Building-permits Services show correct Endpoints, yet traffic still fails on some nodes. Objects look healthy in the API. What plane should administrators investigate next?
Select an answer to reveal the explanation.
Short Explanation
When the roster on paper looks right but the roads are broken, walk the dataplane—kube-proxy and CNI rules on the node. API objects can be fine while forwarding is stale.
Full Explanation
When building-permits Services show correct Endpoints yet traffic still fails on some nodes while API objects look healthy, administrators should investigate the kube-proxy (or equivalent dataplane) and CNI programming on the affected nodes for stale or missing rules. The roster on paper can be right while the roads are broken. The user's local /etc/hosts on a laptop is rarely the next plane when in-cluster East-West fails only on some nodes with healthy Endpoints. etcd compaction does not delete Service YAML from disk permanently as an explanation for node-local forwarding failure. Deployment strategy Recreate versus RollingUpdate does not explain dataplane failures for DNS reasons when Endpoints already look correct. Exam caveat: Compare working versus failing nodes: kube-proxy pods, iptables/IPVS/eBPF rules, and CNI routes. Partial DaemonSet failure yields partial Service breakage. Operational check: Inspect kube-proxy/CNI on the bad nodes, restart or fix the agents, test Service access from those nodes, and document node-local dataplane checks for permits on-call. In municipal production practice, record the finding in the incident ticket with command output snippets, confirm the fix under change control, and re-validate the user-facing civic service before closing the change window.