Kubernetes Service has no endpoints ('kubectl get endpoints' shows <none>, connections refused or time out). Selector and label mismatch checklist

Cause: a Service only routes to pods that match its spec.selector AND are Ready. If the selector matches nothing, or all matching pods fail readiness, the Service has an empty endpoint list and traffic goes nowhere. Fix (best first): 1. Check endpoints: kubectl get endpoints SERVICE_NAME -n NAMESPACE (or kubectl get endpointslices -l kubernetes.io/service-name=SERVICE_NAME). Empty means the problem is selection or readiness. 2. Compare the selector with the pod labels: kubectl get svc SERVICE_NAME -o jsonpath='{.spec.selector}' and kubectl get pods --show-labels -n NAMESPACE. Keys and values must match exactly (a typo like app: web vs app: webapp is enough). Labels on the Deployment object itself are irrelevant; what counts are the labels in the pod template (spec.template.metadata.labels). 3. Check the namespace: the Service only selects pods in its own namespace. 4. Check readiness: kubectl get pods shows 0/1 under READY for pods that are excluded. Run kubectl describe pod and kubectl logs to see why the readiness probe fails, and fix the app or the probe rather than the Service. 5. Check ports: the Service targetPort must be the port the container actually listens on (a number or a named containerPort). Endpoints can exist and still fail if targetPort is wrong. 6. Fix the selector or labels in the manifest and re-apply. Note that changing labels in a Deployment's selector is restricted, so change the Service selector to match the pods where possible. Verify: kubectl get endpoints SERVICE_NAME lists pod IP:port pairs, and a request from a test pod in the cluster to the Service name succeeds. Sources: https://kubernetes.io/docs/tasks/debug/debug-application/debug-service/ https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/