Kubernetes: Services

How a Kubernetes Service gives a group of pods one address that stays while the pods come and go, and the three ways in its types add — ClusterIP inside the cluster, NodePort on every node, LoadBalancer on the internet.

A Service gives a group of pods one address that lasts as long as the Service, while the pods behind it come and go.

The cluster is the Pod Network's.
First a pod is replaced under a client that held its address.
Then one Service, web, grows through its three types:
- ClusterIP: an address inside the cluster, for pods;
- NodePort: the same, plus a port on every node, for computers that reach the nodes;
- LoadBalancer: the same, plus a load balancer the cloud makes, for the internet.

Reading the drawing

The Service is a chip between the two rows of nodes. Every connection to it flies to the chip, then on to the pod that answers.
A pod the Service sends to carries the tag Service web.
The cloud provider, top right, stays empty until a Service asks for a load balancer: cloud-controller-manager asks it for one, and it makes the load balancer in the cloud's network.
vm-1 is a computer on the node network, outside the cluster.
Each web pod's page holds its own name, so every answer shows which pod sent it.

A pod's address and its replacement

A pod's address lasts as long as the pod.

A Deployment replaces a pod that:
- is deleted;
- was on a node that failed;
- belongs to an old version during a rollout.
The replacement is a new pod, with a new address.
A client that held the old address reaches nothing.

ClusterIP: one address for a group of pods

 1apiVersion: v1
 2kind: Service
 3metadata:
 4  name: web
 5spec:
 6  selector:
 7    app: web
 8  ports:
 9    - port: 80
10      targetPort: 80

The Service gets an address of its own, its cluster IP:
- from a range kept for Services, 10.96.0.0/12 here;
- it lasts as long as the Service.
The selector names its pods by label.
- Kubernetes keeps a list of the running pods labelled app=web, in an EndpointSlice beside the Service.
- It rewrites the list as pods start and go.
A connection to the cluster IP reaches one of the pods on the list, on any node. Each new connection may reach a different one.
The Service also has a name. The cluster's DNS server answers web (in full, web.default.svc.cluster.local) with the cluster IP, so a pod can connect to http://web.
ClusterIP is the default type, reachable from inside the cluster.

NodePort: a port on every node

type: NodePort keeps everything a ClusterIP Service has, and adds one port on every node's own address.

The port comes from 30000–32767. A port named in nodePort: is used as it is; left out, the cluster picks a free one.
Every node accepts the port, the manage nodes too, and hands the connection to the Service, which picks a pod on any node.
The client must reach the nodes' addresses: here vm-1, a computer on the node network.
The client names a node. A node that is replaced takes its address with it, so NodePort alone suits tests, and networks that already know the nodes.

LoadBalancer: an address on the internet

type: LoadBalancer keeps the cluster IP and the node port, and asks the cloud for a load balancer.

cloud-controller-manager asks the cloud. The Service's external IP reads <pending> until the load balancer exists.
The load balancer is the cloud's:
- it has an address on the internet;
- it forwards each connection to the node port on one of the workers.
The manage nodes carry the label node.kubernetes.io/exclude-from-external-load-balancers, which keeps them off the load balancer's list.
The user knows one address, and the load balancer knows the nodes, so nodes and pods can be replaced without the user seeing any change.

The three types in one Service

Each type contains the one before it, so a LoadBalancer Service shows all three in one line:

1NAME   TYPE           CLUSTER-IP     EXTERNAL-IP    PORT(S)        AGE
2web    LoadBalancer   10.96.142.17   203.0.113.10   80:31380/TCP   3m

CLUSTER-IP: the address inside the cluster.
PORT(S): port 80 on the Service's address, and 31380 on every node.
EXTERNAL-IP: the load balancer's address on the internet.
Changing a Service's type keeps the cluster IP and the node port it already has.

The symbols for the node, the kubelet, the pod and the Service come from the Kubernetes Icons Set, licensed under Apache-2.0 or CC-BY-4.0.

The course Kubernetes Networking works through Services on your own two-node cluster.