How to fix connect: connection refused in Kubernetes

Verify service has running, ready pods:

kubectl get endpoints <service-name> -n <namespace>
kubectl describe service <service-name> -n <namespace>

Look at the Endpoints field. If it shows <none>, no pods match the selector or all are not ready.

Service selector must match pod labels exactly (case-sensitive):

kubectl get pods --show-labels -n <namespace>
kubectl describe service <service-name> -n <namespace> | grep -i selector

Ensure pod labels include all key=value pairs from service selector.

Pods must be Ready for traffic to reach them:

kubectl get pods -n <namespace>
kubectl describe pod <pod-name> -n <namespace>

If status is not Running or Ready is False, the pod won't receive traffic. Check readiness probe configuration and logs.

Service and pod port must align:

kubectl get service <service-name> -n <namespace> -o yaml | grep -A5 ports
kubectl get pod <pod-name> -n <namespace> -o yaml | grep -A3 containerPort

Example:

# Service
ports:
- port: 80          # External port
  targetPort: 8080  # Container port

# Pod
containerPort: 8080

Connect to pod directly and check if port is listening:

kubectl exec -it <pod-name> -n <namespace> -- sh
netstat -tlnp | grep <port>
# or
lsof -i :<port>

If port not listed, the application isn't listening. Check application logs and startup configuration.

Failing readiness probes remove pods from endpoints:

kubectl describe pod <pod-name> -n <namespace> | grep -A5 "Readiness"
kubectl logs <pod-name> -n <namespace>

If readiness probe is too strict or has wrong port/path, pods won't be marked as ready. Adjust timeoutSeconds, initialDelaySeconds, or probe path.

Use port-forward to bypass service routing:

kubectl port-forward pod/<pod-name> 8080:8080 -n <namespace> &
curl localhost:8080/health

If port-forward works but service doesn't, the issue is service routing/endpoints, not the application.