Kubernetes Networking

Every networking problem in Kubernetes is a chain: client → DNS → Service → Endpoints → pod IP → container port. When something doesn't connect, the fix is to walk that chain in order instead of guessing at layer seven first. Most "the app is broken" tickets are actually a label selector typo two links up the chain.

Services are not load balancers in the traditional sense — they're a label query that produces a list of IPs, continuously recomputed. If a Service has no endpoints, nothing downstream matters yet.

1. Check endpoints before you check anything else

kubectl get endpoints <svc> (or endpointslices) tells you immediately whether the Service's selector is matching any Ready pods. An empty list is the single most common root cause of "connection refused" or 502s inside the cluster, and it's a one-command diagnosis.