Kubernetes Network Debugging Cheat Sheet

kubectl get svc -A

# Check Service types, ports, and cluster IPs.

kubectl describe svc <service> -n <namespace>

# Inspect selectors, target ports, and events.

kubectl get endpoints -A

# Verify which backends a Service resolves to.

kubectl get endpointslices -A

# Inspect endpoint slice distribution for a Service.

kubectl describe endpointslice <name> -n <namespace>

# Inspect ready addresses and ports at slice level.

kubectl get svc <service> -n <namespace> -o jsonpath='{.spec.selector}{"
"}'

# Verify that pod labels match the Service selector.

kubectl get ingress -A

# Inspect ingress addresses and classes.

kubectl describe ingress <name> -n <namespace>

# Check backend mapping, TLS, and events.

kubectl run dnsutils -n <namespace> --image=registry.k8s.io/e2e-test-images/agnhost:2.39 --restart=Never -it --rm -- /bin/sh

# Create an interactive pod for nslookup and dig style checks.

kubectl exec -it <pod> -n <namespace> -- nslookup <service>.<namespace>.svc.cluster.local

# Check internal DNS resolution using the full service name.

kubectl exec -it <pod> -n <namespace> -- getent hosts <service>.<namespace>.svc.cluster.local

# Alternate DNS check inside Linux-based containers.

kubectl get pods -n kube-system -l k8s-app=kube-dns

# Verify DNS control-plane pods are healthy.

kubectl logs -n kube-system -l k8s-app=kube-dns --all-containers=true --prefix

# Inspect DNS errors and upstream resolution problems.

kubectl port-forward svc/<service> -n <namespace> 8080:80

# Test an internal service from your workstation.

curl -i http://127.0.0.1:8080/

# Call the forwarded endpoint locally.

kubectl exec -it <pod> -n <namespace> -- curl -i http://<service>.<namespace>.svc.cluster.local:<port>/

# Validate in-cluster connectivity and service routing.

kubectl exec -it <pod> -n <namespace> -- wget -S -O- http://<service>:<port>/

# Useful in images that have wget but not curl.

kubectl exec -it <pod> -n <namespace> -- nc -vz <service> <port>

# Check if a target port is reachable from inside the cluster.

kubectl exec -it <pod> -n <namespace> -- ss -lntup

# Inspect which ports the container is actually listening on.

kubectl get networkpolicies -A

# See which policies apply in a namespace.

kubectl describe networkpolicy <name> -n <namespace>

# Inspect ingress and egress selectors and ports.

kubectl get pod <pod> -n <namespace> --show-labels

# Verify whether labels match network policy selectors.

kubectl exec -it <pod> -n <namespace> -- curl -I https://example.com

# Validate whether egress is blocked by policy or firewall.

kubectl get pods -n <namespace> -l app=<label> -o wide

# Confirm that backend pods actually match the selector.

kubectl get pod <pod> -n <namespace> -o jsonpath='{.status.conditions[?(@.type=="Ready")].status}{"
"}'

# Non-ready pods usually do not appear as ready endpoints.

kubectl get svc <service> -n <namespace> -o yaml && kubectl get endpoints <service> -n <namespace> -o yaml

# Display selector and endpoints in separate quick commands.