Endpoints <none>·no endpoints available 7가지 원인과 30초 진단법

Endpoints:         <none>

Client Pod
  → DNS 조회 (my-svc.default.svc.cluster.local → 10.96.x.x)   [1편 영역]
  → ClusterIP 10.96.x.x:8080
  → kube-proxy가 설치한 DNAT 룰 (iptables / IPVS / nftables)
  → EndpointSlice에 등록된 Pod IP:targetPort 목록
  → Pod IP 10.244.x.x:8080                                   [4편 영역]

SVC=my-svc
NS=default

# 1) 레거시 Endpoints 객체 확인 (가장 빠른 신호)
kubectl -n "$NS" get endpoints "$SVC"

# 2) EndpointSlice 확인 (1.21+ 실제 소스 오브 트루스)
kubectl -n "$NS" get endpointslices -l "kubernetes.io/service-name=$SVC" -o wide

# 3) Service 정의와 이벤트
kubectl -n "$NS" describe svc "$SVC"

# 4) Service selector 원문
kubectl -n "$NS" get svc "$SVC" -o jsonpath='{.spec.selector}{"\n"}'

# 5) 파드 라벨 전량 확인
kubectl -n "$NS" get pods --show-labels

# 6) selector로 실제 매칭되는 파드 수
kubectl -n "$NS" get pods -l "$(kubectl -n "$NS" get svc "$SVC" -o jsonpath='{range .spec.selector.*}{"\n"}{end}' >/dev/null; kubectl -n "$NS" get svc "$SVC" -o jsonpath='{.spec.selector}' | tr -d '{}"' | tr ',' ',')"

NAME     ENDPOINTS                                   AGE
my-svc   10.244.1.7:8080,10.244.2.9:8080             12d

kubectl -n default run tmp-netshoot --rm -it --restart=Never \
  --image=nicolaka/netshoot -- /bin/bash

# ① Pod IP 직접 (Service를 건너뜀)
curl -sS -m 3 -o /dev/null -w "podip:%{http_code}\n" http://10.244.1.7:8080/

# ② ClusterIP
curl -sS -m 3 -o /dev/null -w "clusterip:%{http_code}\n" http://10.96.30.11:8080/

# ③ NodePort (해당 서비스가 NodePort 타입일 때)
curl -sS -m 3 -o /dev/null -w "nodeport:%{http_code}\n" http://192.168.10.21:30080/

kubectl -n default exec -it deploy/web -- sh -c "ss -lntp || netstat -lntp"

#!/usr/bin/env bash
# svc-diag.sh — Service/Endpoint 결합 상태 일괄 점검
# usage: ./svc-diag.sh <service-name> [namespace]
set -euo pipefail

SVC="${1:?service name required}"
NS="${2:-default}"

line() { printf '\n=== %s ===\n' "$1"; }

line "Service spec"
kubectl -n "$NS" get svc "$SVC" -o yaml | grep -E 'clusterIP:|type:|externalTrafficPolicy:|publishNotReadyAddresses:' || true

line "Selector"
SELECTOR=$(kubectl -n "$NS" get svc "$SVC" -o jsonpath='{.spec.selector}')
echo "raw: ${SELECTOR:-<empty>}"

line "Ports (port -> targetPort)"
kubectl -n "$NS" get svc "$SVC" \
  -o jsonpath='{range .spec.ports[*]}{.name}{" "}{.port}{" -> "}{.targetPort}{"\n"}{end}'

line "Endpoints (legacy)"
kubectl -n "$NS" get endpoints "$SVC" -o wide || echo "no endpoints object"

line "EndpointSlices"
kubectl -n "$NS" get endpointslices -l "kubernetes.io/service-name=$SVC" -o wide || true

line "EndpointSlice ready conditions"
kubectl -n "$NS" get endpointslices -l "kubernetes.io/service-name=$SVC" \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{range .endpoints[*]}{.addresses[0]}{"=ready:"}{.conditions.ready}{" "}{end}{"\n"}{end}' || true

line "Matching pods"
SEL_KV=$(kubectl -n "$NS" get svc "$SVC" \
  -o jsonpath='{range .spec.selector}{@}{end}' | tr -d '{}"' )
if [ -n "$SEL_KV" ]; then
  kubectl -n "$NS" get pods -l "$SEL_KV" -o wide || true
else
  echo "selector is empty (selector-less Service: manual EndpointSlice required)"
fi

line "All pod labels in namespace"
kubectl -n "$NS" get pods --show-labels

line "Recent events"
kubectl -n "$NS" get events --sort-by=.lastTimestamp | tail -20

chmod +x svc-diag.sh
./svc-diag.sh my-svc default

# 잘못된 버전
apiVersion: v1
kind: Service
metadata:
  name: my-svc
  namespace: default
spec:
  selector:
    app: web          # 파드 라벨은 web-api
  ports:
    - port: 8080
      targetPort: 8080

