<p>I was using NodePort to host a webapp on Google Container Engine (GKE). It allows you to directly point your domains to the node IP address, instead of an expensive Google load balancer. Unfortunately, instances are created with HTTP ports blocked by default, and an update locked down manually changing the nodes, as they are now created using and Instance Group/and an Immutable Instance Template.</p>

<p><strong>I need to open port 443 on my nodes, how do I do that with Kubernetes or GCE? Preferably in an update resistant way.</strong></p>

<p><a href="https://i.stack.imgur.com/cBa5b.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/cBa5b.png" alt="enter image description here"></a></p>

<p>Related github question: <a href="https://github.com/nginxinc/kubernetes-ingress/issues/502" rel="nofollow noreferrer">https://github.com/nginxinc/kubernetes-ingress/issues/502</a></p>

<p>Using port 443 on your Kubernetes nodes is not a standard practice. If you look at the <a href="https://kubernetes.io/docs/concepts/services-networking/service/#nodeport" rel="nofollow noreferrer">docs</a> you and see the kubelet option <code>--service-node-port-range</code> which defaults to <code>30000-32767</code>. You could change it to <code>443-32767</code> or something. Note that every port under <code>1024</code> is restricted to <a href="https://unix.stackexchange.com/questions/16564/why-are-the-first-1024-ports-restricted-to-the-root-user-only">root</a>.</p>

<p>In summary, it's not a good idea/practice to run your Kubernetes services on port <code>443</code>. A more typical scenario would be an external nginx/haproxy proxy that sends traffic to the NodePorts of your service.  The other option you mentioned is using a cloud load balancer but you'd like to avoid that due to costs.</p>
