Kubernetes Service Has No Endpoints (Connection Refused)

Traffic to a Service just hangs or is refused, even though the pods look fine. The fastest tell is the Service's endpoints:

kubectl get endpoints my-svc
# NAME     ENDPOINTS   AGE
# my-svc   <none>      10m

<none> is the whole story. A Kubernetes Service doesn't route to pods directly — it routes to the endpoints it builds from pods whose labels match its selector. No endpoints means the Service found no matching, Ready pods, so requests go nowhere.

Cause 1: The selector doesn't match the pod labels

This is the big one. Compare the two:

kubectl get svc my-svc -o jsonpath='{.spec.selector}'   # e.g. {"app":"web"}
kubectl get pods --show-labels                           # do any pods carry app=web?

If the Service selects app=web but your pods are labelled app=webapp, they'll never be linked. Make them match — fix the Service selector or the pod template labels. They must be identical, key and value.

Cause 2: The pods aren't Ready

A Service only adds Ready pods to its endpoints. If a readiness probe is failing, the pod runs but is deliberately kept out of rotation:

kubectl get pods -l app=web      # READY column shows 0/1?

Fix the readiness probe (wrong path/port, or too strict) so the pod reports Ready — and watch the endpoint appear.

Cause 3: targetPort points at the wrong container port

If endpoints exist but connections still fail, check that the Service's targetPort matches the port the container actually listens on:

ports:
  - port: 80          # the Service's port
    targetPort: 8080  # MUST equal the container's listening port

A Service on targetPort: 80 in front of an app listening on 8080 will accept the connection and then refuse it.

The checklist

1. kubectl get endpoints <svc> — <none> means no matching Ready pods.
2. Compare the Service selector to the pods' actual labels; make them identical.
3. Check the pods are Ready (0/1 = a failing readiness probe keeps them out).
4. Confirm targetPort equals the container's real listening port.
5. Endpoints populated + right port = the Service will route.

Frequently Asked Questions

How do I check a Service's endpoints?

Run kubectl get endpoints <svc>. If it shows <none>, the Service found no matching, Ready pods to route to.

Why doesn't my Service selector match my pods?

The Service selector labels must match the pod template labels exactly — same key and value. Compare them with kubectl get pods --show-labels.

My pods are running but the Service has no endpoints — why?

A Service only adds Ready pods to its endpoints. A failing readiness probe keeps a running pod out of rotation, so fix the probe.