Fix a Service That Has No Endpoints

Original Prepium guide · Written for Kubernetes v1.35 and checked against the official documentation on 6 October 2026. Use a disposable practice cluster.

Why a Service has no endpoints, and how to prove which link is broken

A Service forwards nothing by itself. The control plane continuously evaluates its selector against Pod labels and writes the matching Pod addresses into EndpointSlices; kube-proxy then routes to the ready ones on the targetPort. "No endpoints" therefore has a short list of causes, and the EndpointSlice tells you which one you are facing.

Service selector ──matches?──→ Pod labels ──ready?──→ EndpointSlice ──targetPort──→ container
     cause 1: no match          cause 3: not ready                 cause 2: wrong port

1. Build a Service with a deliberate typo

kubectl create namespace prepium-tutorial
kubectl -n prepium-tutorial create deployment tickets --image=nginx:1.27-alpine --replicas=2
kubectl -n prepium-tutorial create service clusterip tickets-svc --tcp=80:8080 \
  --dry-run=client -o yaml > tickets-svc.yaml

Open tickets-svc.yaml and set the selector to app: ticket (singular, the typo). Notice it already carries a second fault: targetPort: 8080, while nginx listens on 80. Apply it.

2. Read the slice before reading YAML

kubectl -n prepium-tutorial get endpointslices -l kubernetes.io/service-name=tickets-svc
kubectl -n prepium-tutorial get svc tickets-svc -o jsonpath='{.spec.selector}{"\n"}'
kubectl -n prepium-tutorial get pods --show-labels

The ENDPOINTS column reads <none>. Run the Service's selector as a query, kubectl get pods -l app=ticket, and it returns nothing, which settles it: no Pod carries every key/value pair the selector demands. A Service selector is a plain map, and all of its pairs must match; a Pod may carry extra labels, but it cannot be missing one.

3. Fix the selector, then discover the next fault

kubectl -n prepium-tutorial set selector service tickets-svc 'app=tickets'
kubectl -n prepium-tutorial get endpointslices -l kubernetes.io/service-name=tickets-svc
kubectl -n prepium-tutorial run probe --image=busybox:1.36 --restart=Never -- sleep 3600
kubectl -n prepium-tutorial exec probe -- wget -T 3 -qO- http://tickets-svc

set selector replaces the whole selector rather than merging into it. The slice now lists both Pod IPs, but its PORTS column says 8080 and the request still fails. Endpoints existing is necessary, not sufficient: traffic goes to targetPort, and nothing listens there.

kubectl -n prepium-tutorial patch service tickets-svc --type=json \
  -p '[{"op":"replace","path":"/spec/ports/0/targetPort","value":80}]'
kubectl -n prepium-tutorial exec probe -- wget -T 3 -qO- http://tickets-svc | head -n 4

Now the nginx page arrives. If the Service is shared by other clients, fixing it is safer than relabelling the Pods to match a typo; if the Pods' labels are the ones that drifted, fix the Deployment's template instead.

4. The third cause: Pods that are not ready

Run kubectl -n prepium-tutorial get endpointslices -l kubernetes.io/service-name=tickets-svc -o yaml and look at conditions on each endpoint. A Pod whose readiness probe fails is taken out of rotation: it no longer counts as a ready endpoint, so Services stop sending it traffic. Running Pods with 0/1 in READY and a selector that matches perfectly are the signature of this case; the fix is in the probe or the app, not the Service.

Common mistakes

• Comparing the selector with the Deployment's own labels instead of the Pod template labels. Only Pod labels count.
• Changing port when targetPort was wrong. Clients keep using the Service port; the container port is what must match.
• Patching the selector to something broader, such as a label every Pod in the namespace shares, and silently pulling unrelated Pods into the Service.
• Stopping at "endpoints exist". Always finish with a request through the Service name.

Cleanup: kubectl delete namespace prepium-tutorial and rm tickets-svc.yaml. References: Debug Services, EndpointSlices, Labels and Selectors. Next, try readiness probes or NodePort Services.