# Fix Kubernetes Service Endpoints Empty

You created a Kubernetes Service to expose your application, but when you check the endpoints, there's nothing there. No IP addresses, no targets. Your service is configured, but it can't find any pods to route traffic to.

This guide helps you diagnose and fix Kubernetes services with no endpoints, solving selector mismatches, pod readiness, and traffic routing issues.

Introduction

You are seeing a Kubernetes Service configured but with no endpoints. The service can't find any pods to route traffic to. This guide helps you diagnose and fix Kubernetes services with no endpoints, solving selector mismatches, pod readiness, and traffic routing issues.

Symptoms

Kubernetes empty endpoints issues present with: - Service exists but has no endpoints - No IP addresses in endpoints list - Traffic not routing to pods - Selector not matching any pods - Pods not becoming ready

Common Causes and Solutions

```bash # Check service exists and has correct selector kubectl get service service-name -n namespace -o wide kubectl describe service service-name -n namespace

# Check endpoints - this is where you'll see the problem kubectl get endpoints service-name -n namespace kubectl describe endpoints service-name -n namespace

# Check endpoint slices (newer Kubernetes versions) kubectl get endpointslices -n namespace -l kubernetes.io/service-name=service-name ```

```bash # List pods with their labels kubectl get pods -n namespace --show-labels

# List pods matching a specific label kubectl get pods -n namespace -l app=your-app

# Get pod labels in detail kubectl get pods -n namespace -o custom-columns='NAME:.metadata.name,LABELS:.metadata.labels' ```

```bash # Check if pods are ready kubectl get pods -n namespace

# Check pod readiness condition kubectl get pods -n namespace -o jsonpath='{.items[*].status.conditions[?(@.type=="Ready")].status}'

# Check pod ports kubectl get pods -n namespace -o jsonpath='{.items[*].spec.containers[*].ports}' ```

Common Causes

  • Configuration misconfiguration
  • Missing or incorrect credentials
  • Network connectivity issues
  • Version compatibility problems
  • Resource exhaustion or limits
  • Permission or access denied

Understanding Service Endpoints

Kubernetes Services use label selectors to find pods. When a Service's selector matches a pod's labels, and that pod is ready (passing readiness probes), the pod's IP is added to the Service's endpoints. Empty endpoints mean no pods match these criteria.

The endpoint population happens automatically, but several things can break this chain: selector mismatches, pods not ready, different namespaces, or ports not matching.

Step-by-Step Fix

Start by checking the service and its endpoints:

```bash # Check service exists and has correct selector kubectl get service service-name -n namespace -o wide kubectl describe service service-name -n namespace

# Check endpoints - this is where you'll see the problem kubectl get endpoints service-name -n namespace kubectl describe endpoints service-name -n namespace

# Check endpoint slices (newer Kubernetes versions) kubectl get endpointslices -n namespace -l kubernetes.io/service-name=service-name ```

Check the pod labels:

```bash # List pods with their labels kubectl get pods -n namespace --show-labels

# List pods matching a specific label kubectl get pods -n namespace -l app=your-app

# Get pod labels in detail kubectl get pods -n namespace -o custom-columns='NAME:.metadata.name,LABELS:.metadata.labels' ```

Check pod readiness:

```bash # Check if pods are ready kubectl get pods -n namespace

# Check pod readiness condition kubectl get pods -n namespace -o jsonpath='{.items[*].status.conditions[?(@.type=="Ready")].status}'

# Check pod ports kubectl get pods -n namespace -o jsonpath='{.items[*].spec.containers[*].ports}' ```

Common Solutions

Solution 1: Fix Label Selector Mismatch

The most common cause - the service selector doesn't match pod labels:

```bash # Check service selector kubectl get service service-name -n namespace -o jsonpath='{.spec.selector}' # Output: {"app":"myapp"}

# Check pod labels kubectl get pods -n namespace -l app=myapp --show-labels

# If no pods match, check actual pod labels kubectl get pods -n namespace --show-labels ```

Fix the service selector to match pod labels:

```yaml # Service with incorrect selector apiVersion: v1 kind: Service metadata: name: my-service spec: selector: app: myapp-wrong # This doesn't match pod labels ports: - port: 80 targetPort: 8080

# Fix: Update selector to match pod labels apiVersion: v1 kind: Service metadata: name: my-service spec: selector: app: myapp-correct # Matches pod label app: myapp-correct ports: - port: 80 targetPort: 8080 ```

Apply the fix:

```bash # Update service selector kubectl apply -f service.yaml

# Or patch directly kubectl patch service my-service -n namespace -p '{"spec":{"selector":{"app":"myapp-correct"}}}' ```

Solution 2: Fix Namespace Mismatch

Services and pods must be in the same namespace:

```bash # Check service namespace kubectl get service my-service --all-namespaces

# Check pod namespace kubectl get pods -A -l app=myapp ```

If they're in different namespaces, recreate the service in the correct namespace:

yaml
apiVersion: v1
kind: Service
metadata:
  name: my-service
  namespace: correct-namespace  # Same namespace as pods
spec:
  selector:
    app: myapp
  ports:
  - port: 80
    targetPort: 8080

Solution 3: Fix Pods Not Ready

Pods must be ready to be added to endpoints:

```bash # Check pod readiness kubectl get pods -n namespace -l app=myapp

# If pods show 0/1 Ready, check why kubectl describe pod pod-name -n namespace

# Check readiness probe status kubectl describe pod pod-name -n namespace | grep -A 5 Readiness ```

Fix failing readiness probes:

