See these pages for more details about Services:
https://kubernetes.io/docs/concepts/services-networking/service/
https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/
https://kubernetes.io/docs/concepts/security/controlling-access/
https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/

Pods have their own unique IP addresses but these IP addresses are not reliable (if a Pod get rescheduled it might get a new IP address). For a large deployment, it will be hard to maintain and keep updated a list of all these IP addresses,.

Kubernetes provides a solution that makes accessing the Pods easier and reliable. The Kubernetes Service is a special object that regroup a set of related Pods. A Kubernetes Service has a unique IP address (ClusterIP), DNS name, and Port that last for the life of the service. The Kubernetes Service load balance requests across its associated Pods.

Kubernetes Service uses the Kubernetes Endpoints object (endpoints|ep) to manage Pods. For each service, an associated EndPoints object will be created. This object will keep updating the list of all the Pods that their labels match the Service's selector. Pods (coming from new deployment, scaling up an existing deployment) that their labels match the Service's label selector, will dynamically be added to the Endpoints object. If a Pod get updated (labels), become unhealthy (failure), or terminated (an existing deployment get deleted or rolled back), it will be removed from the Endpoints object. The EndPoints object will have the name of the Service.

Linking Pods to a Service using labels and label selectors allow Pods to be loosely coupled with the Service. To be selected, a pod must define all the labels defined in the Service's label selector. A Pod can define more labels than the one defined in the Service's selector.

The Service object allow you to specify the type (spec.type) of the Service you want. The possible values are:

• ClusterIP (default):
  The Service (unique IP address, DNS name, and Port) will be, by default, only available within the cluster.
  
  
• NodePort:
  Superset of ClusterIP. It also exposes a node port (TCP/UDP) that allow the Service to be available from outside the cluster.
  
  
• LoadBalancer:
  Superset of NodePort. If supported, It creates an external load balancer in the cloud provider and assigns an external IP address to the Service.
  
  
• ExternalName:
  Can be used when there's need to direct requests to applications running outside the Kubernetes cluster.
  
  

"Headless" Service (spec.clusterIP set to none) is a special case of the ClusterIP Service. A query to the Service will return the Pods' IP addresses (no load balancing). Statefulset is a known use case where "Headless" Services are used.

To create/deploy a Service, you need first to create a manifest YAML file. The manifest file describe the Service and its components (name, type, Ports, Selector, ...). You can use "kubectl" (or any rest client tool) to post the manifest file to the API server If applicable, the API server verifies that the request is authenticated, validates it's authorized, and runs the admission controllers on it. The API server verifies the manifest file and, if no issues, it writes a record for that manifest in the cluster store (etcd). The scheduler will then read the record and deploy the Pod of the Service to a healthy worker node with enough available resources.

The same behaviour, described above, applies if you use the imperative command ("kubectl create") to create the Service.

Let's define a simple Service:
$ vi hello-nginx-service.yaml apiVersion: v1 kind: Service metadata: name: hello-nginx spec: type: ClusterIP # this's default if the field type is skipped ports: - port: 80 targetPort: 80 # this defaults to the Port's value if the field targetPort is skipped protocol: TCP # this's the default if the field protocol is skipped selector: # the Service's selector verifies Pods that define all its labels app: hello-nginx
The Service defines a Selector (spec.selector): "app=hello-nginx"
Pods that have all the labels defined in the Service's Selector will be selected.

Let's apply now the Service:
$ kubectl apply -f hello-nginx-service.yaml service/hello-nginx created
Check the Service:
$ kubectl get service hello-nginx -o wide NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR hello-nginx ClusterIP 10.109.87.124 <none> 80/TCP 11m app=hello-nginx
In the bellow Deployment example, the Pods will be selected because they define (spec.template.metadata.labels) the label "app=hello-nginx". The other labels of the Pods ("product=mtitek", "stage=dev") are not considered.

