What do you check first when one Kubernetes service can't reach another?

I start with the Service definition and its EndpointSlices. Check the selector against the target pod labels, then check whether the selected pods are ready. An empty endpoint list can point to a selector mismatch, but readiness and the Service configuration matter too.

Once there are usable endpoints, try connecting from the source pod. That way you know the Service has somewhere to send traffic before digging into the network path.

I like to test from the source pod early, using the same hostname and port as the application. Then try the Service cluster IP on that port. If the IP works but the name doesn't, investigate DNS resolution and the cluster DNS pods. That result narrows the problem down, though it doesn't automatically prove CoreDNS itself is broken.

Before getting deep into networking, check the boring stuff: Service name, namespace, Service port and target port. A valid connection to the wrong port isn't going to help, and a typo in the name can send you chasing DNS for no reason.

If the Service and endpoints look right, check NetworkPolicies affecting the source and destination pods. A default deny can block ingress or egress, including traffic across namespaces. Depending on the cluster setup, security groups may also need a look.

Use a debug container or a small utility pod if the application image has no shell or curl. BusyBox can be handy, while netshoot has a broader set of network tools. Make sure the test runs in a comparable namespace and has relevant labels, since policies can apply differently.

Packet capture is useful when simpler checks don't explain where traffic stops. I wouldn't make it the first step for every failure.