<p>I have a deployment with 2 replicas. I can access the pods via curl.</p>

<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  selector:
    matchLabels:
      app: nginx
  replicas: 2
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.7.9
        ports:
        - containerPort: 80
</code></pre>

<p>I created a service.</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: nginx-service
spec:
  selector:
    app: nginx
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
</code></pre>

<p>I was expecting to be able to access the pods through the service via the EndPoints but the result I get is.</p>

<pre><code>{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "forbidden: User \"system:anonymous\" cannot get path \"/\"",
  "reason": "Forbidden",
  "details": {

  },
  "code": 403
}
</code></pre>

<p>Can someone help me understand what is going on here better?</p>

<p>kubectl get svc</p>

<pre><code>NAME            TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)   AGE
kubernetes      ClusterIP   10.96.0.1      &lt;none&gt;        443/TCP   2d23h
nginx-service   ClusterIP   10.109.19.46   &lt;none&gt;        80/TCP    22h
</code></pre>

<p>curl --insecure <a href="https://PUBLICIP:6443" rel="nofollow noreferrer">https://PUBLICIP:6443</a></p>

tink3r
<p>The <code>curl</code> command you are using will hit the <code>Kubernetes API server</code> (defaults to <code>6443</code> port) ; NOT the service you created.</p>

<p>The <code>nginx-service</code> you created will create a <code>ClusterIP</code> service, which will not be accessible from outside. You have to use either <code>NodePort</code> or <code>LoadBalancer</code> type service.</p>

<p>To access your service, you can try below (using <code>NodePort</code>)</p>

<pre><code>kind: Service
metadata:
  name: nginx-service
spec:
  selector:
    app: nginx
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
  type: NodePort
</code></pre>

<p>Then get the <code>NodePort</code> from <code>kubectl get svc</code></p>

<pre><code>NAME            TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)   AGE
kubernetes      ClusterIP   10.96.0.1      &lt;none&gt;        443/TCP   2d23h
nginx-service   NodePort    10.109.19.46   &lt;none&gt;        80:32474/TCP    22h &lt;&lt;&lt;-- (NodePort is 32474)
</code></pre>

<p>You can use any node's IP and the port 32474 combinations to access the service.</p>

<p>Eg:- </p>

<p><code>curl http://192.168.10.10:32474</code> </p>