Let's define a simple deployment:
$ vi hello-nginx-deployment.yaml apiVersion: apps/v1 kind: Deployment metadata: name: hello-nginx spec: replicas: 2 selector: matchLabels: app: hello-nginx template: metadata: labels: # a subset of the Pod's labels must match the Service's selector app: hello-nginx product: mtitek stage: dev spec: containers: - name: hello-nginx image: nginx:latest ports: - containerPort: 80
Let's apply the Deployment:
$ kubectl apply -f hello-nginx-deployment.yaml deployment.apps/hello-nginx created
Verify that Pods are running and ready (note the IP addresses of each Pod):
$ kubectl get pods -o wide NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES hello-nginx-5d77cc88f4-gj6k2 1/1 Running 0 13m 10.1.0.157 docker-desktop <none> <none> hello-nginx-5d77cc88f4-pz9dj 1/1 Running 0 13m 10.1.0.156 docker-desktop <none> <none>
Let's validate the Service (note that the Endpoints field contains the Pods' IP addresses):
$ kubectl describe service hello-nginx Name: hello-nginx Namespace: default Labels: <none> Annotations: <none> Selector: app=hello-nginx # list of labels that Pods must define so they can bed added to the Service's Endpoints Type: ClusterIP IP: 10.109.87.124 # clusterIP address (internal) of the Service Port: <unset> 80/TCP # the port that the Service listens on inside the cluster TargetPort: 80/TCP # the port that the Pods are listening on Endpoints: 10.1.0.156:80,10.1.0.157:80 # list of Pods (IP addresses) that are healthy and their labels match the service's label selector Session Affinity: None Events: <none>
Check the Endpoints object of the Service (note the ENDPOINTS column):
$ kubectl get endpoints hello-nginx NAME ENDPOINTS AGE hello-nginx 10.1.0.156:80,10.1.0.157:80 23m
Describe the Endpoints object of the Service (note the Addresses field):
$ kubectl describe endpoints hello-nginx Name: hello-nginx Namespace: default Labels: <none> Annotations: endpoints.kubernetes.io/last-change-trigger-time: 2021-06-06T10:31:11Z Subsets: Addresses: 10.1.0.156,10.1.0.157 NotReadyAddresses: <none> Ports: Name Port Protocol ---- ---- -------- <unset> 80 TCP Events: <none>
To access the service from inside the cluster:
$ kubectl exec -ti hello-nginx-5d77cc88f4-gj6k2 -- bash root@hello-nginx-5d77cc88f4-gj6k2:/# curl -I -X GET 10.109.87.124:80 HTTP/1.1 200 OK Server: nginx/1.21.0 Date: Wed, 06 Jun 2021 02:52:40 GMT Content-Type: text/html Content-Length: 612 Last-Modified: Tue, 25 May 2021 12:28:56 GMT Connection: keep-alive ETag: "60aced88-264" Accept-Ranges: bytes root@hello-nginx-5d77cc88f4-gj6k2:/#

The NodePort Service defines a node port on every node in the cluster. Requests from outside the cluster can target the node port of any cluster node to reach the Service. The NodePort Service will load balance requests to the Pods that are associated to it.

Requests -> Cluster Node (NodePort) -> Service -> Pods

Let's use the Deployment created previously (hello-nginx-deployment.yaml).

Let's define a simple NodePort Service:
$ vi hello-nginx-service-node-port.yaml apiVersion: v1 kind: Service metadata: name: hello-nginx-node-port spec: type: NodePort ports: - port: 80 targetPort: 80 # this defaults to the Port's value if the field targetPort is skipped protocol: TCP # this's the default if the field protocol is skipped nodePort: 30080 # if not defined, Kubernetes will assign a port from a range (default: 30000-32767) selector: # the Service's selector verifies Pods that define all its labels app: hello-nginx
Let's apply the Service:
$ kubectl apply -f hello-nginx-service-node-port.yaml service/hello-nginx-node-port created
Check the Service:
$ kubectl get service hello-nginx-node-port -o wide NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR hello-nginx-node-port NodePort 10.106.138.253 <none> 80:30080/TCP 24s app=hello-nginx
Let's validate that Service (note that the Endpoints field contains the Pods' IP addresses):
$ kubectl describe service hello-nginx-node-port Name: hello-nginx-node-port Namespace: default Labels: <none> Annotations: <none> Selector: app=hello-nginx Type: NodePort IP: 10.106.138.253 LoadBalancer Ingress: localhost Port: <unset> 80/TCP TargetPort: 80/TCP NodePort: <unset> 30080/TCP # the port to access the Service from outside the cluster Endpoints: 10.1.0.156:80,10.1.0.157:80 Session Affinity: None External Traffic Policy: Cluster Events: <none>
Check the Endpoints object of the Service (note the ENDPOINTS column):
$ kubectl get endpoints hello-nginx-node-port NAME ENDPOINTS AGE hello-nginx-node-port 10.1.0.156:80,10.1.0.157:80 83s
Describe the Endpoints object of the Service (note the Addresses field):
$ kubectl describe endpoints hello-nginx-node-port Name: hello-nginx-node-port Namespace: default Labels: <none> Annotations: endpoints.kubernetes.io/last-change-trigger-time: 2021-06-09T02:36:41Z Subsets: Addresses: 10.1.0.156,10.1.0.157 NotReadyAddresses: <none> Ports: Name Port Protocol ---- ---- -------- <unset> 80 TCP Events: <none>
To access the service from inside the cluster, execute the same command we did above for the ClusterIP service (on port 80).

