<p>I'm trying to debug why a service for a perfectly working deployment is not answering (connection refused).</p>

<p>I've double and tripled checked that the <code>port</code> and <code>targetPort</code> match (4180 for the container and 80 for the service)</p>

<p>when I list the my endpoints I get the following:</p>

<pre><code>$ kubectl get endpoints
NAME           ENDPOINTS           AGE
kubernetes     10.40.63.79:443     82d
oauth2-proxy   10.40.34.212:4180   33s // &lt;--this one
</code></pre>

<p>and from a pod running in the same namespace:</p>

<pre><code># curl 10.40.34.212:4180
curl: (7) Failed to connect to 10.40.34.212 port 4180: Connection refused
</code></pre>

<p>(By the way, same happens if I try to curl the service)</p>

<p>yet, if I port forward directly to the pod, I get a response:</p>

<pre><code>$ kubectl port-forward oauth2-proxy-559dd9ddf4-8z72c 4180:4180 &amp;
$ curl -v localhost:4180
* Rebuilt URL to: localhost:4180/
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 4180 (#0)
&gt; GET / HTTP/1.1
&gt; Host: localhost:4180
&gt; User-Agent: curl/7.58.0
&gt; Accept: */*
&gt; 
Handling connection for 4180
&lt; HTTP/1.1 403 Forbidden
&lt; Date: Tue, 25 Jun 2019 07:53:19 GMT
&lt; Content-Type: text/html; charset=utf-8
&lt; Transfer-Encoding: chunked
&lt; 

&lt;!DOCTYPE html&gt;
// more of the expected response
* Connection #0 to host localhost left intact

</code></pre>

<p>I also checked that I get the pods when I use the selector from the service (I copy pasted it from what I see in <code>kubectl describe svc oauth2-proxy</code>):</p>

<pre><code>$ kubectl describe svc oauth2-proxy | grep Selector
Selector:          app.kubernetes.io/name=oauth2-proxy,app.kubernetes.io/part-of=oauth2-proxy

$ kubectl get pods --selector=app.kubernetes.io/name=oauth2-proxy,app.kubernetes.io/part-of=oauth2-proxy
NAME                            READY   STATUS    RESTARTS   AGE
oauth2-proxy-559dd9ddf4-8z72c   1/1     Running   0          74m

</code></pre>

<p>I don't get why the endpoint is refusing the connection while using port forwarding gets a valid response. Anything else I should check?</p>

Tom Klino
<p>Alright, turns out that this specific service was listening on localhost only by default:</p>

<pre><code>$ netstat -tunap | grep LISTEN
tcp        0      0 127.0.0.1:4180          0.0.0.0:*               LISTEN      1/oauth2_proxy
</code></pre>

<p>I had to add an argument (<code>-http-address=0.0.0.0:4180</code>) to tell it to listen on 0.0.0.0</p>
