How to Expose a Kubernetes Deployment with a Service

Why you need a Service

A Kubernetes Deployment manages a set of pods, but pod IPs are ephemeral - they change every time a pod restarts or reschedules. A Service sits in front of the pods and gives them a stable in-cluster DNS name and IP. Without one, nothing else in the cluster can reach your app reliably.

The three things that must line up

A ClusterIP Service connects to your pods through three pieces of wiring:

1. selector - must match a label on the pod template in the Deployment (e.g. app: web)
2. port - the port the Service itself listens on (what callers dial)
3. targetPort - the port the container is actually listening on

If the selector doesn't match any pod labels, the Service has zero endpoints and traffic goes nowhere - no error, just silence.

Writing service.yaml

Given a Deployment whose pod template has labels: {app: web} and whose container listens on port 80:

apiVersion: v1
kind: Service
metadata:
  name: web
spec:
  type: ClusterIP
  selector:
    app: web       # must match pod template labels exactly
  ports:
  - port: 80
    targetPort: 80  # the port your container listens on

Apply it and confirm the Service picked up endpoints:

kubectl apply -f service.yaml
kubectl get svc web
kubectl get endpoints web

A healthy output from kubectl get endpoints web shows at least one IP:PORT entry. If the ENDPOINTS column shows <none>, the selector is wrong - compare it to the pod labels with kubectl get pods --show-labels.

Verifying connectivity

Once endpoints are populated you can reach the Service by its DNS name from any pod in the same namespace:

kubectl run curl-test --image=curlimages/curl --rm -it --restart=Never \
  -- curl -s http://web/

Or kubectl port-forward svc/web 8080:80 to hit it from your local machine.

Common mistakes

• Selector typo - app: Web vs app: web is a mismatch; labels are case-sensitive.
• Wrong targetPort - the Service points at port 80 but the container listens on 8080; curl gets a Connection refused from inside the pod.
• Missing Service entirely - kubectl get svc returns nothing for the name while kubectl get pods shows the Deployment running. Create and apply the Service manifest to wire it up.