Cannot access service across namespace

General Discussions
1

k8s 1.10;
I created two namespaces dev and test:

  1. One nginx deployment and ClusterIP type service nginx-service in dev
  2. In one pod of test namespace, i cannot access nginx-service by “curl nginx-service.dev”

If i change nginx-service to NodePort , it works, why?

2

This guide is a really complete way to debug issues with services: https://kubernetes.io/docs/tasks/debug-application-cluster/debug-service/

Have you tried it? Which things there work and which doesn’t?

3

thanks rata, i read this guide.
the problem is , my service is very well if i access it in the namespace dev.
everything been mentioned in this article is correct in my k8s.

4

It mentions about access across namespaces too. Have you tried those options?

5

If you try the links that @rata provided, and still can’t get it to work, then consider making a minimal example that you feel comfortable posting here. It should not have to be very big, I’m guessing.

6

yes, actually, my app has already serviced for my customer for about half a year.
i created a debug image recently , as a debug pod, want to access service in deferent namespaces for debug. unfortunately, this debug pod cannot access those services.

7

3
3.png860×155 66.1 KB

as you can see, there are gymdev and testgym namespaces in my k8s.

8

1
1.png1055×320 120 KB

i cannot access retailmanagement-service.gymdev by full name, dns is ok.

9

2
i can access service from k8s node by service ip

10

4
i can access service from other deployment in same namespace

11

Have you got any Network Policies setup in your cluster that could be blocking the request?
The DNS service is reporting the right IP so that service is visible.

12

i think there are no network policies, i don’t quiet understand network policies of k8s, just checked by some simple command .

13

Could you try everything from this guide: https://kubernetes.io/docs/tasks/debug-application-cluster/debug-service/ ?

Also, how did you installed and are you using a network overlay (like calico, flannel, etc.) or using kubenet?

Please try that link and tell us more about your installation.

Also, if you create yet another NS, is that isolated from the other two? Can’t it connect to no pod in other NS and vice versa? (Just to understand if there is something special about that NS or if it happens with every NS)

14

For me it was a network policy.

Run: kubectl get networkpolicy -A