Octet

Say this first

A Service gives a stable virtual IP and DNS name to a changing set of pods. ClusterIP is the default and is reachable only inside the cluster. NodePort also opens a port, from 30000 to 32767 by default, on every node. LoadBalancer asks the cloud for an external load balancer that sends traffic to the nodes or straight to pods. kube-proxy, or an eBPF data plane like Cilium, programs the translation from the virtual IP to the pod IPs listed in the EndpointSlices.

Go deeper

Types

Type	Reachable from	Notes
ClusterIP	Inside the cluster	Virtual IP from the service CIDR
NodePort	Any node IP on a high port	Builds on ClusterIP
LoadBalancer	Outside, through a cloud LB	Builds on NodePort unless the controller targets pods directly
ExternalName	Inside, as a DNS CNAME	No proxying, just DNS
Headless (`clusterIP: None`)	Inside	DNS returns pod IPs; used by StatefulSets

Data path

Pods matching the selector and passing readiness probes are listed in EndpointSlices.
kube-proxy watches them and writes rules: iptables DNAT chains, IPVS virtual servers, or nftables in newer releases. Cilium can replace kube-proxy with eBPF.
A packet to 10.96.40.12:80 is translated to a chosen pod, for example 10.244.3.17:8080.
CoreDNS answers web.shop.svc.cluster.local with the ClusterIP.

YAML

apiVersion: v1
kind: Service
metadata:
  name: web
  namespace: shop
spec:
  type: ClusterIP
  selector:
    app: web
  ports:
    - port: 80
      targetPort: 8080

They will ask next

Why can you not ping a ClusterIP?
In iptables mode the ClusterIP is not on any interface. Only the defined ports are translated, so ICMP gets no answer. Test with curl to the port instead. In IPVS mode the address is bound to a dummy interface and may answer ping.
A Service has no endpoints. What is wrong?
The selector does not match the pod labels, or the pods are not ready. This shows what the Service actually selected: kubectl get endpointslices -n shop -l kubernetes.io/service-name=web

Traps

Saying a Service is a pod or a process. It is a virtual IP plus rules.
Exposing many services with one cloud load balancer each, which gets expensive. That is what ingress is for.

How did you do?