<p>I am trying to set up TLS for a MessageSight service that has been installed on IBM Cloud Private(ICP) </p>

<p>ICP and MessageSight have already been installed and I was trying to see how the MessageSight has been exposed as a service (Is that a NodePort, LoadBalancer or Externalname)</p>

<pre><code>$kubectl get services 
NAME                              TYPE        CLUSTER-IP     EXTERNAL-IP     PORT(S)                       AGE
messagesight-messagesight-svc     ClusterIP   10.0.241.72    168.xx.xx.xxx   9089/TCP,1883/TCP,16102/TCP   9d
messagesight-messagesightui-svc   ClusterIP   10.0.139.199   168.xx.xx.xxx   9087/TCP                      9d
</code></pre>

<p>The type states it is a ClusterIP however it has an external IP. I always thought an external IP is going to empty if the service type is ClusterIP. If it were a LoadBalancer i would expect to see the external IP. </p>

<p>Describing the service does not provide any additional information</p>

<pre><code>kubectl describe svc messagesight-messagesight-svc 
Name:              messagesight-messagesight-svc
Labels:            app=messagesight
                   chart=messagesight
                   heritage=Tiller
                   release=messagesight
Annotations:       &lt;none&gt;
Selector:          app=messagesight,release=messagesight
Type:              ClusterIP
IP:                10.0.241.72
External IPs:      168.xx.xx.xxx
Port:              adminport  9089/TCP
TargetPort:        9089/TCP
Endpoints:         10.1.66.1:9089
Port:              messaging-1883  1883/TCP
TargetPort:        1883/TCP
Endpoints:         10.1.66.1:1883
Port:              messaging-16102  16102/TCP
TargetPort:        16102/TCP
Endpoints:         10.1.66.1:16102
Session Affinity:  None
Events:            &lt;none&gt;
</code></pre>

<p>I am able to access the service via the external-IP and ports and am puzzled as to how it is working.</p>

<p>I installed a Jenkins setup to make observations and the output looks good and makes sense to me</p>

<pre><code>$kubectl get services 
NAME                       TYPE       CLUSTER-IP     EXTERNAL-IP   PORT(S)                          AGE
jenkins-ibm-jenki   NodePort   10.0.241.156   &lt;none&gt;        8080:31058/TCP,50000:31155/TCP   1d
</code></pre>

<p>I can see the type is NodePort and it doesn't have a corresponding externalIP.</p>

<p>The description of the service also give me clear insights that this service is of type NodePort</p>

<pre><code>$kubectl describe svc jenkins-ibm-jenki 
Name:                     jenkins-ibm-jenki
Labels:                   app=jenkins-ibm-jenki
                          chart=ibm-jenkins-dev-1.0.2
                          component=jenkins-jenkins-master
                          heritage=Tiller
                          release=jenkins
Annotations:              helm.sh/created=1559696400
Selector:                 app=jenkins-ibm-jenki,component=jenkins-jenkins-master
Type:                     NodePort
IP:                       10.0.241.156
Port:                     http  8080/TCP
TargetPort:               8080/TCP
NodePort:                 http  31058/TCP
Endpoints:                10.1.66.89:8080
Port:                     slavelistener  50000/TCP
TargetPort:               50000/TCP
NodePort:                 slavelistener  31155/TCP
Endpoints:                10.1.66.89:50000
Session Affinity:         None
External Traffic Policy:  Cluster
Events:                   &lt;none&gt;
</code></pre>

<p>As stated in <a href="https://kubernetes.io/docs/concepts/services-networking/service/#external-ips" rel="nofollow noreferrer">documentation</a>:</p>

<p><code>In the Service spec, externalIPs can be specified along with any of the ServiceTypes</code></p>
