Accessing Services From Outside the Cluster

Let's discuss the idea of accessing Services from outside the cluster.

Introduction

Kubernetes has another type of Service called a NodePort Service. This builds on the top of ClusterIP and enables access from outside of the cluster.

You already know that the default Service type is ClusterIP, and it registers a DNS name, virtual IP, and port with the cluster’s DNS. A different type of Service, called a NodePort, Service builds on this by adding another port that can be used to reach the Service from outside the cluster. This additional port is called the NodePort.

The following example represents a NodePort Service:

  • name: magic-sandbox
  • clusterIP: 172.12.5.17
  • port: 8080
  • nodePort: 30050

This magic-sandbox Service can be accessed from inside the cluster via magic-sandbox on port 8080, or 172.12.5.17 on port 8080. It can also be accessed from outside of the cluster by sending a request to the IP address of any cluster node on port 30050.

At the bottom of the stack are cluster nodes that host Pods. You add a Service and use labels to associate it with Pods. The Service object has a reliable NodePort mapped to every node in the cluster –- the NodePort value is the same on every node. This means that traffic from outside of the cluster can hit any node in the cluster on the NodePort and get through to the application (Pods).

Example of a NodePort Service

The figure below shows a NodePort Service where 3 Pods are exposed externally on port 30050 on every node in the cluster.

  1. In step 1, an external client hits Node2 on port 30050.
  2. In step 2 it is redirected to the Service object (this happens even though Node2 isn’t running a Pod from the Service).
  3. Step 3 shows that the Service has an associated Endpoint object with an always-up-to-date list of Pods matching the label selector.
  4. Step 4 shows the client being directed to pod1 on Node1.

Get hands-on with 1200+ tech skills courses.