# 수정 버전
apiVersion: v1
kind: Service
metadata:
  name: my-svc
  namespace: default
spec:
  selector:
    app: web-api
  ports:
    - name: http
      port: 8080
      targetPort: 8080
      protocol: TCP

kubectl -n default get pods -l app=web

# 잘못된 버전: Service는 http라는 이름을 찾는데 컨테이너에 이름이 없음
apiVersion: v1
kind: Service
metadata:
  name: my-svc
spec:
  selector:
    app: web-api
  ports:
    - port: 8080
      targetPort: http
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
spec:
  replicas: 2
  selector:
    matchLabels:
      app: web-api
  template:
    metadata:
      labels:
        app: web-api
    spec:
      containers:
        - name: app
          image: nginx:1.27
          ports:
            - containerPort: 8080   # name 지정 누락

# 수정 버전: 컨테이너 포트에 name: http 정의
apiVersion: v1
kind: Service
metadata:
  name: my-svc
spec:
  selector:
    app: web-api
  ports:
    - name: http
      port: 8080
      targetPort: http
      protocol: TCP
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
spec:
  replicas: 2
  selector:
    matchLabels:
      app: web-api
  template:
    metadata:
      labels:
        app: web-api
    spec:
      containers:
        - name: app
          image: nginx:1.27
          ports:
            - name: http
              containerPort: 8080
              protocol: TCP

kubectl -n default get endpointslices -l kubernetes.io/service-name=my-svc \
  -o jsonpath='{range .items[*]}{range .ports[*]}{.name}{":"}{.port}{"\n"}{end}{end}'

kubectl -n default get pods -l app=web-api
kubectl -n default describe pod <pod-name> | grep -A5 "Readiness"

NAME                   READY   STATUS    RESTARTS   AGE
web-6f9c8d5b4c-2xk7p   0/1     Running   0          3m

apiVersion: v1
kind: Service
metadata:
  name: db-headless
spec:
  clusterIP: None
  publishNotReadyAddresses: true
  selector:
    app: postgres
  ports:
    - name: pg
      port: 5432
      targetPort: 5432

kubectl get pods -A -l app=web-api -o wide

curl -sS http://my-svc.prod.svc.cluster.local:8080/healthz

apiVersion: v1
kind: Service
metadata:
  name: my-svc
  namespace: default
spec:
  type: ExternalName
  externalName: my-svc.prod.svc.cluster.local

# 잘못된 버전: 일반 API 서비스인데 headless
apiVersion: v1
kind: Service
metadata:
  name: my-svc
spec:
  clusterIP: None
  selector:
    app: web-api
  ports:
    - port: 8080
      targetPort: 8080

# 수정 버전: ClusterIP 할당
apiVersion: v1
kind: Service
metadata:
  name: my-svc
spec:
  type: ClusterIP
  selector:
    app: web-api
  ports:
    - name: http
      port: 8080
      targetPort: 8080

kubectl -n default delete svc my-svc
kubectl -n default apply -f my-svc-fixed.yaml

kubectl run dnsq --rm -it --restart=Never --image=nicolaka/netshoot -- \
  dig +short my-svc.default.svc.cluster.local

apiVersion: v1
kind: Service
metadata:
  name: legacy-db
  namespace: default
spec:
  ports:
    - name: pg
      port: 5432
      targetPort: 5432
      protocol: TCP
---
apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
  name: legacy-db-1
  namespace: default
  labels:
    kubernetes.io/service-name: legacy-db
addressType: IPv4
ports:
  - name: pg
    port: 5432
    protocol: TCP
endpoints:
  - addresses:
      - "192.168.50.31"
    conditions:
      ready: true

kubectl -n default apply -f legacy-db.yaml
kubectl -n default get endpointslices -l kubernetes.io/service-name=legacy-db -o wide

kubectl -n default get pods -l app=web-api -o wide

# 수정 버전: 노드당 1개만 뜨도록 anti-affinity 부여
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web-api
  template:
    metadata:
      labels:
        app: web-api
    spec:
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app: web-api
              topologyKey: kubernetes.io/hostname
      containers:
        - name: app
          image: nginx:1.27
          ports:
            - name: http
              containerPort: 8080

kubectl -n default get endpointslices -l kubernetes.io/service-name=my-svc \
  -o jsonpath='{range .items[*]}{range .endpoints[*]}{.addresses[0]}{"\n"}{end}{end}' \
  | sort -u | wc -l

kubectl -n kube-system get cm kube-proxy -o yaml | grep -i "mode"

# iptables 모드
sudo iptables-save | grep my-svc

# IPVS 모드
sudo ipvsadm -Ln | grep -A3 10.96.30.11

# nftables 모드 (1.31+ 에서 사용 가능)
sudo nft list ruleset | grep my-svc

kubectl -n default get svc my-svc -o jsonpath='{.spec.externalTrafficPolicy}{"\n"}'
kubectl -n default get pods -l app=web-api -o wide
kubectl get nodes -o name

