External Access to Services
Inside the cluster, notes-web works. Your users, however, are on the internet, and the cluster IP means nothing to them. Kubernetes has a ladder of options for letting traffic in.
The rule
ClusterIP stays in, NodePort opens a port, LoadBalancer gets an address, Ingress routes by URL.
The Service type decides how far a Service reaches:
- ClusterIP (the default) — reachable only inside the cluster.
- NodePort — also opens the same port, from 30000–32767 by default, on every node.
http://<any-node-ip>:30080reaches the app. Fine for testing; awkward for real users. - LoadBalancer — on a cloud cluster, also asks the provider for an external load balancer with its own public address. Simple, but usually one load balancer, and one bill, per Service.
apiVersion: v1
kind: Service
metadata:
name: notes-web-public
namespace: notes
spec:
type: LoadBalancer
selector:
app: notes-web
ports:
- port: 80
targetPort: 8080Ingress works one level up. It is not a Service type but a separate object with HTTP rules: route by host name and path to different Services, and terminate TLS, all behind one address.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: notes
namespace: notes
spec:
ingressClassName: nginx
rules:
- host: notes.example.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: notes-web
port:
number: 80An Ingress does nothing on its own. An ingress controller — a program running in the cluster, such as ingress-nginx or Traefik — must be installed to read the rules and route the traffic.
The shortcut
Ask "how many apps, and does the URL matter?" One app, any protocol → LoadBalancer. Many HTTP apps behind one address, split by host or path → Ingress. Just testing → port-forward or NodePort.
Testing on kind
kubectl port-forward service/notes-web 8080:80— private, quick, done.
Drills
Answer fast — trust the rule.
Which Service type is reachable only from inside the cluster?
A NodePort Service uses port 30080. Where can it be reached?
You want notes.example.com/ and notes.example.com/api to go to two Services behind one address. What fits?
You applied an Ingress but no traffic ever reaches notes-web. What is the most likely missing piece?
Remember
- ClusterIP stays in, NodePort opens a port on every node, LoadBalancer gets an address, Ingress routes by URL.
- One app → LoadBalancer; many HTTP apps behind one address → Ingress; testing → port-forward.
- Trap: an Ingress without a controller does nothing.