```yaml # Pod with failing readiness probe containers: - name: app readinessProbe: httpGet: path: /health port: 8080 initialDelaySeconds: 5 periodSeconds: 10

# Fix: Ensure the endpoint exists and returns 200 # Or increase initial delay if app takes time to start readinessProbe: httpGet: path: /health port: 8080 initialDelaySeconds: 30 # Increased for slow-starting apps periodSeconds: 10 failureThreshold: 3 ```

Test the readiness endpoint:

```bash # Test from inside the pod kubectl exec -it pod-name -n namespace -- curl -v http://localhost:8080/health

# Check application logs kubectl logs pod-name -n namespace ```

Solution 4: Fix Port Mismatch

The service targetPort must match the container port:

```bash # Check service targetPort kubectl get service my-service -n namespace -o jsonpath='{.spec.ports[*].targetPort}'

# Check container ports kubectl get pods -n namespace -o jsonpath='{.items[*].spec.containers[*].ports}' ```

Fix port configuration:

```yaml # Service targeting wrong port apiVersion: v1 kind: Service metadata: name: my-service spec: selector: app: myapp ports: - port: 80 targetPort: 8080 # Container must listen on this port

# Check pod container port containers: - name: app ports: - containerPort: 9090 # Mismatch! Should be 8080 or update service

# Fix: Either update container port or service targetPort # Option 1: Update service targetPort ports: - port: 80 targetPort: 9090 # Match container port

# Option 2: Update container port ports: - containerPort: 8080 # Match service targetPort ```

Solution 5: Fix Headless Service Configuration

Headless services (clusterIP: None) need special handling:

bash
# Check if service is headless
kubectl get service my-service -n namespace -o jsonpath='{.spec.clusterIP}'
# "None" means headless service

Headless services rely on DNS and require the selector:

yaml
apiVersion: v1
kind: Service
metadata:
  name: my-headless-service
spec:
  clusterIP: None  # Headless service
  selector:
    app: myapp    # Still needs selector for endpoints
  ports:
  - port: 80
    targetPort: 8080

Solution 6: Fix EndpointSlice Issues

In newer Kubernetes, EndpointSlices replace Endpoints:

```bash # Check endpoint slices kubectl get endpointslices -n namespace

# Describe specific slice kubectl describe endpointslice my-service-xyz -n namespace ```

Solution 7: Manually Create Endpoints (Advanced)

For special cases, you can manually create endpoints (without selector):

yaml
apiVersion: v1
kind: Service
metadata:
  name: my-external-service
spec:
  # No selector - endpoints created manually
  ports:
  - port: 80
    targetPort: 80
---
apiVersion: v1
kind: Endpoints
metadata:
  name: my-external-service  # Must match service name
subsets:
  - addresses:
      - ip: 192.168.1.100  # External IP
      - ip: 192.168.1.101
    ports:
      - port: 80

Verification

After fixing the issue:

```bash # Check endpoints are populated kubectl get endpoints my-service -n namespace

# Verify endpoint IPs match pod IPs kubectl get pods -n namespace -o wide kubectl describe endpoints my-service -n namespace

# Test service connectivity kubectl run test --rm -it --image=busybox -- wget -qO- my-service.namespace.svc.cluster.local:80

# Check service DNS resolution kubectl run test --rm -it --image=busybox -- nslookup my-service.namespace ```

Empty Endpoints Causes Summary

CauseCheckSolution
Selector mismatchkubectl describe svc vs kubectl get pods --show-labelsUpdate service selector
Namespace mismatchService and pod namespaces differRecreate in same namespace
Pods not readykubectl get pods shows 0/1 ReadyFix readiness probe
Port mismatchtargetPort vs containerPortAlign port configuration
Headless serviceclusterIP: None without selectorAdd selector or manual endpoints
No pods existkubectl get pods -l selector emptyDeploy pods first

Prevention

Use consistent labeling across deployments and services. Implement meaningful readiness probes. Use named ports for flexibility. Verify service selectors after changes. Use kubectl get endpoints as part of deployment verification. Label resources consistently with app, version, and environment.

Empty service endpoints are almost always a labeling or readiness issue. The kubectl describe service command shows you the selector, and kubectl get pods --show-labels shows you what labels are actually on your pods - compare them and you'll usually find the mismatch.

  • [Fix Envoy Rate Limit Configuration with envoyproxy/ratelimit](envoyproxy-ratelimit-configuration-guide)
  • [Fix Fix Argocd App Not Syncing Issue in Kubernetes](fix-argocd-app-not-syncing)
  • [Fix Fix Argocd Sync Conflict Issue in Kubernetes](fix-argocd-sync-conflict)
  • [Fix ArgoCD Sync Timeout](fix-argocd-sync-timeout)
  • [How to Fix Cilium Identity Exhaustion and Endpoint Allocation Failed](fix-cilium-identity-exhaustion)

<script type="application/ld+json"> { "@context": "https://schema.org", "@type": "TechArticle", "headline": "Fix Kubernetes Service Endpoints Empty", "description": "Learn how to diagnose and fix Kubernetes services with no endpoints, solving selector mismatches, pod readiness, and traffic routing issues.", "url": "https://www.fixwikihub.com/fix-kubernetes-service-endpoints-empty", "publisher": { "@type": "Organization", "name": "FixWikiHub", "url": "https://www.fixwikihub.com" }, "author": { "@type": "Person", "name": "FixWikiHub Editorial Team" }, "datePublished": "2025-11-26T23:26:06.552Z", "dateModified": "2025-11-26T23:26:06.552Z" } </script>