Skip to content

Services Explained

A Kubernetes Service is a stable virtual IP in front of a set of pods. Which one you pick determines where packets are load-balanced.

The four types at a glance

Type	Scope	Reached via	Typical use
`ClusterIP`	In-cluster	Cluster-internal virtual IP	In-cluster east–west
`NodePort`	Node port	`<any-node-ip>:30000-32767`	Bare metal, quick expose
`LoadBalancer`	External LB	Cloud LB → node port → pod	Public entrypoints
Headless	DNS-only	Per-pod DNS `A` records, no VIP	StatefulSets, DBs

The packet path

flowchart LR
  U[Client] -->|1. DNS| S[my-svc.default.svc.cluster.local]
  S -->|2. kube-proxy DNAT| C[ClusterIP: 10.96.44.12]
  C -->|3. iptables / IPVS rule| P1[pod-a: 10.244.1.7]
  C -.-> P2[pod-b: 10.244.2.4]
  C -.-> P3[pod-c: 10.244.1.9]

The four Services in YAML

apiVersion: v1
kind: Service
metadata:
  name: api
spec:
  type: ClusterIP        # default
  selector:
    app: api
  ports:
    - port: 80           # service port
      targetPort: 8080   # container port

apiVersion: v1
kind: Service
metadata:
  name: api
spec:
  type: NodePort
  selector:
    app: api
  ports:
    - port: 80
      targetPort: 8080
      nodePort: 30080     # 30000–32767

apiVersion: v1
kind: Service
metadata:
  name: api
spec:
  type: LoadBalancer
  externalTrafficPolicy: Local    # preserve source IP, only routes to local pods
  selector:
    app: api
  ports:
    - port: 443
      targetPort: 8080

apiVersion: v1
kind: Service
metadata:
  name: db
spec:
  clusterIP: None     # ← makes it headless
  selector:
    app: postgres
  ports:
    - port: 5432

DNS returns one A record per pod: db-0.db.default.svc.cluster.local, db-1... — perfect for StatefulSets where clients need to talk to a specific replica.

`externalTrafficPolicy` — the sneaky one

Debugging

# Resolve the service via cluster DNS
kubectl run -it --rm debug --image=nicolaka/netshoot --restart=Never -- \
  dig +short api.default.svc.cluster.local

# See where kube-proxy routes it (iptables mode)
iptables -t nat -L KUBE-SERVICES -n | grep api

# See endpoints
kubectl get endpoints api -o yaml

Further reading