<p dir="auto"><strong>Is this a request for help?</strong> (If yes, you should use our troubleshooting guide and community support channels, see <a href="http://kubernetes.io/docs/troubleshooting/" rel="nofollow">http://kubernetes.io/docs/troubleshooting/</a>.): <code class="notranslate">No</code></p>
<p dir="auto"><strong>What keywords did you search in Kubernetes issues before filing this one?</strong> (If you have found any duplicates, you should instead reply there.): <code class="notranslate">nodePort</code>, <code class="notranslate">kubeadm</code></p>
<hr>
<p dir="auto"><strong>Is this a BUG REPORT or FEATURE REQUEST?</strong> (choose one): <code class="notranslate">BUG REPORT</code></p>

<p dir="auto"><strong>Kubernetes version</strong> (use <code class="notranslate">kubectl version</code>):</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="$ kubectl version
Client Version: version.Info{Major:&quot;1&quot;, Minor:&quot;4&quot;, GitVersion:&quot;v1.4.3&quot;, GitCommit:&quot;4957b090e9a4f6a68b4a40375408fdc74a212260&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2016-10-16T06:36:33Z&quot;, GoVersion:&quot;go1.6.3&quot;, Compiler:&quot;gc&quot;, Platform:&quot;linux/amd64&quot;}
Server Version: version.Info{Major:&quot;1&quot;, Minor:&quot;4&quot;, GitVersion:&quot;v1.4.5&quot;, GitCommit:&quot;5a0a696437ad35c133c0c8493f7e9d22b0f9b81b&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2016-10-29T01:32:42Z&quot;, GoVersion:&quot;go1.6.3&quot;, Compiler:&quot;gc&quot;, Platform:&quot;linux/amd64&quot;}"><pre class="notranslate"><code class="notranslate">$ kubectl version
Client Version: version.Info{Major:"1", Minor:"4", GitVersion:"v1.4.3", GitCommit:"4957b090e9a4f6a68b4a40375408fdc74a212260", GitTreeState:"clean", BuildDate:"2016-10-16T06:36:33Z", GoVersion:"go1.6.3", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"4", GitVersion:"v1.4.5", GitCommit:"5a0a696437ad35c133c0c8493f7e9d22b0f9b81b", GitTreeState:"clean", BuildDate:"2016-10-29T01:32:42Z", GoVersion:"go1.6.3", Compiler:"gc", Platform:"linux/amd64"}
</code></pre></div>
<p dir="auto"><strong>Environment</strong>:</p>
<ul dir="auto">
<li><strong>Cloud provider or hardware configuration</strong>: AWS</li>
<li><strong>OS</strong> (e.g. from ca): Ubuntu 16.04.1 LTS</li>
<li><strong>Kernel</strong> (e.g. <code class="notranslate">uname -a</code>): 4.4.0-31-generic x86_64 GNU/Linux</li>
<li><strong>Install tools</strong>: kubeadm</li>
<li><strong>Others</strong>: single node cluster, with calico network plugin</li>
</ul>
<p dir="auto"><strong>What happened</strong>:</p>
<p dir="auto"><code class="notranslate">nodePort</code> attribute in pod does not map container port to host.</p>
<p dir="auto"><strong>What you expected to happen</strong>:</p>
<p dir="auto">Yaml file like:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ports:
- containerPort: 80
   hostPort: 80"><pre class="notranslate"><code class="notranslate">ports:
- containerPort: 80
   hostPort: 80
</code></pre></div>
<p dir="auto">should expose the container port 80 to host port 80.</p>
<p dir="auto"><strong>How to reproduce it</strong> (as minimally and precisely as possible):</p>
<p dir="auto">Create a pod use below yaml file:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="apiVersion: v1
kind: Pod
metadata:
  name: demo
spec:
  containers:
  - name: nginx-demo
    image: nginx
    ports:
    - containerPort: 80
      hostPort: 80"><pre class="notranslate"><code class="notranslate">apiVersion: v1
kind: Pod
metadata:
  name: demo
spec:
  containers:
  - name: nginx-demo
    image: nginx
    ports:
    - containerPort: 80
      hostPort: 80
</code></pre></div>
<p dir="auto">Then use <code class="notranslate">curl &lt;node-ip&gt;:80</code> try access it, will get <code class="notranslate">Connection refused</code> error.</p>
<p dir="auto">Check the docker container via <code class="notranslate">docker inspect &lt;container-id&gt;</code>, the container port is actually not exposed:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="&quot;HostConfig&quot;: {
  &quot;PortBindings&quot;: null
}
&quot;Config&quot;: {
  &quot;ExposedPorts&quot;: {
    &quot;443/tcp&quot;: {},
    &quot;80/tcp&quot;: {}
  }
}
&quot;NetworkSettings&quot;: {
  &quot;Ports&quot;: null,
}"><pre class="notranslate"><code class="notranslate">"HostConfig": {
  "PortBindings": null
}
"Config": {
  "ExposedPorts": {
    "443/tcp": {},
    "80/tcp": {}
  }
}
"NetworkSettings": {
  "Ports": null,
}
</code></pre></div>
<p dir="auto"><strong>Anything else do we need to know</strong>:</p>
<p dir="auto">Issue was found originally because the <a href="https://raw.githubusercontent.com/kubernetes/contrib/master/ingress/controllers/nginx/examples/default/rc-default.yaml" rel="nofollow">rc-default.yaml</a> file in ingress example require <code class="notranslate">nodePort</code>.</p>
<p dir="auto">Happy to send a patch for this -- I've already written an SNI Client Hello packet parser --</p>
<p dir="auto"><a href="https://github.com/paultag/sniff/blob/master/parser/parser.go">https://github.com/paultag/sniff/blob/master/parser/parser.go</a></p>
<p dir="auto">That code needs to be audited a bit, and fuzzed, but it's hello-world-ing. Anyone willing to break this?</p>
<p dir="auto">However, this will fail if the request has no SNI extension, so default routes are unclear to me.</p>
<p dir="auto">The HTTPS Ingress point could do TLS termination, but that'll be mildly annoying for containers that terminate TLS (perhaps Golang apps that to TLS Peer Authentication?), otherwise we could use virtual hosting on HTTP Host.</p>