An application deployed in EKS is not accessible externally. How do you debug it?
Quick Answer
Work outside-in: confirm the Service type (LoadBalancer/NodePort) and that it got an external address, check Ingress and its controller, then Security Group inbound rules, NACLs/VPC route tables, DNS records, and finally that pods are Ready with matching Service endpoints.
Detailed Answer
Trace the request path layer by layer. kubectl get svc/ingress to see if an address/ADDRESS was provisioned; kubectl get endpoints to confirm the Service selector actually matches Ready pods (a label mismatch means zero endpoints). Then AWS-side: the ALB/NLB Security Group must allow the listener port, subnets must be public with correct route tables, and Route 53/external DNS must point at the load balancer. kubectl describe on the ingress often reveals controller errors.
Interview Tip
Show a layered outside-in method (Service to endpoints to SG to routing to DNS) — checking endpoints for a selector mismatch is the pro move.