
      nodePort: 30845

$ kubectl get svc api-np
NAME     TYPE       CLUSTER-IP      EXTERNAL-IP   PORT(S)        AGE
api-np   NodePort   10.103.112.35   <none>        80:30845/TCP   1s

# From this machine, outside the cluster, 12 connections
$ for i in 1 2 3 4 5 6 7 8 9 10 11 12; do curl -s --max-time 2 http://127.0.0.1:30845/; done | sort | uniq -c
      3 api-7d66f59445-fb2fb
      4 api-7d66f59445-mn4r9
      5 api-7d66f59445-th48x

# A nodePort outside the allowed range is refused by the API server
$ kubectl apply -f bad.yaml
The Service "api-bad" is invalid: spec.ports[0].nodePort: Invalid value: 20045: provided port is not in the valid range. The range of valid ports is 30000-32767

apiVersion: v1
kind: Service
metadata:
  name: api-lb
  namespace: abcl-ks
spec:
  type: LoadBalancer
  selector:
    app: api
  ports:
    - name: http
      port: 18045
      targetPort: http

$ kubectl get svc api-lb
NAME     TYPE           CLUSTER-IP      EXTERNAL-IP   PORT(S)           AGE
api-lb   LoadBalancer   10.108.255.68   localhost     18045:30610/TCP   4s

$ kubectl get svc api-lb -o jsonpath='{.status}{"\n"}'
{"loadBalancer":{"ingress":[{"hostname":"localhost"}]}}

$ for i in 1 2 3 4 5 6; do curl -s --max-time 3 http://127.0.0.1:18045/; done | sort | uniq -c
      3 api-7d66f59445-fb2fb
      2 api-7d66f59445-mn4r9
      1 api-7d66f59445-th48x

$ kubectl delete svc api-lb
service "api-lb" deleted from abcl-ks namespace

apiVersion: v1
kind: Service
metadata:
  name: api-headless
  namespace: abcl-ks
spec:
  clusterIP: None
  selector:
    app: api
  ports:
    - name: http
      port: 80
      targetPort: http
---
apiVersion: v1
kind: Service
metadata:
  name: pay-gateway
  namespace: abcl-ks
spec:
  type: ExternalName
  externalName: pay.example.com

$ kubectl get svc
NAME           TYPE           CLUSTER-IP       EXTERNAL-IP       PORT(S)   AGE
api            ClusterIP      10.105.249.110   <none>            80/TCP    45s
api-headless   ClusterIP      None             <none>            80/TCP    4s
pay-gateway    ExternalName   <none>           pay.example.com   <none>    4s

$ kubectl exec client -- nslookup api-headless.abcl-ks.svc.cluster.local
…
Name:	api-headless.abcl-ks.svc.cluster.local
Address: 10.1.0.13
Name:	api-headless.abcl-ks.svc.cluster.local
Address: 10.1.0.11
Name:	api-headless.abcl-ks.svc.cluster.local
Address: 10.1.0.16

# Port 80 is only the Service's number: nothing translates it here
$ kubectl exec client -- curl -sS --max-time 2 http://api-headless/
curl: (7) Failed to connect to api-headless port 80 after 1 ms: Could not connect to server

$ kubectl exec client -- curl -sS --max-time 2 http://api-headless:8080/
api-7d66f59445-wjdht

$ kubectl exec client -- nslookup pay-gateway.abcl-ks.svc.cluster.local
…
pay-gateway.abcl-ks.svc.cluster.local	canonical name = pay.example.com

$ kubectl port-forward --address 127.0.0.1 svc/api 18145:80
Forwarding from 127.0.0.1:18145 -> 8080

# In another terminal, 8 connections
$ for i in 1 2 3 4 5 6 7 8; do curl -s --max-time 3 http://127.0.0.1:18145/; done | sort | uniq -c
      8 api-7d66f59445-th48x

$ kubectl apply -f typo.yaml
service/orders created

$ kubectl get svc orders
NAME     TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)   AGE
orders   ClusterIP   10.106.98.36   <none>        80/TCP    2s

$ kubectl get endpointslices -l kubernetes.io/service-name=orders
NAME           ADDRESSTYPE   PORTS     ENDPOINTS   AGE
orders-8mtx4   IPv4          <unset>   <unset>     2s

$ kubectl exec client -- getent hosts orders
10.106.98.36      orders.abcl-ks.svc.cluster.local  orders.abcl-ks.svc.cluster.local orders

$ kubectl exec client -- curl -sS --max-time 3 http://orders/
curl: (7) Failed to connect to orders port 80 after 0 ms: Could not connect to server

$ kubectl describe svc orders | grep -E 'Selector|Endpoints|Events'
Selector:                 app=apii
Endpoints:
Events:                   <none>

$ kubectl get pods -l app=apii
No resources found in abcl-ks namespace.

$ kubectl get pods --show-labels -l app=api
NAME                   READY   STATUS    RESTARTS   AGE     LABELS
api-7d66f59445-fb2fb   1/1     Running   0          2m46s   app=api,pod-template-hash=7d66f59445
api-7d66f59445-mn4r9   1/1     Running   0          92s     app=api,pod-template-hash=7d66f59445
api-7d66f59445-th48x   1/1     Running   0          2m46s   app=api,pod-template-hash=7d66f59445

$ kubectl patch svc orders -p '{"spec":{"selector":{"app":"api"}}}'
service/orders patched

$ kubectl get endpointslices -l kubernetes.io/service-name=orders
NAME           ADDRESSTYPE   PORTS   ENDPOINTS                       AGE
orders-8mtx4   IPv4          8080    10.1.0.11,10.1.0.13,10.1.0.40   5s

$ kubectl exec client -- curl -sS --max-time 3 http://orders/
api-7d66f59445-mn4r9

// "Service not reachable" decision tree. Set what you observed.
const OBSERVED = {
  serviceExists: true,      // kubectl get svc api
  dnsResolves: true,        // getent hosts api (from a Pod)
  podsMatchSelector: false, // kubectl get pods -l <selector>
  somePodReady: true,       // READY column, or slice conditions
  slicePortSet: true,       // PORTS is not <unset>
  podIpWorks: true,         // curl PodIP:targetPort (from a Pod)
  clusterIpWorks: true,     // curl ClusterIP:port (from a Pod)
  outsideWorks: true,       // from outside the cluster
};
const TREE = [
  ["serviceExists", "Service exists?", "Wrong name or namespace. Check: kubectl get svc -A"],
  ["dnsResolves", "Name resolves?", "Use the full name; check namespace and CoreDNS Pods."],
  ["podsMatchSelector", "Pods match selector?", "Selector or label typo. Compare with --show-labels."],
  ["somePodReady", "Any Pod Ready?", "Read kubectl describe pod: probe, crash or image."],
  ["slicePortSet", "Slice port set?", "targetPort name not on the Pod. Fix the port name."],
  ["podIpWorks", "Pod answers directly?", "App not listening there, wrong targetPort, or NetworkPolicy."],
  ["clusterIpWorks", "ClusterIP answers?", "Service path broken: check port, kube-proxy, CNI, policy."],
  ["outsideWorks", "Reachable from outside?", "Check type, NodePort, firewall, LB health check."],
];
let step = 0;
for (const [key, question, fix] of TREE) {
  step++;
  if (OBSERVED[key]) { console.log(step + ". " + question + " yes"); continue; }
  console.log(step + ". " + question + " NO");
  console.log("STOP -> " + fix);
  step = -1;
  break;
}
if (step !== -1) console.log("All checks pass: test from the failing client itself.");