Expose Apps with the Right Service Type

Why this matters

Wrong service types waste the most debuggable hours in app delivery: NodePorts committed to git, LoadBalancers that never provision on bare metal, hardcoded external IPs that rot. Choosing by caller keeps manifests portable across dev, staging and production, which is exactly what reviewers check.

Concepts

ClusterIP serves cluster callers on a stable virtual IP: the default and the right answer for service-to-service traffic. NodePort adds a node-wide port for human previews and lab access: convenient, unencrypted, unauthenticated, never the production front door. LoadBalancer asks the cloud for an external entry and populates it asynchronously: code for Pending as not-yet, not broken. ExternalName returns a CNAME for outside dependencies: config changes instead of manifest edits when the vendor moves.

Ports deserve precision: port is the Service's ear, targetPort is the container's ear, and naming targetPorts lets Deployments evolve container ports without touching Services. Endpoints prove every choice: no addresses means the selector is wrong regardless of type.

Worked example

API for cluster callers, preview for humans, vendor reached by name:

kubectl expose deployment api --port=80 --name=api
kubectl get endpoints api              # ready addresses: internal path proven
kubectl expose deployment api --port=80 --type=NodePort --name=api-preview
# preview at http://<node>:<nodeport>/ for humans only
apiVersion: v1
kind: Service
metadata: { name: vendor }
spec:
  type: ExternalName
  externalName: api.vendor.example
  ports: [{ port: 443 }]
# app calls https://vendor:443, vendor moves by editing one field

Each caller gets its proper door, and the app's code never names an infrastructure address except through these Services.

Exam notes

Fresh Services need fresh endpoints: check before declaring victory, every time. NodePort commits to manifests pin random high ports into git history: acceptable in tasks, flagged in reviews. And ExternalName ignores selectors entirely: endpoints stay empty by design, which is correct.