gabrielmoreira Kubernetes Service Path Tracing
Server
k8s-mcp — vendored third-party, read-only, 7 tools. See
k8s-network-policy for the shared preflight and the empty-result cautions,
which apply here identically.
The path, and the rule about it
Ingress → Service → selector → Pods → EndpointSlice → readiness
Mark every link checked or not checked. A partial trace presented as complete is the failure mode of this skill — "the service is fine" after checking two of five links is worse than saying nothing, because it sends the next person somewhere else.
Walking it
resources_list({"apiVersion":"networking.k8s.io/v1","kind":"Ingress"})
resources_get ({"apiVersion":"v1","kind":"Service","namespace":"app1","name":"web"})
pods_list_in_namespace({"namespace":"app1"}) // then match against the Service selector
resources_list({"apiVersion":"discovery.k8s.io/v1","kind":"EndpointSlice","namespace":"app1"})
Diagnoses that look identical and are not
| Symptom | Actual cause | How to say it |
|---|---|---|
| No endpoints | Selector matches no pods | "The Service selector app=web matches no pods" — the selector is wrong or the pods are gone |
| No endpoints | Pods exist but none are ready | "3 pods match but none are Ready" — a readiness-probe problem, not a wiring problem |
| No endpoints | Pods ready, port mismatch | "Pods are ready but no container exposes the target port" |
| Traffic blocked | A NetworkPolicy denies it | hand off to k8s-network-policy — this skill does not evaluate policy |
| Ingress not routing | Backend names a non-existent Service | "Ingress web routes to Service web-v2, which does not exist" — call this out loudly, it is a common and silent misconfiguration |
"No endpoints" is a symptom, never a diagnosis. Always name which of these it is.
Ready is not the same as existing
An EndpointSlice lists both ready and not-ready addresses. A Service with five not-ready endpoints has zero serving capacity but is not empty. Report the two counts separately — collapsing them hides an outage.
Empty results
Everything in k8s-network-policy's six-cause table applies. In particular:
- A Service in a non-existent namespace returns nothing, not a 404.
- A typo'd selector returns zero pods with HTTP 200 — show the selector.
- Without confirmed cluster-wide scope, a cross-namespace Ingress trace may be silently incomplete.
Boundaries
| Want to… | Use |
|---|---|
| Whether traffic is permitted | k8s-network-policy — this traces wiring, not policy |
| Whether packets actually flowed | kubeshark-traffic |
| Latency / error rates | prometheus, grafana |
| Pod inventory and status | k8s-workload-inventory |
| Change anything | nothing here. Read-only |
Rules
- State which links you checked and which you did not.
- "No endpoints" is a symptom — name the cause.
- Separate ready from not-ready.
- Call out an Ingress backend that does not exist.
- Show selectors and scope. Read-only.