Service has no endpoints — the empty EndpointSlice

A Service with no endpoints is one whose EndpointSlice is empty. The diagnostic is the selector, the Pod labels, and the Pod readiness. The remediation is to fix the mismatch. The discipline is to compare the selector to the Pod labels.

The EndpointSlice

The EndpointSlice is the controller’s authoritative view of the Pods that the Service routes to. The EndpointSlice controller watches all Pods and populates the slice with Pods that match the Service’s selector and have ready: true.

flowchart TD
    A[Service selector] --> B{Selector matches Pods?}
    B -->|Yes| C{Pods are Ready?}
    B -->|No| D[Empty EndpointSlice]
    C -->|Yes| E[Pod in EndpointSlice]
    C -->|No| F[Pod not in EndpointSlice]

A Service with no endpoints has an empty EndpointSlice. The two branches above are the only causes: the selector matched no Pod, or every matching Pod is not Ready.

The diagnostic

The canonical diagnostic:

# 1. Get the Service's spec
kubectl get service billing -n prod -o yaml

# 2. Get the EndpointSlice
kubectl get endpointslices -n prod -l kubernetes.io/service-name=billing -o yaml

# 3. Get the Pods and their labels
kubectl get pods -n prod -l app=billing -o wide --show-labels

# 4. Get the Pods' readiness
kubectl get pods -n prod -l app=billing -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.status.conditions[?(@.type=="Ready")].status}{"\n"}{end}'

The output tells the operator:

• The Service’s selector.
• The EndpointSlice’s contents.
• The Pods’ labels and readiness.

Common causes

The most common causes of a Service with no endpoints:

1. Selector mismatch. The Service’s selector does not match the Pods’ labels. The EndpointSlice is empty.
2. All Pods are not Ready. The Pods match the selector, but no Pod is Ready. The EndpointSlice has Pods with ready: false.
3. No Pods exist. The Deployment’s Pods are not running (Pending, CrashLoopBackOff). The EndpointSlice is empty.
4. Service was created without a selector. The Service was created without a selector, so the EndpointSlice controller does not populate the slice.

flowchart TD
    A[Empty EndpointSlice] --> B{Selector mismatch?}
    B -->|Yes| C[Fix selector or labels]
    B -->|No| D{All Pods not Ready?}
    D -->|Yes| E[Fix readiness]
    D -->|No| F{No Pods exist?}
    F -->|Yes| G[Fix Pods]
    F -->|No| H[No selector on Service]
    H --> I[Add selector or manually populate endpoints]

The diagnostic is the comparison.

The selector mismatch remediation

The selector mismatch is the most common cause. The remediation is to fix the selector or the labels:

# Option 1: Fix the Service's selector
kubectl patch service billing -n prod -p '{"spec":{"selector":{"app":"billing"}}}'

# Option 2: Fix the Pod's labels (via the Deployment)
kubectl patch deployment billing -n prod -p '{"spec":{"template":{"metadata":{"labels":{"tier":"api"}}}}}'

The remediation is the mismatch resolution.

The readiness probe remediation

The readiness probe remediation is to fix the probe or the application:

# Option 1: Fix the probe's configuration
kubectl set probe deployment/billing -n prod \
  --readiness=http-get=/health:8080

# Option 2: Fix the application
kubectl set image deployment/billing -n prod \
  billing=registry.example.com/billing:1.2.4

The remediation is the readiness recovery.

Production discipline

An empty EndpointSlice is the cluster’s hypothesis. The discipline is to compare the selector to the Pod labels, the readiness to the application’s state. The diagnostic is the EndpointSlice controller’s view; the remediation is the mismatch resolution.

• Compare the readiness to the Pod state. The EndpointSlice only includes Ready Pods.
• Compare the Pods to the Deployment. The Pods must exist for the EndpointSlice to be populated.

Quiz