Kubernetes timeout troubleshooting is fastest when you test the path from the inside out: reach the application Pod IP, then its Service ClusterIP, then any external LoadBalancer or ingress address. The first hop that fails identifies the layer to repair. A direct Pod-IP failure points to the application, Pod networking, readiness, or policy; a working Pod IP with a failing Service IP points to Service configuration, EndpointSlices, policy, kube-proxy, or conntrack; a working in-cluster path with an external timeout points to probes, firewalls, routes, or the ingress path.
Run each test from a diagnostic Pod in the same namespace and, where relevant, from nodes on both sides of the connection. Use curl -v -m 5 for HTTP, or the equivalent protocol-specific test for TCP, UDP, DNS, or gRPC. The verbose output tells you whether the TCP connection was established before any application-layer exchange.
As an Amazon Associate I earn from qualifying purchases.
Start with the first failing hop
A Service can exist and still have no usable backend. Kubernetes assembles Service forwarding from the Service object, matching EndpointSlices, kube-proxy’s node rules, and the network supplied by the CNI plugin. Testing those layers in a fixed order prevents you from changing several variables at once.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →| Observed result | Most likely investigation area | What the result tells you |
|---|---|---|
| Pod IP refuses or times out | Application listener, Pod health, Pod network, or policy | The failure occurs before Service routing is involved. |
| Pod IP works but ClusterIP times out | Service ports, targetPort, EndpointSlices, policy, kube-proxy, or conntrack | The backend is reachable directly, so focus on virtual-IP forwarding and the controls around it. |
| Same-node Pod traffic works but cross-node traffic fails | CNI configuration, Pod CIDR routes, host firewalls, cloud NSGs, or user-defined routes | The application and local stack work; the inter-node path is broken. |
EndpointSlices show <none> |
Service selector or Pod readiness | No ready endpoint is available for kube-proxy to program. |
| A Pod cannot call its own Service VIP | Kubelet hairpin configuration | The special same-Pod-through-Service path needs inspection. |
| ClusterIP works but LoadBalancer or ingress times out | Health probes, NSGs, firewalls, route symmetry, or ingress controller | The internal path is healthy; investigate traffic before or after the cluster. |
Do not infer that kube-proxy is broken merely because a Service request timed out. The first failing hop narrows the fault far more reliably than restarting a DaemonSet or changing a CNI setting at random.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
1. Test the application through its Pod IP
Begin with the backend itself. From a diagnostic Pod, run:
kubectl exec -n <namespace> <diagnostic-pod> -- curl -v -m 5 http://<pod-ip>:<port>Replace the URL test with an appropriate client for non-HTTP protocols. Run the test more than once if the application is expected to accept concurrent connections, and test each backend Pod when a Service has several endpoints.
Interpret a refusal or timeout
- Connection refused: the Pod is reachable at the network layer, but no process is accepting the destination port, or the process is bound to a different address.
- Connection timeout: investigate the application’s listening state, Pod networking, and NetworkPolicy before touching the Service.
- Successful TCP connection followed by an application error: routing is working; debug the application protocol, request, or response rather than kube-proxy.
Inside the container, confirm that the process listens on 0.0.0.0 (or the intended Pod interface), not only on 127.0.0.1. Verify the expected port and protocol, and check that the Pod is Ready. A Pod that is running but not Ready should not receive normal Service traffic; readiness state also affects the EndpointSlices used for forwarding.
Check the application’s own logs and startup configuration before changing cluster networking. A wrong environment variable, a TLS-only listener tested with plain HTTP, or a process that has not finished initialization can all look like a Kubernetes timeout.
2. Validate the Service object and port mapping
Once the Pod IP works, inspect the Service that should expose it:
kubectl get svc <name> -n <namespace>
kubectl describe svc <name> -n <namespace>Review every item in spec.ports[], not just the Service port shown in a brief listing.
Check the port fields
port: the port clients use on the Service ClusterIP.targetPort: the destination port on each selected Pod. A numeric value must match the listening port; a named value must exactly match a container port name.protocol: TCP, UDP, or SCTP must match the application and the client test. Testing TCP against a UDP service cannot succeed.- Named-port spelling: Kubernetes treats names literally. A typo or a name defined on a different container can produce an unusable mapping even when the Pod is healthy.
Also check the Service selector and namespace. A client in one namespace cannot reach a same-named Service in another namespace unless it uses the correct DNS name or ClusterIP. If the Service has no selector by design, its endpoints must be managed separately; do not expect Pod labels to populate it automatically.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
3. Inspect EndpointSlices for usable backends
EndpointSlices show which addresses Kubernetes considers eligible for the Service. Query them with:
kubectl get endpointslices -n <namespace> -l kubernetes.io/service-name=<name>If the ENDPOINTS column is <none>, check that the Service’s spec.selector matches the Pods’ metadata.labels. Kubernetes documentation explicitly advises this check when the column is empty. A selector that differs by one label key, value, or namespace leaves the Service with no backends.
