48

I would like to understand the mapping between the service port and pod container port.

Do I need to define the container port as part of my pod and also as part of my service? Or it's ok just to expose it as part of the service?

4 Answers 4

59

containerPort as part of the pod definition is only informational purposes. Ultimately if you want to expose this as a service within the cluster or node then you have to create a service.

To answer your question, yes it is enough if you just expose it as part of the Kubernetes service. It is a good practice to mention as part of the pod definition so that if someone looks at the definition can understand the port where your container service is running.

This is very well explained here

Official kubernetes reference documentation

2
  • 1
    k8s website explained it as well: kubernetes.io/docs/reference/kubernetes-api/workload-resources/… "Exposing a port here gives the system additional information about the network connections a container uses, but is primarily informational. Not specifying a port here DOES NOT prevent that port from being exposed."
    – Sany Liew
    Apr 1, 2022 at 8:37
  • Thank you for pointing out. I have updated with the k8 reference link as well.
    – Lokesh
    Apr 1, 2022 at 17:40
26

The port that the container exposes and the port of the service are different concepts in Kubernetes.

If you want to create a service for your app, your pod has to have a port. For example, this is a pod yaml:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-nginx
spec:
  selector:
    matchLabels:
      run: my-nginx
  replicas: 2
  template:
    metadata:
      labels:
        run: my-nginx
    spec:
      containers:
      - name: my-nginx
        image: nginx
        ports:
        - containerPort: 8080

containerPort sets the port that app will expose.

To access this app via a service you have to create a service object with such yaml:

apiVersion: v1
kind: Service
metadata:
  name: my-nginx
  labels:
    run: my-nginx
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 8080
  selector:
    run: my-nginx

In this yaml, keyword port sets the port of the service. targetPort is the port of your app. So, port of the service is different.

Here is a good definition from official doc:

A Kubernetes Service is an abstraction which defines a logical set of Pods and a policy by which to access them - sometimes called a micro-service. The set of Pods targeted by a Service is (usually) determined by a Label Selector (see below for why you might want a Service without a selector).

2
  • Example scenario from offical doc: kubernetes.io/docs/tasks/access-application-cluster/…
    – Yavuz Sert
    Apr 18, 2019 at 7:48
  • 4
    containerPort does not set the port that will be exposed, it is purely informational and had no effect on Kubernetes networking. It is however good practice to document the port that the container is listening on for the next poor soul that is trying to figure out your system.
    – bikeman868
    Nov 25, 2021 at 20:30
20

Let's take an example and try to understand with the help of a diagram. Consider a cluster having 2 nodes and one service. Each nodes having 2 pods and each pod having 2 containers say app container and web container.

NodePort: 30001 (cluster level exposed port for each node)

Port: 80 (service port)

targetPort:8080 (app container port same should be mentioned in docker expose)

targetPort:80 (web container port same should be mentioned in docker expose)

Now the below diagram should help us understand it better.

enter image description here

For reference and further details please refer to below link https://theithollow.com/2019/02/05/kubernetes-service-publishing/

3
  • Your NodePort as a typo: missing a 0. Nov 20, 2021 at 2:53
  • corrected the typo
    – Aydin K.
    Dec 30, 2021 at 9:36
  • so can I access container port by directly using the Pod's IP?
    – toto'
    Jul 11 at 20:57
0

Actually, there is one case , where pod.spec.ports[].containerPort is put to 'use' in my opinion.

I do agree with all that mostly its Informational only , considering by-design all Ports are made available from Pod.

But , if the ports[*].name is defined. This serves a mapping for the port that can be externally addressed by service. Help to ease the port mapping.

$kubectl expose pod mypod --port=300 --target-port=MostfamousPort
 

Instead of Actual port-id , Port is addressed by a 'Name'

ports:
- containerPort: 80
  name: MostfamousPort

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.