EndpointSlices — the scalable service-to-Pod mapping

EndpointSlices are the scalable replacement for Endpoints. The Service is split into multiple slices (default 100 endpoints per slice) for scalability. The kube-proxy reads the EndpointSlices and programs the iptables or IPVS rules. This lesson walks the EndpointSlice, the controller, and the operational discipline.

Why EndpointSlices

The legacy Endpoints object is a single API object that lists every Pod IP for the Service. A Service with 10,000 Pods produces an Endpoints object with 10,000 entries. Every update (Pod creation, deletion, or readiness change) updates the entire Endpoints object; the kube-proxy must re-read the entire object.

The EndpointSlice object splits the backends into multiple slices. Each slice has up to 100 endpoints. The kube-proxy reads only the slices that change. The result is a scalable, low-latency data plane.

flowchart LR
    A[Service billing] --> B[EndpointSlice billing-abc]
    A --> C[EndpointSlice billing-def]
    A --> D[EndpointSlice billing-ghi]
    B --> E[Pod 1, 2, 3, ...]
    B --> F[Pod 100]
    C --> G[Pod 101, 102, ...]
    D --> H[Pod 901, 902, ...]

The slices are independently updated. The kube-proxy only watches the slices that change.

The EndpointSlice manifest

The EndpointSlice is an API object:

apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
  name: billing-abc123
  namespace: prod-app
  labels:
    kubernetes.io/service-name: billing
addressType: IPv4
endpoints:
  - addresses:
      - 10.244.1.5
    conditions:
      ready: true
    targetRef:
      kind: Pod
      name: billing-7d4
      namespace: prod-app
  - addresses:
      - 10.244.1.6
    conditions:
      ready: true
    targetRef:
      kind: Pod
      name: billing-8e5
      namespace: prod-app
ports:
  - name: http
    port: 8080
    protocol: TCP

The endpoints have addresses, conditions (ready, serving, terminating), and a targetRef. The ports list the Service’s ports.

The EndpointSlice controller

The controller-manager includes the EndpointSlice controller. The controller:

1. Watches every Service.
2. Watches every Pod with a label matching a Service’s selector.
3. Reconciles the EndpointSlices for each Service.

The controller creates, updates, and deletes slices based on the Pod’s state. The default maxEndpoints per slice is 100; the cluster operator can configure it via the endpoint-slice-controller flag.

The kube-proxy integration

The kube-proxy reads the EndpointSlices and programs the iptables or IPVS rules. The kube-proxy watches the EndpointSlices by the kubernetes.io/service-name label.

# The kube-proxy's view
kubectl get endpointslices -l kubernetes.io/service-name=billing

NAME             ADDRESSTYPE   PORTS   ENDPOINTS
billing-abc123   IPv4          8080    10.244.1.5,10.244.1.6,10.244.2.5
billing-def456   IPv4          8080    10.244.2.6,10.244.3.5
billing-ghi789   IPv4          8080    10.244.3.6,10.244.4.5

The kube-proxy’s data plane is the union of the slices. The rules are updated when the slices change.

The EndpointSlice and topology

The EndpointSlice supports topology hints:

apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
  name: billing-abc123
  namespace: prod-app
  labels:
    kubernetes.io/service-name: billing
addressType: IPv4
endpoints:
  - addresses:
      - 10.244.1.5
    zone: us-east-1a
    nodeName: node-1
  - addresses:
      - 10.244.1.6
    zone: us-east-1b
    nodeName: node-2

The zone and nodeName fields are used by the kube-proxy to prefer local Pods. The topology hints are populated by the EndpointSlice controller.

The failure modes

The EndpointSlice’s failure modes:

• Controller down: the EndpointSlices are not updated. The fix is to restart the controller.
• Selector mismatch: the EndpointSlice is empty. The fix is to verify the selector.
• Pod not Ready: the Pod’s ready condition is false; the Pod is not in the EndpointSlice. The fix is to verify the readiness probe.
• Stale slice: the slice is not updated when a Pod is deleted. The fix is to restart the controller.
• Slicing issue: the slice grows beyond the maxEndpoints. The fix is to verify the controller’s configuration.

The operational discipline

The EndpointSlice’s operational discipline:

• Audit the EndpointSlice for every Service. The cluster operator must verify the slices are healthy.
• Monitor the slice count. A growing slice count is a leading indicator of Pod churn.
• Test the Service in staging. The EndpointSlice must be correct for the workload.
• Document the slicing configuration. The cluster operator must understand the slicing.
• Plan the slicing’s evolution. The slicing can be tuned for performance.

Quiz

Production discipline

• EndpointSlices are the default discovery API. The Endpoints object is for backward compatibility.
• The default maxEndpoints per slice is 100. The cluster operator can tune it.
• Audit the EndpointSlice for every Service. The cluster operator must verify the slices are healthy.
• Monitor the slice count. A growing slice count is a leading indicator of Pod churn.
• Test the Service in staging. The EndpointSlice must be correct for the workload.
• Document the slicing configuration. The cluster operator must understand the slicing.
• Plan the slicing’s evolution. The slicing can be tuned for performance.
• Verify the kube-proxy’s data plane. The kube-proxy reads the slices; the iptables/IPVS rules must be correct.