Kubernetes Network: Port, NodePort, TargetPort

3 min readJul 24


When you want to access a Pod via a network port, you need to expose it.

The easiest way to expose a port is by using NodePort.

Photo by Denys Nevozhai on Unsplash

Let’s assume you have a simple Nginx container.

Generate a base yaml file:

kubectl run hello-nginx --image=nginx --dry-run=client -o yaml

Modify it:

apiVersion: v1
kind: Pod
run: hello-nginx
name: hello-nginx
- image: nginx
name: hello-nginx

The nginx container will run on Port 80. Let’s assume, you want to access this container’s Port 80 via Node_Public_IP:30003.

Generate a service yaml file:

kubectl create service nodeport hello-nginx-port-expose --tcp=8181:80 --dry-run=client -o yaml

Modify it:

apiVersion: v1
kind: Service
app: hello-nginx-port-expose
name: hello-nginx-port-expose
- name: 8181-80
port: 8181
protocol: TCP
targetPort: 80
nodePort: 30003
run: hello-nginx
type: NodePort

Get your Node’s external IP address:

kubectl get node -o wide

Get your hello-nginx-port-expose service Port numbers:

kubectl get svc -o wide
hello-nginx-port-expose NodePort <none> 8181:30003/TCP 47m run=hello-nginx

What are Port 30003 and Port 8181?

We have seen 3 different port numbers so far.

  1. Nginx port (targetPort)-> 80
  2. Exposed port (port) -> 8181
  3. NodePort -> 30046

When you try to expose your application container, you first need to expose it in the cluster. This is called Port (yes only port). After that, you will need to expose a port to the public internet. This is called NodePort.

By design, Kubernetes will assign a random port number between 3000032767 to NodePort. If you specify a port number for NodePort in the service yaml file, Kubernetes will try to assign that number.

You can’t assign a port number lower than 30000 or higher than 32767 in the service yaml file.

You will get the following error:

The Service "hello-nginx-port-expose" is invalid: spec.ports[0].nodePort: Invalid value: 9090: provided port is not in the valid range. The range of valid ports is 30000-32767

So, we have 3 different ports with these names: port, targetPort, and nodePort:

I would change these names to:

port -> internalPort (or servicePort)
targetPort -> applicationPort (or podPort)
nodePort -> externalPort (or publicPort)

I think if the names were like that, it would be much more understandable for beginners.

When you try to access your nodePort 30003 (publicPort) your request will eventually hit the hello-nginx-port-expose service. This service’s port number (internalPort, servicePort) is 8181. Your request will be forwarded from Port 30003 to Port 8181.

After that, your request will be forwarded to pods that have this key-value pair:


Please notice, we have created our pod with the run=hello-nginx label.

The request will be forwarded to Port 80 of the pods labeled run=hello-nginx

You can see the mapping with this command:

kubectl describe svc hello-nginx-port-expose

IP Family Policy:         SingleStack
IP Families: IPv4
Port: 8181-80 8181/TCP
TargetPort: 80/TCP
NodePort: 8181-80 30003/TCP

Basically, the flow is like this: Port 30003 -> Port 8181 -> find run=hello-nginx -> Port 80