Services and Networking →mediumMultiple Choice

CKAD Services and Networking Practice Question

You have a Deployment named 'web-app' with 3 replicas. You want to expose the pods on port 80 internally within the cluster using a ClusterIP service. Which kubectl command should you use?

⚠ Common exam trap

Test-takers frequently confuse `kubectl expose` with `kubectl create service`, not realizing that `kubectl create service` does not automatically inherit the selector from an existing workload, leading to a Service that has no endpoints and fails to route traffic.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

kubectl expose deployment web-app --port=80 --target-port=8080

`kubectl expose deployment web-app --port=80 --target-port=8080` creates a ClusterIP Service that maps port 80 on the Service to port 8080 on the Pods, allowing internal cluster traffic to reach the application. The `--port` flag defines the Service's listening port, while `--target-port` specifies the container port the traffic is forwarded to, which is essential when the container listens on a different port than the Service exposes.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
kubectl expose deployment web-app --port=80 --target-port=8080
Why this is correct
kubectl expose deployment web-app --port=80 --target-port=8080 creates a ClusterIP service automatically using the Deployment's pod selector, so traffic on port 80 is forwarded to port 8080 on all three replicas. It is the correct approach because the service tracks the Deployment's labels, giving it a stable cluster-internal IP and load-balancing across healthy pods, and it remains correct across scale events and rolling updates.
✗
kubectl create service clusterip web-app --tcp=80:8080
Why it's wrong here
kubectl create service clusterip web-app --tcp=80:8080 generates a ClusterIP service, but it does not include a pod selector by default—unlike kubectl expose, which copies the workload's selector. Without a selector, the service has no endpoints and cannot route any traffic to the three replicas, even though the port mapping is correct. To make it functional, you would need to manually add a selector matching the Deployment's labels, so this command as written is not self-sufficient.
✗
kubectl create service nodeport web-app --tcp=80:8080
Why it's wrong here
kubectl create service nodeport web-app --tcp=80:8080 produces a NodePort service, which is a different service type than the ClusterIP service that kubectl expose would create. NodePort exposes the service on a static port on each node, which is not the default in-cluster access method required here. Moreover, like all kubectl create service subcommands, it creates a service with no selector, so even as a NodePort it would not route to the Deployment's pods unless a selector is added separately, making this doubly incorrect.
✗
kubectl expose pod web-app --port=80 --target-port=8080
Why it's wrong here
kubectl expose pod web-app --port=80 --target-port=8080 tries to create a service targeting a pod literally named 'web-app,' but the Deployment's pods have auto-generated names like 'web-app-7d5f9f8f6-abc12,' so no matching pod exists. Even if you corrected the syntax to target an actual pod, the service would be pinned to that single pod's IP, bypassing the Deployment's replica set and ignoring scaling, rolling updates, or rescheduling. This approach does not use the Deployment's selector and would break high availability, so it cannot expose the Deployment as intended.

Go deeper

CKAD Services and Networking Practice Question

Why each option matters

Option-by-option breakdown

Related to this question