ClusterIP — Internal Only
ClusterIP is the default Service type. It exposes the Service on an internal IP address that is only reachable from within the cluster. External clients cannot reach it.
Use ClusterIP for internal microservice communication — like a frontend calling a backend API within the same cluster.
How ClusterIP Works
Inside the Cluster:
┌───────────────────────────────────────────┐
│ │
│ Frontend ──▶ Service: backend (10.0.0.50)│
│ │ │
│ ┌────┴────┐ │
│ ▼ ▼ │
│ Pod-1 Pod-2 │
│ (10.1.1.5) (10.1.2.8) │
│ │
│ ClusterIP is ONLY reachable inside here │
└───────────────────────────────────────────┘
Outside the Cluster:
┌───────────────────────────────────────────┐
│ Client ──x── 10.0.0.50 │
│ Cannot reach ClusterIP from outside! │
└───────────────────────────────────────────┘
Creating a ClusterIP Service
apiVersion: v1
kind: Service
metadata:
name: backend-api
spec:
type: ClusterIP # This is the default, so you can omit it
selector:
app: backend
ports:
- protocol: TCP
port: 80 # Service port
targetPort: 3000 # Container port
This Service routes traffic to all pods with the label app: backend on port 3000. Other pods in the cluster can reach it at backend-api:80.
Multi-Port Services
apiVersion: v1
kind: Service
metadata:
name: multi-port-service
spec:
type: ClusterIP
selector:
app: my-app
ports:
- name: http
port: 80
targetPort: 8080
- name: https
port: 443
targetPort: 8443
- name: metrics
port: 9090
targetPort: 9090
When exposing multiple ports, give each one a name. This makes your configuration clearer and is required for some tools.
Testing ClusterIP Services
# Run a temporary pod to test connectivity
kubectl run curl --image=curlimages/curl -it --rm -- /bin/sh
# Inside the pod, reach the service:
curl http://backend-api
curl http://backend-api:80
# Or use kubectl port-forward to access from your machine
kubectl port-forward svc/backend-api 8080:80
# Visit http://localhost:8080 in your browser