To access the service from outside the cluster (note the node port 30080 and the IP address of the docker desktop VM):
$ curl -I -X GET 192.168.2.10:30080 HTTP/1.1 200 OK Server: nginx/1.21.0 Date: Wed, 06 Jun 2021 02:58:03 GMT Content-Type: text/html Content-Length: 612 Last-Modified: Tue, 25 May 2021 12:28:56 GMT Connection: keep-alive ETag: "60aced88-264" Accept-Ranges: bytes

You can use the "kubectl expose" command to create a Service object that exposes a Deployment.

Let's use the Deployment created previously (hello-nginx-deployment.yaml).

To expose the "hello-nginx"" Deployment:
$ kubectl expose deployment hello-nginx \ --name=hello-nginx \ --port=80 \ --target-port=80 \ --type=ClusterIP service/hello-nginx exposed

• The --name flag defines the name of the service.
  
  
• The --port flag defines the port that the Service listens on inside the cluster.
  
  
• The --target-port flag defines the port that the Pods are listening on.
  
  
• The --type flag defines the service type.
  
  

To get details about the Service, you can use the same commands explained above (kubectl get services, kubectl describe services).
$ kubectl get services hello-nginx -o wide NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE SELECTOR hello-nginx ClusterIP 10.97.96.83 <none> 80/TCP 76s app=hello-nginx

To delete a Service: using manifest file (kubectl delete):
$ kubectl delete -f hello-nginx-service.yaml service "hello-nginx" deleted
To delete a Service using its name:
$ kubectl delete services hello-nginx service "hello-nginx" deleted

See more details about Kubernetes DNS Service (and dnsutils utility) in this page: Kubernetes Cluster

The Kubernetes DNS (controller) watches the API Server for new Services. When a new Service is created (get assigned a virtual IP address: ClusterIP), the Kubernetes DNS will automatically create the DNS records for the Service (the Service's name and IP address get registered with the cluster DNS).

The fully qualified domain name (FQDN) of a Service will be created by combing the following data:

• The Service name (metadata.name).
  This's also called the short name or the unqualified name of the Service (i.e. hello-nginx).
  
  
• The namespace where the service is created.
  
  
• The service type name (svc).
  
  
• The cluster domain address (cluster.local).
  
  

This can be represented as following: <SERVICE-NAME>.<NAMESPACE>.svc.cluster.local
Example (Service: hello-nginx): hello-nginx.default.svc.cluster.local

• A request to a Service from outside its namespace needs to use the Service's FQDN: hello-nginx.default.svc.cluster.local.
  
  
• A request to a Service from inside its namespace can use the Service's name (short name or unqualified name): hello-nginx.
  
  

It's also possible to use the Service's name concatenated with the namespace: hello-nginx.default.

The nslookup command can be used to resolve the "hello-nginx" Service (you should get something like the following):
$ kubectl exec -i -t dnsutils -- nslookup hello-nginx Server: 10.96.0.10 <- The IP address of the Kubernetes DNS (kube-dns Service ClusterIP) Address: 10.96.0.10#53 Name: hello-nginx.default.svc.cluster.local <- The FQDN of the hello-nginx Service Address: 10.109.87.124 <- The clusterIP of the hello-nginx Service
When Pods are created, they are configured to know about the Kubernetes DNS (ClusterIP, search domains). This will allow Pods to query the Kubernetes DNS to resolve a service's name to its IP address.

Kubernetes will configure each Pod's "/etc/resolv.conf" file with the IP address (nameserver) of the Kubernetes DNS Service and the search domains (search) that can be appended to the Services' unqualified names.
$ kubectl exec hello-nginx-5d77cc88f4-gj6k2 -- cat /etc/resolv.conf nameserver 10.96.0.10 <- Kubernetes DNS IP address (kube-dns Service ClusterIP) to which request will be senn search default.svc.cluster.local svc.cluster.local cluster.local #<- search domains to be appended to unqualified names options ndots:5