<p>I have a deployment with 2 replicas. I can access the pods via curl.</p>

<pre><code>apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  selector:
    matchLabels:
      app: nginx
  replicas: 2
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.7.9
        ports:
        - containerPort: 80
</code></pre>

<p>I created a service.</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: nginx-service
spec:
  selector:
    app: nginx
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
</code></pre>

<p>I was expecting to be able to access the pods through the service via the EndPoints but the result I get is.</p>

<pre><code>{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "forbidden: User \"system:anonymous\" cannot get path \"/\"",
  "reason": "Forbidden",
  "details": {

  },
  "code": 403
}
</code></pre>

<p>Can someone help me understand what is going on here better?</p>

<p>kubectl get svc</p>

<pre><code>NAME            TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)   AGE
kubernetes      ClusterIP   10.96.0.1      &lt;none&gt;        443/TCP   2d23h
nginx-service   ClusterIP   10.109.19.46   &lt;none&gt;        80/TCP    22h
</code></pre>

<p>curl --insecure <a href="https://PUBLICIP:6443" rel="nofollow noreferrer">https://PUBLICIP:6443</a></p>

tink3r
<p>With your command you're trying to access the <code>/</code> path of the Kubernetes API, but it fails because you're not supplying any credentials to the request:</p>

<pre class="lang-sh prettyprint-override"><code>curl --insecure https://PUBLICIP:6443
</code></pre>

<p>But anyway, if you want to access the Pods behind the Service, you don't need to access the Kubernetes API, but you need to access the exposed Service.</p>

<p>A ClusterIP service as in your example (the default) cannot be accessed from outside the cluster. If you want to access the Service from outside the cluster, you need to create, for example, a NodePort Service:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  name: nginx-service
spec:
  selector:
    app: nginx
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
  type: NodePort
</code></pre>

<p>And then you can access the Service (and thus the Pods behind it) through the IP address and NodePort of one of the worker nodes:</p>

<pre class="lang-sh prettyprint-override"><code>curl NODE_IP:NODE_PORT
</code></pre>

<p>You can get the <code>NODE_IP</code> of one of the nodes with <code>kubectl get nodes -o wide</code> and the <code>NODE_PORT</code> of the Service with <code>kubectl get svc nginx-service</code>.</p>
