Full lesson
Explore the full explanation, examples, and visuals at your own pace.
Part 1
Which client can reach the API Pods? Inside is in the Cluster; Outside is beyond it. The Service connects to the same API Pods, but its type determines which entry point each client can use.
ClusterIP: inside the cluster
With ClusterIP, the API is reachable from inside the cluster, but there’s no direct external entry point. Inside sends traffic to the Service on port 80, and the Service forwards it to a selected API Pod on port 8080. Outside has no direct path to that ClusterIP address.
NodePort: a port on each node
NodePort adds an outside entry point. Outside can connect to a reachable Node address on port 30080, and traffic reaches the Service and API Pods on port 8080. Inside still uses Service port 80, so both clients reach the same Pods through different routes.
An illustrative NodePort Service
This Service keeps selecting the API Pods with app: api. It maps Service port 80 to their port 8080, while NodePort opens port 30080 on each node, giving an outside client an entry point through a reachable node.
apiVersion: v1
kind: Service
metadata:
name: api
spec:
type: NodePort
selector:
app: api
ports:
- port: 80
targetPort: 8080
nodePort: 30080The API uses NodePort, but an outside client cannot reach any node address. Can it use that NodePort?
Let's think this through. The API uses NodePort, but an outside client cannot reach any node address. Can it use that NodePort? A: Yes, the Service automatically gets a public address. B: No, the client needs network access to a node. C: No, NodePort works only inside the cluster. Choose an answer, or just think it through. I'll explain in a moment.
- Yes, the Service automatically gets a public address
- No, the client needs network access to a node
- No, NodePort works only inside the cluster
The API uses NodePort, but an outside client cannot reach any node address. Can it use that NodePort?
The answer is B: No, the client needs network access to a node. NodePort opens a port on each node, but it does not make a node reachable from every network. The outside client still needs a route to a node, and network rules must allow the traffic.
- Yes, the Service automatically gets a public address
- No, the client needs network access to a node
- No, NodePort works only inside the cluster
LoadBalancer: an external address
When provisioned, a load balancer gives outside clients an external address to reach the LB, then the Service and same API Pods. Inside clients still reach the Service on port 80, which forwards to the Pods on port 8080. The Service type changes the doorway, not the Pods.
Who can connect directly?
The in-cluster client can use the Service with all three types. ClusterIP has no direct outside entry; NodePort adds a reachable node, and LoadBalancer a provisioned address.
- ClusterIP: inside via Service
- NodePort: inside; outside via reachable node
- LoadBalancer: inside; outside via provisioned address
An entry point is not a connectivity guarantee.
A NodePort needs a reachable node and permitted traffic; LoadBalancer needs a supporting implementation and an assigned external address.
Same API Pods, different entry point
The Service type changes the entry point, not the selected Pods. In-cluster access remains available across all three; outside access depends on the doorway and network conditions.