CKA Services & Networking Practice Question
An administrator notices that traffic to a Service is not being forwarded to any pod. The Service has selector 'app: web' and there are pods with that label. However, 'kubectl get endpoints' shows no endpoints. What is the most likely cause?
⚠ Common exam trap
A common mix-up: candidates assume label matching alone guarantees endpoint creation, but Kubernetes requires pods to be in the Ready state (determined by readiness probes) before they are added to the Service's endpoints.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The pods are not in Ready state (e.g., failing readiness probes).
The most likely cause is that the pods are not in Ready state, often due to failing readiness probes. Kubernetes endpoints are only populated for pods that pass their readiness checks; if a pod is not Ready, it is removed from the Service's endpoint list, even if it is running and has the correct labels.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Service port name does not match the container port name.
Why it's wrong here
In Kubernetes, Service port names are only used as a convenience for multi-port Services and named references. The endpoint controller matches traffic based on the numeric targetPort, or by name only if the container port is explicitly named in the pod spec. A mismatch between the Service port name and the container port name does not stop endpoint generation because port numbers still align. Unless you are using named targetPorts that refer to missing names, this is not a cause of endpoint absence.
- ✗
The Service type is ClusterIP.
Why it's wrong here
ClusterIP is the default and most common Service type, providing a virtual IP for in-cluster access. A ClusterIP Service can absolutely have endpoints and route traffic to pods; it simply does not expose the Service externally. If selection labels match and pods are Ready, a ClusterIP Service will receive a healthy set of Endpoints. Therefore, the Service type itself is never a blocker for traffic when the issue is missing endpoints.
- ✗
The Service targetPort is not specified.
Why it's wrong here
When targetPort is omitted, Kubernetes defaults it to the value of the `port` field, meaning the Service forwards traffic to the same port number on the pod. This default behavior is well-documented and part of the Service API spec. Therefore, not specifying targetPort is only a problem if you actually intended to map to a different container port. It cannot be responsible for empty endpoints because the default is applied automatically.
- ✓
The pods are not in Ready state (e.g., failing readiness probes).
Why this is correct
Readiness probes determine whether a pod is included in the Service's EndpointSlices. The endpoint controller monitors pod readiness and only adds pods whose readiness probe is currently passing; pods failing readiness (or running a container that never becomes ready) are excluded. If all matching pods fail their readiness probe, the endpoint list is empty, and traffic to the Service's ClusterIP or DNS name is dropped. This directly explains why traffic is not reaching the application when the selector matches but no endpoints exist.
Go deeper
Related to this question
Learn chapter
Kubernetes Architecture Overview
Key term
Network Policies
A Kubernetes resource that controls how pods communicate with each other and with other network endpoints, acting as a firewall for pod-to-pod traffic.
Key term
Ingress Resources
Ingress Resources are Kubernetes API objects that manage external access to services inside a cluster, typically HTTP and HTTPS traffic, by defining rules for routing requests based on hostnames and paths.
About these practice questions
Courseiva writes every CKA question from scratch — 302 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKA exam.