# 1) 소스 IP 보존이 필수가 아니면 Cluster로 전환
kubectl -n default patch svc my-svc -p '{"spec":{"externalTrafficPolicy":"Cluster"}}'

# 2) Local을 유지해야 하면 모든 노드에 파드를 배치 (DaemonSet 또는 anti-affinity + 충분한 replicas)
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: web
spec:
  selector:
    matchLabels:
      app: web-api
  template:
    metadata:
      labels:
        app: web-api
    spec:
      containers:
        - name: app
          image: nginx:1.27
          ports:
            - name: http
              containerPort: 8080

#!/usr/bin/env bash
# validate-svc-match.sh — Service selector ↔ Deployment 라벨/포트 정합성 검증
# usage: ./validate-svc-match.sh deploy.yaml svc.yaml
set -euo pipefail

DEPLOY_FILE="${1:?deployment yaml required}"
SVC_FILE="${2:?service yaml required}"
FAIL=0

POD_LABELS=$(yq -o=json '.spec.template.metadata.labels' "$DEPLOY_FILE")
SELECTOR=$(yq -o=json '.spec.selector' "$SVC_FILE")

echo "pod labels : $POD_LABELS"
echo "selector   : $SELECTOR"

# selector의 모든 key/value가 pod labels에 포함되는지 검사
MISSING=$(echo "$SELECTOR" | jq -r --argjson labels "$POD_LABELS" \
  'to_entries[] | select(($labels[.key] // "") != .value) | .key')

if [ -n "$MISSING" ]; then
  echo "FAIL: selector keys not matched in pod labels -> $MISSING"
  FAIL=1
else
  echo "OK: selector matches pod labels"
fi

# targetPort가 숫자인 경우 containerPort 존재 확인
TARGET=$(yq '.spec.ports[0].targetPort' "$SVC_FILE")
if [[ "$TARGET" =~ ^[0-9]+$ ]]; then
  HIT=$(yq ".spec.template.spec.containers[].ports[] | select(.containerPort == $TARGET) | .containerPort" "$DEPLOY_FILE" || true)
  if [ -z "$HIT" ]; then
    echo "FAIL: targetPort $TARGET has no matching containerPort"
    FAIL=1
  else
    echo "OK: targetPort $TARGET matches containerPort"
  fi
else
  # named port인 경우 이름 정의 확인
  HIT=$(yq ".spec.template.spec.containers[].ports[] | select(.name == \"$TARGET\") | .name" "$DEPLOY_FILE" || true)
  if [ -z "$HIT" ]; then
    echo "FAIL: named targetPort '$TARGET' is not defined in containers[].ports[].name"
    FAIL=1
  else
    echo "OK: named port '$TARGET' defined"
  fi
fi

exit "$FAIL"

kubeconform -strict -summary -kubernetes-version 1.33.0 deploy.yaml svc.yaml

name: k8s-manifest-gate
on: [pull_request]
jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install tools
        run: |
          sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
          sudo chmod +x /usr/local/bin/yq
          curl -sSL https://github.com/yannh/kubeconform/releases/latest/download/kubeconform-linux-amd64.tar.gz | tar xz
          sudo mv kubeconform /usr/local/bin/
      - name: Schema validation
        run: kubeconform -strict -summary -kubernetes-version 1.33.0 manifests/
      - name: Selector/port match
        run: ./validate-svc-match.sh manifests/deploy.yaml manifests/svc.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
spec:
  replicas: 4
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 1
  selector:
    matchLabels:
      app: web-api
  template:
    metadata:
      labels:
        app: web-api
    spec:
      containers:
        - name: app
          image: nginx:1.27
          ports:
            - name: http
              containerPort: 8080
          startupProbe:
            httpGet:
              path: /healthz
              port: http
            failureThreshold: 30
            periodSeconds: 5
          readinessProbe:
            httpGet:
              path: /healthz
              port: http
            periodSeconds: 5
            timeoutSeconds: 2
            failureThreshold: 3
---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: web-pdb
spec:
  minAvailable: 2
  selector:
    matchLabels:
      app: web-api

apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: service-endpoint-rules
  namespace: monitoring
  labels:
    release: kube-prometheus-stack
spec:
  groups:
    - name: service-endpoints
      rules:
        - alert: ServiceHasNoEndpoints
          expr: |
            kube_endpoint_address_available == 0
            and on (namespace, service)
            label_replace(
              kube_service_spec_type{type!="ExternalName"},
              "service", "$1", "service", "(.*)"
            )
          for: 5m
          labels:
            severity: critical
          annotations:
            summary: "Service {{ $labels.namespace }}/{{ $labels.service }} has zero endpoints"
            description: "5분 이상 사용 가능한 엔드포인트가 0개입니다. selector 라벨, targetPort, readiness probe 순서로 확인하세요."
        - alert: ServiceEndpointsDropped
          expr: |
            delta(kube_endpoint_address_available[10m]) < 0
            and kube_endpoint_address_available < 2
          for: 10m
          labels:
            severity: warning
          annotations:
            summary: "Endpoints decreasing for {{ $labels.namespace }}/{{ $labels.service }}"
            description: "엔드포인트 수가 감소해 2개 미만입니다. 롤아웃 또는 readiness 실패 여부를 확인하세요."