Next, verify Pod readiness. Unready backends are removed from normal Service endpoint use, so a selector can match Pods while the effective endpoint list remains empty. Compare:
kubectl get pods -n <namespace> --show-labels
kubectl get pods -n <namespace> -o wideMatch the displayed labels to the selector and inspect readiness conditions, readiness probe failures, and restart history. If only some Pods are ready, test each ready Pod IP directly and inspect whether EndpointSlices contain those same addresses. This distinguishes a bad selector from a subset of unhealthy replicas.
Recommended Free Tools
EndpointSlices are also useful for spotting an address-family mismatch. Confirm that the addresses in the slices are reachable using the same IPv4 or IPv6 family that the client and Service are using. A client forced to IPv6 cannot reach an IPv4-only backend merely because the Service object exists.
4. Check NetworkPolicy from both directions
NetworkPolicy can block a valid Service path at either endpoint. Review ingress rules on the backend Pods and egress rules on the client Pod. A policy allowing traffic from one namespace, label, or port does not automatically allow every diagnostic Pod.
Reproduce the request from a controlled diagnostic Pod whose namespace and labels are known. Verify that the policy permits:
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
- the client identity and namespace to send egress traffic to the destination;
- the backend identity and namespace to receive ingress traffic;
- the exact destination port and protocol being tested; and
- DNS egress if the test uses a Service name rather than a ClusterIP.
Keep the intended security policy in place while testing. A temporary broad allow rule can prove that policy is involved, but it should be removed or narrowed after the test. If the Pod IP fails under the same policy while a policy-free test succeeds, the fault is policy enforcement rather than kube-proxy.
5. Determine whether kube-proxy received and programmed the Service
The default implementation of Services, and the one used on most clusters, is kube-proxy. It watches Services and EndpointSlices, then programs each node’s forwarding mechanism. A Service request can therefore fail when kube-proxy is absent, unhealthy, unable to watch the API, or working from stale endpoint data.
Confirm the node-local component
Find the node where the client Pod runs and verify that the kube-proxy DaemonSet or equivalent process is running there. Inspect its logs for API authentication failures, watch disconnects, repeated sync errors, or messages showing that Service and endpoint updates were rejected. A healthy kube-proxy on other nodes does not repair a missing instance on the client’s node.
Compare the Service and EndpointSlice objects in the API with the rules or virtual servers programmed on that node. In iptables mode, use the platform’s supported iptables inspection tooling to find the generated Service and endpoint chains. Do not edit generated chains by hand; kube-proxy will overwrite manual changes during the next sync.
Account for kube-proxy mode
Clusters may use iptables, IPVS, or nftables mode. The inspection method and failure signatures differ, but the diagnostic question is the same: does the node contain a forwarding entry for the requested ClusterIP and port, with a current backend address?
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors| Mode | What to verify | Why the check matters |
|---|---|---|
| iptables | Generated Service and endpoint rules on the client node | Missing or stale chains prevent ClusterIP translation. |
| IPVS | The virtual Service and its real-server entries | A virtual address without healthy real servers cannot forward requests. |
| nftables | The nftables ruleset created by the cluster’s supported tooling | Looking only at iptables can miss the active forwarding mechanism. |
If kube-proxy logs show that it has not received an update, fix API connectivity, permissions, or the DaemonSet before investigating packet forwarding. If it has current objects but the rules are missing, inspect node-level firewall or ruleset conflicts and the mode-specific implementation.
6. Check conntrack capacity and state
kube-proxy’s forwarding often relies on connection tracking, and conntrack problems can drop or reset otherwise valid flows. Inspect conntrack usage, maximum entries, and drop counters on the affected node. A full table leaves new connections without state; invalid return state can break established conversations.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Compare an affected node with a node that handles the same Service successfully. Look for bursts that fill the table, frequent invalid-state drops, or timeout behavior that coincides with connection churn. kube-proxy exposes conntrack minimum and timeout settings, but changing them blindly can increase memory use or preserve stale flows longer than the workload needs.
Tune capacity and timeouts only with guidance for the node distribution and measurements from the workload. Drain or restart traffic carefully after a change, because deleting conntrack state can interrupt active connections. If only new connections fail while existing streams remain stable, conntrack exhaustion is a stronger suspect than an application listener problem.
7. Separate CNI and routing faults from Service faults
A CNI plugin is required to implement the Kubernetes network model. To isolate it, compare Pod-IP requests between Pods on the same node and Pods on different nodes. Use the same destination port, protocol, and client policy for both tests.
