kubernetes-networkinglisted

# Kubernetes Networking Follow a request through the five hops between a client and a container, and find the one that drops it. ## Purpose **Use this when:** - `kubectl get endpoints <svc>` is empty or short. - An Ingress or load balancer returns 502, 503 or 504 while pods are Ready. - Service A cannot reach Service B: connection refused, timeout, or `no such host`. - A NetworkPolicy was added and something stopped working. - An external `LoadBalancer` Service is stuck `<pending>`. **Do not use this when:** - Pods are not Ready — fix that first with `kubernetes-troubleshooting`. An empty endpoint list is a *symptom* of unready pods far more often than a networking fault. - The failure is TLS handshake or certificate validation — use `tls-debugging`. - The failure is outside the cluster entirely — use `dns-troubleshooting` or `http-debugging`. **What this skill assumes:** read access to the namespace, and the ability to run a debug pod or `kubectl exec` into an existing one. Without in-cluster execution you can only inspect objects, which is rarely enough. ## Operating Procedure The request path has five hops. Test them **in order, from the pod outwards** — starting at the ingress means you retest four working hops before finding the broken one. 1. **Pod** — does the process listen on the port, inside the pod? 2. **Endpoints** — does the Service select the pod, and is the pod Ready? 3. **Service** — does the ClusterIP route, and does `targetPort` match the contain