NodePort Services

In the previous lesson, you built a three-tier shop application using ClusterIP Services. You learned that ClusterIP provides stable, internal-only endpoints for communication between Pods inside your cluster. Your frontend could talk to your backend, and your backend could talk to your database — all using simple DNS names like backend-svc and database-svc.

But there's a problem: ClusterIP Services are only accessible from inside the cluster. If you want actual users on the internet to access your frontend application, ClusterIP won't work. You need a way to expose your application externally, and that's where NodePort Services come in. In this lesson, you'll learn how NodePort builds on top of ClusterIP to provide external access, understand the three-port system that makes it work, and discover when NodePort is the right choice for your application.

Here's the key insight about NodePort Services: they don't replace ClusterIP — they extend it. When you create a NodePort Service, you still get all the ClusterIP functionality you learned about in the previous lesson. The Service still gets a stable Cluster IP address, a DNS name, and internal load balancing. NodePort simply adds an additional capability on top: it opens a specific port on every node in your cluster, allowing external traffic to reach your Pods.

Think of it like adding a front door to a building. The internal hallways (ClusterIP) still work exactly the same way — employees can move between rooms using internal doors. But now there's also a front entrance (NodePort) that lets people from outside come in. Both access methods lead to the same rooms (Pods), but they serve different purposes.

Here is how the traffic flow works: When you create a NodePort Service, Kubernetes opens the same port on every single node in your cluster. This means you can reach your application by connecting to any node's IP address on that port. For example, if your NodePort is 30080, you can reach your application at NodeA:30080, NodeB:30080, or NodeC:30080. Kubernetes will automatically route that traffic to the correct backend Pods.

There is an important constraint to remember: By default, NodePort Services use ports in the range 30000-32767. This is the standard range configured on most Kubernetes clusters and what you'll encounter in practice. You cannot use standard ports like 80 or 443 directly because those might conflict with system services running on the host machine. The 30000-32767 range is high enough to avoid most common conflicts. (Note: While this range is configurable via the API server's --service-node-port-range flag, changing it is rare and not recommended unless you have specific infrastructure requirements.)

The beauty of this system is that it maintains all the ClusterIP benefits while adding external access. Your Pods inside the cluster can still use the Service's DNS name to connect internally, while external users connect via the node IP and port.