Kubernetes Service for selecting pods in two namespaces

Question

I have a service "A" deployed in "X" namespace. "Z" service from "P" namespace, calls it on
svc-a.x.svc.cluster.local
I have to deploy staging of service "A" in Y namespace as well and I want to register these IPs under
svc-a.x.svc.cluster.local
Is there any way to do it? I want to the main service to select pods from different namespaces.

Answer 1

You can try using a Service without selectors with an EndPointSlice which refers to a Service from each namespace.

Create svc-a in namespace X which selects / points to pods in namespace X. The Service will be available at svc-a.x.svc.cluster.local.

Create svc-a in namespace Y which selects / points to pods in namespace Y. The Service will be available at svc-a.y.svc.cluster.local.

Create a svc-a in namespace Z without selectors.

apiVersion: v1
kind: Service
metadata:
  name: svc-a
spec:
  ports:
    - protocol: TCP
      port: 80
      targetPort: 9376

The Service will be available at svc-a.z.svc.cluster.local.

Create an EndpointSlice in namespace Z with svc-a.x.svc.cluster.local and svc-a.y.svc.cluster.local as endpoints and attach it to svc-a:

apiVersion: discovery.k8s.io/v1
kind: EndpointSlice
metadata:
  name: svc-a
  labels:
    kubernetes.io/service-name: svc-a
addressType: FQDN
ports:
  - name: http
    protocol: TCP
    port: 80
endpoints:
  - addresses:
      - "svc-a.x.svc.cluster.local"
      - "svc-a.y.svc.cluster.local"

So now you'll have svc-a.z.svc.cluster.local available in any namespace pointing to backends in both the X and Y namespaces.

Answer 2

You can use the ExternalName service type for this purpose. You can create new service which selects the pods from 'Y' namespace and use that service in 'A' by using the externalName.

Example: Assume new service name is 'svc-b' which is in Y namespace you can modify your 'A' service something like this

apiVersion: v1
kind: Service
metadata:
  name: svc-a
  namespace: X
spec:
  type: ExternalName
  externalName: svc-b.y.svc.cluster.local
  ports:
  - port: 80

Refer to this SO which helped in solving a similar issue.

Answer 3

As per Gari's suggestion i tried using the Endpoint slice but didn't work, looks like kube-proxy having an issue with internal virtual IP.

Note: The endpoint IPs must not be: loopback (127.0.0.0/8 for IPv4, ::1/128 for IPv6), or link-local (169.254.0.0/16 and 224.0.0.0/24 for IPv4, fe80::/64 for IPv6).

The endpoint IP addresses cannot be the cluster IPs of other Kubernetes Services, because kube-proxy doesn't support virtual IPs as a destination.

Created 3 namespace test-1, test-2, test-main

You can go with Endpoints instead. Sharing the YAML example below

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-nginx
  namespace: test-1
spec:
  selector:
    matchLabels:
      run: my-nginx
  replicas: 1
  template:
    metadata:
      labels:
        run: my-nginx
    spec:
      containers:
      - name: my-nginx
        image: nginx
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: my-nginx
  namespace: test-1
  labels:
    run: my-nginx
spec:
  ports:
  - port: 80
    protocol: TCP
  selector:
    run: my-nginx
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: hello-app
  namespace: test-2
spec:
  selector:
    matchLabels:
      run: hello-app
  replicas: 1
  template:
    metadata:
      labels:
        run: hello-app
    spec:
      containers:
      - name: hello-app
        image: gcr.io/google-samples/hello-app:1.0
        ports:
        - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: hello-app
  namespace: test-2
  labels:
    run: hello-app
spec:
  ports:
  - port: 80
    targetPort: 8080
    protocol: TCP
  selector:
    run: hello-app
---
apiVersion: v1
kind: Service
metadata:
  name: slice-svc
  namespace: test-main
spec:
  ports:
  - port: 80
    name: http
    targetPort: 80
  clusterIP: None
---
kind: Endpoints
apiVersion: v1
metadata:
  name: slice-svc
  namespace: test-main
subsets:
  - addresses:
      - ip: 10.102.24.29 #CluserIP of service nginx from namespace-1
      - ip: 10.99.216.222 #CluserIP of service my-app from namespace-2
    ports:
      - port: 80

Note : ClusterIP get change when you delete and re-create the service else it's stable to use when you don't have a better way to resolve the IP in DNS.