CKAD Practice Question 10: Service No Endpoints Readiness
Certified Kubernetes Application Developer (CKAD) · Test 1 · question 10 of 10
Clients calling the checkout Service get connection failures. Investigation shows:
- kubectl get pods -l app=checkout lists 3 Pods, all Running, all showing 0/1 in the READY column, with no restarts - the Service's selector is app: checkout - kubectl get endpointslices -l kubernetes.io/service-name=checkout -o yaml shows one slice listing all 3 Pod IPs, and every endpoint has conditions: {ready: false, serving: false, terminating: false}
Which explanation and fix is correct?
Show answer and explanation
Answer:
Selector matching and readiness are separate steps. The EndpointSlice controller adds every Pod that matches the selector to the slice, then sets each endpoint's serving condition from the Pod's Ready condition; ready means "serving and not terminating". A Pod failing its readiness probe is not removed; it stays in the slice with ready: false (and, in the legacy Endpoints object, under notReadyAddresses), and kube-proxy sends Service traffic only to ready endpoints. 0/1 in the READY column with a Running Pod and zero restarts is the signature of a readiness probe failing while the container stays alive, a wrong path or port, or a dependency the application waits on. Fix the probe or the condition it reports and the endpoints flip to ready: true.
Option B is contradicted by the evidence. The controller only lists Pods whose labels match the selector, so the fact that all 3 Pod IPs appear in the slice proves the selector matches. A selector mismatch would produce a slice with no endpoints at all.
Option C is a guess at the wrong layer. kube-proxy is correctly honouring the slice it was given; it skips endpoints marked not ready. Recreating the Service leaves the Pods just as unready while breaking every client that cached the old ClusterIP.
Option D inverts the meaning of the field. publishNotReadyAddresses: true is an opt-in that makes a Service treat endpoints as ready *despite* Pods being unready, mainly for StatefulSet peer discovery. It is not a prerequisite for normal readiness, and using it here would route live traffic to Pods that have said they cannot serve it.
Reference: EndpointSlices