What is the "port" used for for a Kubernetes Service

Question

Considering a very simple service.yaml file:

kind: Service
apiVersion: v1
metadata:
  name: gateway-service
spec:
  type: NodePort
  selector:
    app: gateway-app
  ports:
  - name: gateway-service
    protocol: TCP
    port: 80
    targetPort: 8080
    nodePort: 30080

We know that service will route all the requests to the pods with this label app=gateway-app at port 8080 (a.k.a. targetPort). There is another port field in the service definition, which is 80 in this case here. What is this port used for? When should we use it?

From the documentation, there is also this line:

By default the targetPort will be set to the same value as the port field.

Reference: https://kubernetes.io/docs/concepts/services-networking/service/

In other words, when should we keep targetPort and port the same and when not?

Answer 1

In a nodePort service you can have 3 types of ports defined:

TargetPort:

As you mentioned in your question, this is the corresponding port to your pod and essentially the containerPorts you have defined in your replica manifest.

Port (servicePort):

This defines the port that other local resources can refer to. Quoting from the Kubernetes docs:

this Service will be visible [locally] as .spec.clusterIP:spec.ports[*].port

Meaning, this is not accessible publicly, however you can refer to your service port through other resources (within the cluster) with this port. An example is when you are creating an ingress for this service. In your ingress you will be required to present this port in the servicePort field:

  ...
        backend:
          serviceName: test
          servicePort: 80

NodePort:

This is the port on your node which publicly exposes your service. Again quoting from the docs:

this Service will be visible [publicly] as [NodeIP]:spec.ports[*].nodePort

Answer 2

Port is what clients will connect to. TargetPort is what container is listening. One use case when they are not equal is when you run container under non-root user and cannot normally bind to port below 1024. In this case you can listen to 8080 but clients will still connect to 80 which might be simpler for them.