<p>I need for a service in a K8 pod to be able to make HTTP calls to downstream services, load balanced by a NodePort, within the same cluster and namespace.</p>

<p>My constraints are these:</p>

<ul>
<li>I can do this only through manipulation of deployment and service
entities (no ingress. I don't have that level of access to the
cluster)  </li>
<li>I cannot add any K8 plugins </li>
<li>The port that the NodePort exposes must be randomized, not hard coded  </li>
<li>This whole thing must be automated. I can't set the deployment with the literal value of
the exposed port. It needs to be set by some sort of variable, or
similar process.</li>
</ul>

<p>Is this possible, and, if so, how?</p>

<p>It probably can be done but it will not be straight forward and you might have to add some custom automation. A <a href="https://kubernetes.io/docs/concepts/services-networking/service/#nodeport" rel="nofollow noreferrer"><code>NodePort</code></a> service is meant to be used by an entity outside your cluster.  </p>

<p>For inter-cluster communication, a regular service (with a ClusterIP) will work as designed. Your service can reach another service using <a href="https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/" rel="nofollow noreferrer">DNS service discovery</a>. For example. <code>svc-name.mynamespace.svc.cluster.local</code> would be the DNS entry for a <code>svc-name</code> in the <code>mynamespace</code> namespace.</p>

<p>If you can only do a <code>NodePort</code> which essentially is a port on your K8s nodes, you could create another <a href="https://kubernetes.io/docs/concepts/workloads/controllers/deployment/" rel="nofollow noreferrer">Deployment</a> or Pod of something like <a href="http://nginx.org" rel="nofollow noreferrer">nginx</a> or <a href="http://www.haproxy.org/" rel="nofollow noreferrer">haproxy</a>. Then have this deployment being serviced by regular K8s service with a ClusterIP. Then have nginx or haproxy point to the NodePort on all your nodes in your Kubernetes cluster. Also, have it configured so that it only forwards to listening NodePorts with some kind of healthcheck.</p>

<p>The above seems like an extra necessary step, but if NodePort from within the cluster is what you need (for some reason), it should do the trick.</p>
