Pod IPs change constantly, so a Service provides a fixed virtual IP and DNS name.

It finds its backends with a label selector and load-balances across the ready ones.

ClusterIP

Default. A virtual IP reachable only inside the cluster. Most Services.

NodePort

Opens the same port (30000-32767) on every node. A building block, rarely used directly.

LoadBalancer

Asks the cloud for a real load balancer (GCP, AWS NLB/ALB, Azure LB, or MetalLB on-prem).

ExternalName

A pure DNS alias (CNAME) to something outside the cluster.

service.yaml

apiVersion: v1
kind: Service
metadata: {name: checkout, namespace: shop}
spec:
  type: ClusterIP
  selector: {app: checkout}      # finds Pods by label
  ports: [{port: 80, targetPort: 8080}]

Session affinity

sessionAffinity: ClientIP pins a client IP to one Pod. A stopgap for legacy apps; better to move session state to Redis or a database.

Cloud cost note

A separate LoadBalancer per Service gets expensive. Put many Services behind one Ingress or Gateway.

A Service is a stable address for changing Pods

Pods are disposable and each replacement gets a new IP, so nothing can depend on a Pod IP. A Service solves this by providing a stable virtual IP and DNS name that load-balances across whichever Pods currently match its label selector and are ready. It couples to Pods only through labels, which is why new Pods are adopted automatically.

There are four types. ClusterIP is the default and is reachable only from inside the cluster; most internal service-to-service traffic uses it. NodePort exposes a static port on every node and is mostly a building block. LoadBalancer asks the platform to provision an external load balancer pointing at the Service; on-prem clusters need something like MetalLB for this to work. ExternalName is just a DNS alias to an external name.

A Service's port is what clients connect to; targetPort is the container port on the Pod. Session affinity by client IP is available but coarse: users behind one corporate NAT all look like one client. The cleaner design is a stateless application with session state in an external store.

Cost note for managed clusters: each type LoadBalancer Service typically creates a separate cloud load balancer with its own hourly charge. For HTTP services, route many hosts and paths through one Ingress or Gateway instead.