Or with Endpoints for IP-based external service

apiVersion: v1 kind: Service metadata: name: external-api spec: ports: - port: 443 targetPort: 443 protocol: TCP

apiVersion: v1 kind: Endpoints metadata: name: external-api subsets:

• addresses:
  • ip: 203.0.113.100 ports:
  • port: 443

### Pattern 5: Multi-Port Service with Metrics

```yaml
apiVersion: v1
kind: Service
metadata:
  name: web-app
  annotations:
    prometheus.io/scrape: "true"
    prometheus.io/port: "9090"
    prometheus.io/path: "/metrics"
spec:
  type: ClusterIP
  selector:
    app: web-app
  ports:
    - name: http
      port: 80
      targetPort: 8080
    - name: metrics
      port: 9090
      targetPort: 9090

Network Policies

Control traffic to services:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 8080

Best Practices

Service Configuration

1. Use named ports for flexibility
2. Set appropriate service type based on exposure needs
3. Use labels and selectors consistently across Deployments and Services
4. Configure session affinity for stateful apps
5. Set external traffic policy to Local for IP preservation
6. Use headless services for StatefulSets
7. Implement network policies for security
8. Add monitoring annotations for observability

Production Checklist

• Service type appropriate for use case
• Selector matches pod labels
• Named ports used for clarity
• Session affinity configured if needed
• Traffic policy set appropriately
• Load balancer annotations configured (if applicable)
• Source IP ranges restricted (for public services)
• Health check configuration validated
• Monitoring annotations added
• Network policies defined

Performance Tuning

For high traffic:

spec:
  externalTrafficPolicy: Local
  sessionAffinity: ClientIP
  sessionAffinityConfig:
    clientIP:
      timeoutSeconds: 3600

For WebSocket/long connections:

spec:
  sessionAffinity: ClientIP
  sessionAffinityConfig:
    clientIP:
      timeoutSeconds: 86400 # 24 hours

Troubleshooting

Service not accessible

# Check service exists
kubectl get service <service-name>

# Check endpoints (should show pod IPs)
kubectl get endpoints <service-name>

# Describe service
kubectl describe service <service-name>

# Check if pods match selector
kubectl get pods -l app=<app-name>

Common issues:

• Selector doesn't match pod labels
• No pods running (endpoints empty)
• Ports misconfigured
• Network policy blocking traffic

DNS resolution failing

# Test DNS from pod
kubectl run debug --rm -it --image=busybox -- nslookup <service-name>

# Check CoreDNS
kubectl get pods -n kube-system -l k8s-app=kube-dns
kubectl logs -n kube-system -l k8s-app=kube-dns

Load balancer issues

# Check load balancer status
kubectl describe service <service-name>

# Check events
kubectl get events --sort-by='.lastTimestamp'

# Verify cloud provider configuration
kubectl describe node

Related Resources

• Kubernetes Service API Reference
• Service Networking
• DNS for Services and Pods

Output Format

<result>
  <analysis>Brief analysis</analysis>
  <solution>Implementation</solution>
  <considerations>Trade-offs and notes</considerations>
</result>