Port number 

Instead of picking a specific port with nodePort: 30036 , you can let Kubernetes pick a free port within its range. 

Firewall rules 

Since this method opens a port on all the nodes, you may have to configure addi‐ tional firewall rules to let external clients access the node ports. 

Node selection 

An external client can open connection to any node in the cluster. However, if the node is not available, it is the responsibility of the client application to connect to another healthy node. For this purpose, it may be a good idea to put a load bal‐ ancer in front of the nodes that picks healthy nodes and performs failover. 

Pods selection 

When a client opens a connection through the node port, it is routed to a ran‐ domly chosen Pod that may be on the same node where the connection was open or a different node. It is possible to avoid this extra hop and always force Kuber‐ netes to pick a Pod on the node where the connection was opened by adding externalTrafficPolicy: Local  to the Service definition. When this option is set, Kubernetes does not allow connecting to Pods located on other nodes, which can be an issue. To resolve that, you have to either make sure there are Pods placed on every node (e.g., by using Daemon Services ), or make sure the client knows which nodes have healthy Pods placed on them. 

Source addresses 

There are some peculiarities around the source addresses of packets sent to dif‐ ferent types of Services. Specifically, when we use type NodePort , client addresses are source NAT’d, which means the source IP addresses of the network packets containing the client IP address are replaced with the node’s internal addresses. For example, when a client application sends a packet to node 1, it replaces the source address with its node address and replaces the destination address with the Pod’s address, and forwards the packet to node 2, where the Pod is located. When the Pod receives the network packet, the source address is not equal to the original client’s address but is the same as node 1’s address. To prevent this from happening, we can set externalTrafficPolicy: Local  as described earlier and forward traffic only to Pods located on node 1. 

