Skip to content

Room 17

NODEPORT & LOADBALANCER

The Gateway

  • ClusterIP only works inside the cluster. To let the outside world in, you need NodePort or LoadBalancer.
  • Expose a service and access it from outside the cluster.

📜 Mission Briefing

  1. Apply nodeport-svc.yaml - exposes an nginx deployment on a NodePort.
  2. Find the assigned NodePort: kubectl get svc gateway-svc.
  3. Access the service using the node IP and NodePort.
  4. The service returns a page with a hidden password in an HTML comment.
  5. Use curl to fetch the page and grep for the password.
  6. The password is nodeport3.
Key Commands
Command Purpose
kubectl get svc -o wide Services with type and ports
kubectl get nodes -o wide Node IPs
kubectl describe svc NAME Service details including NodePort
curl NODE_IP:NODE_PORT Access NodePort service
NodePort & LoadBalancer
# NodePort: Exposes on all nodes at a static port (30000-32767)
apiVersion: v1
kind: Service
metadata:
  name: nodeport-svc
spec:
  type: NodePort
  selector:
    app: my-app
  ports:
    - port: 80               # Service port (internal)
      targetPort: 8080       # Container port
      nodePort: 30080        # Static node port (optional, auto-assigned if omitted)
---
# LoadBalancer: Provisions external LB (in cloud environments)
apiVersion: v1
kind: Service
metadata:
  name: lb-svc
spec:
  type: LoadBalancer
  selector:
    app: my-app
  ports:
    - port: 80
      targetPort: 8080

# NodePort flow: External → NodeIP:NodePort → Service → Pod:TargetPort

# Find NodePort
kubectl get svc nodeport-svc
# NAME           TYPE       CLUSTER-IP    PORT(S)        AGE
# nodeport-svc   NodePort   10.96.x.x     80:30080/TCP   1m

# Get node IP
kubectl get nodes -o wide
# Or for Kind:
docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' escape-room-control-plane

# Access the service
curl http://<node-ip>:30080

# In Kind, use port mappings in kind-config.yaml for LoadBalancer:
# extraPortMappings:
#   - containerPort: 30080
#     hostPort: 30080
Hints

Hint 1

Get the NodePort: 

kubectl get svc gateway-svc

Hint 2

For Kind, get the node container IP: 

kubectl get nodes -o wide
curl http://<INTERNAL-IP>:<NODE-PORT>

Hint 3

The password is nodeport3.

🔓 Unlock Room 18

openssl enc -aes-256-cbc -d -a -pbkdf2 \
        -in ../room_18/README             \
        -out ../room_18/README.txt        \
        -pass pass:PASSWORD
cat ../room_18/README.txt