52

I am becoming more familiar with Kubernetes by the day, but am still at a basic level. I am also not a networking guy.

I am staring at the following snippet of a Service definition, and I can't form the right picture in my mind of what is being declared:

spec:
  type: NodePort
  ports:
  - port: 27018
    targetPort: 27017
    protocol: TCP

Referencing the ServicePort documentation, which reads in part:

nodePort     The port on each node on which this service is exposed when type=NodePort or LoadBalancer. Usually
integer      assigned by the system. If specified, it will be allocated to the service if unused or else creation of the
             service will fail. Default is to auto-allocate a port if the ServiceType of this Service requires one. More info: 
             http://kubernetes.io/docs/user-guide/services#type--nodeport

port         The port that will be exposed by this service.
integer

targetPort   Number or name of the port to access on the pods targeted by the service. Number must be in the range 1
IntOrString  to 65535. Name must be an IANA_SVC_NAME. If this is a string, it will be looked up as a named port in the
             target Pod's container ports. If this is not specified, the value of the 'port' field is used (an identity map).
             This field is ignored for services with clusterIP=None, and should be omitted or set equal to the 'port' field.
             More info: http://kubernetes.io/docs/user-guide/services#defining-a-service

My understanding is that the port that a client outside of the cluster will "see" will be the dynamically assigned one in the range of 30000-32767, as defined in the documentation. This will, using some black magic that I do not yet understand, flow to the targetPort on a given node (27017 in this case).

So what is the port used for here?

2 Answers 2

57

nodePort is the port that a client outside of the cluster will "see". nodePort is opened on every node in your cluster via kube-proxy. With iptables magic Kubernetes (k8s) then routes traffic from that port to a matching service pod (even if that pod is running on a completely different node).

port is the port your service listens on inside the cluster. Let's take this example:

---
apiVersion: v1
kind: Service
metadata:
  name: my-service
spec:
  ports:
  - port: 8080
    targetPort: 8070
    nodePort: 31222
    protocol: TCP 
  selector:
    component: my-service-app

From inside my k8s cluster this service will be reachable via my-service.default.svc.cluster.local:8080 (service to service communication inside your cluster) and any request reaching there is forwarded to a running pod on targetPort 8070.

tagetPort is also by default the same value as port if not specified otherwise.

5
  • Thank you. So nodePort is not a port that the Service listens on? It is instead a port that is opened on Nodes hosting the Pods that the Service fronts? Commented Jan 31, 2017 at 17:42
  • 2
    nodePort is unique, so 2 different services cannot have the same nodePort assigned. Once declared, the k8s master reserves that nodePort for that service. nodePort is then opened on EVERY node (master and worker) - also the nodes that do not run a pod of that service - k8s iptables magic takes care of the routing. That way you can make your service request from outside your k8s cluster to any node on nodePort without worrying whether a pod is scheduled there or not.
    – fishi0x01
    Commented Jan 31, 2017 at 17:45
  • 11
    From the #kubernetes-users Slack channel: "the nodePort routes to the service, which in turn routes to the pod / if you hit the service directly then the nodePort step is skipped / the 'magical routing' is handled by kube-proxy". This led me to say (using invented notation): "nodePort -> port -> targetPort, not nodePort -> targetPort && port -> targetPort". Commented Jan 31, 2017 at 20:02
  • @LairdNelson I like that port chain explanation. I wasn't entirely sure if kube-proxy always routes to the service port first (coming from nodePort) or if in some cases it skips this step and goes directly nodePort -> targetPort. Thank you for that clarification!
    – fishi0x01
    Commented Feb 1, 2017 at 9:24
  • In your example: any.host.in.the.cluster:31222 => service.listening:8080 => one.of.the.pods.listening:8070 more info in this scenario:katacoda.com/courses/kubernetes/networking-introduction
    – NicoKowe
    Commented Oct 8, 2018 at 21:53
8

To explain better the concept, I visualize Service's NodePort concept.

NodePort Service

As @fishi mentioned in his answer NodePort allows exposing k8s host port(aka nodePort) to the external clients. A client can directly access nodePort and k8s forwards a traffic to the necessary port.

K8s reserves a nodePort on all its nodes. All nodes that running the Service's pods have this port open.

Pods can be accessed not only through internal cluster IP but also through node's IP and reserved port aka HOST_IP:NODE_PORT pair.

3
  • 2
    I believe the image is misguiding. If, CURL 10.0.2.15:30230 is an external call, it should point to the cloud NodePort and that one does the request follow to the pod. That would mean that the cloud part should have Node IP: 10.0.2.15 and NodePort: 30230. And additionally, the "Pod: CURL" pod should be shown with a request directly to the "Pod: Nginx" pod. You can also have "Pod: CURL" pod have a request to the Node cloud part, but I don't think you wanted to depict that.
    – despot
    Commented May 4, 2020 at 12:07
  • In this diagram, I think 'hostPort' is the nodePort, and 'Node Port' is the port. Commented Dec 14, 2020 at 18:20
  • This is confusing! I guess Commented Apr 7, 2021 at 9:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.