Same-node succeeds, cross-node fails
This pattern points away from the application and toward the inter-node path. Inspect:
- CNI daemon logs and the active CNI configuration;
- Pod CIDR routes on every relevant node;
- host firewall rules and forwarding settings;
- cloud network security groups (NSGs) and other network controls; and
- user-defined routes (UDRs) or equivalent route tables.
Confirm that each node knows how to reach the remote Pod CIDR and that return traffic follows a valid route. Asymmetric routing can make a request appear to leave successfully while replies are discarded by a stateful firewall. Provider-specific remediation belongs to the documentation for the CNI and infrastructure platform in use.
Both same-node and cross-node Pod IP tests fail
Return to the application listener, Pod readiness, and NetworkPolicy checks. A CNI-wide outage is possible, but it should be supported by node-level evidence such as missing Pod interfaces, failed CNI agents, or absent routes. Do not replace the CNI configuration until you have preserved logs and identified the failed component; changing it can destroy the evidence and create a second outage.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteTest the address family explicitly
For dual-stack or IPv6 deployments, repeat the test using the address family shown in the Pod and EndpointSlice data. Check that the Service family, Pod listener, CNI routes, and node firewall all support that family. A working IPv4 path does not prove that IPv6 forwarding is configured, and vice versa.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
8. Handle hairpin traffic when a Pod calls its own Service
A special case occurs when a Pod accesses the Service VIP that selects the same Pod. This is hairpin traffic: the packet leaves through the virtual Service path and returns to the originating Pod interface. If direct Pod-IP access works but the Pod’s own Service VIP hangs, inspect the kubelet hairpin-mode.
In the documented bridge-and-iptables scenario, the valid settings are hairpin-veth and promiscuous-bridge. Confirm which mode the node uses, whether the bridge or virtual Ethernet configuration matches it, and whether host firewall rules permit the return path. Test from a different Pod as well; if other clients succeed, the problem is specifically the hairpin path rather than the Service’s general endpoint programming.
9. Investigate LoadBalancer and ingress paths last
Do not begin with cloud firewall rules while the ClusterIP is still failing. Once Pod-IP and ClusterIP tests succeed, test the external address with the same bounded timeout and inspect the ingress controller logs.
- No ingress-controller log entry: the request likely never reached the cluster. Check the external load balancer, health probes, NSGs, firewalls, route tables, and advertised address.
- A log entry shows an upstream timeout: the external request arrived, but the controller cannot reach the Service or backend. Return to EndpointSlices, policy, kube-proxy, and CNI checks.
- Health probes fail: verify the probe port, path, protocol, source ranges, and whether the selected backend is Ready. A load balancer can remove every node while Pods remain reachable internally.
- Intermittent external failures: compare nodes and zones, then check route symmetry and node-specific firewall or kube-proxy state.
External failures can involve NSGs, UDRs, asymmetric routing, or ingress-controller configuration even when every in-cluster test is healthy. Keep those controls separate from the Service diagnosis so a cloud change does not mask an internal defect.
Use a controlled recovery sequence
When the failing layer is identified, apply the smallest repair that addresses it and rerun the same test. This sequence preserves causality:
- Record the client Pod, node, destination address, port, protocol, and timestamp.
- Capture direct Pod-IP, ClusterIP, and external results with
curl -v -m 5or the equivalent protocol test. - Fix the first failing layer: listener and readiness, Service port mapping, selector, EndpointSlices, policy, kube-proxy, conntrack, CNI routing, hairpin mode, or external controls.
- Repeat the failed test from the original client and from a second node when cross-node behavior is relevant.
- Check that the repair did not remove required policy or expose an unintended port.
Avoid simultaneously restarting kube-proxy, changing NetworkPolicy, editing routes, and replacing the CNI. If the request starts working, you will not know which change mattered; if it gets worse, rollback becomes ambiguous.
Prevent recurring timeout incidents
- Keep Service selectors, named ports, protocols, and targetPorts under review whenever a Deployment changes.
- Alert on Pods that are Running but not Ready and on Services whose EndpointSlices contain no ready addresses.
- Monitor kube-proxy health, API watch errors, and node-level rule or virtual-server programming.
- Track conntrack utilization and drops on nodes that handle high connection rates.
- Validate CNI routes, Pod CIDR reachability, host forwarding, NSGs, and UDRs after node-pool or network changes.
- Exercise both same-node and cross-node Pod-IP tests, then a ClusterIP test, in a controlled diagnostic job.
- For external services, monitor load-balancer health probes and verify that ingress logs contain the expected requests.
- Document whether the cluster uses iptables, IPVS, or nftables mode, which CNI implements Pod networking, which policy engine enforces NetworkPolicy, and whether the affected Service is IPv4, IPv6, or dual-stack.
The durable rule is simple: follow the packet in order. A timeout is not a diagnosis; the first address that cannot be reached is the evidence that tells you where to work.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
