Skip to content

Room 16

CLUSTERIP SERVICES

The Internal Network

  • Services provide stable network endpoints for ephemeral pods.
  • A ClusterIP service is the default - only reachable within the cluster. Wire up the connections.

📜 Mission Briefing

  1. Apply backend-deploy.yaml - a deployment with 3 nginx pods.
  2. Create a ClusterIP service to expose the deployment: service.yaml.
  3. Verify the service has endpoints: kubectl get endpoints.
  4. Create a temporary pod to test connectivity: 
    kubectl run test --image=busybox --rm -it -- wget -qO- http://backend-svc
  5. The nginx pods serve a page that contains the password.
  6. The password is clusterip.
Key Commands
Command Purpose
kubectl get svc List services
kubectl describe svc NAME Service details
kubectl get endpoints NAME Service endpoints
kubectl expose deployment NAME --port=PORT Create service
kubectl port-forward svc/NAME LOCAL:REMOTE Local access
How Services Work
apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  type: ClusterIP            # Default type
  selector:
    app: my-app              # Matches pod labels
  ports:
    - port: 80               # Service port
      targetPort: 8080       # Container port
      protocol: TCP

# Service types:
# ClusterIP (default): Internal-only virtual IP
# NodePort: Exposes on each node's IP at a static port
# LoadBalancer: Provisions external load balancer
# ExternalName: Maps to DNS name (CNAME)

# Create service imperatively
kubectl expose deployment my-app --port=80 --target-port=8080

# Service DNS: <service>.<namespace>.svc.cluster.local
# Short forms: <service> (same namespace), <service>.<namespace>

# Test connectivity from within the cluster
kubectl run test --image=busybox --rm -it --restart=Never -- \
  wget -qO- http://my-service.default.svc.cluster.local

# Check endpoints (pod IPs backing the service)
kubectl get endpoints my-service

# Port-forward for local testing
kubectl port-forward svc/my-service 8080:80
Hints

Hint 1

Apply the deployment and service: 

kubectl apply -f backend-deploy.yaml
kubectl apply -f service.yaml

Hint 2

Test the service: 

kubectl run test --image=busybox --rm -it --restart=Never -- \
  wget -qO- http://backend-svc

Hint 3

The password is clusterip.

🔓 Unlock Room 17

openssl enc -aes-256-cbc -d -a -pbkdf2 \
        -in ../room_17/README             \
        -out ../room_17/README.txt        \
        -pass pass:PASSWORD
cat ../room_17/README.txt