<p>In the past I've tried <code>NodePort</code> service and if I add a firewall rule to the corresponding Node, it works like a charm:</p>
<pre><code>  type: NodePort
  ports:
    - nodePort: 30000
      port: 80
      targetPort: 5000
</code></pre>
<p>I can access my service from outside and long as the node has an external IP(which it does by default in GKE).
However, the service can only be assigned to 30000+ range ports, which is not very convenient.
By the way, the Service looks as follows:</p>
<pre><code> kubectl get service -o=wide
NAME                     TYPE       CLUSTER-IP      EXTERNAL-IP   PORT(S)        AGE   SELECTOR
web-engine-service   NodePort   10.43.244.110   &lt;none&gt;        80:30000/TCP   11m   app=web-engine-pod
</code></pre>
<p>Recently, I've come across a different configuration option that is documented <a href="https://kubernetes.io/docs/concepts/services-networking/service/#external-ips" rel="nofollow noreferrer">here</a>.
I've tried is as it seems quite promising and should allow to expose my service on any port I want.<br />
The configuration is as follows:</p>
<pre><code>  ports:
    - name: web-port
      port: 80
      targetPort: 5000
  externalIPs:
    - 35.198.163.215
</code></pre>
<p>After the service updated, I can see that External IP is indeed assigned to it:</p>
<pre><code>$ kubectl get service -o=wide
NAME                     TYPE        CLUSTER-IP      EXTERNAL-IP      PORT(S)   AGE   SELECTOR
web-engine-service   ClusterIP   10.43.244.110   35.198.163.215   80/TCP    19m   app=web-engine-pod
</code></pre>
<p>(where <code>35.198.163.215</code> - Node's external IP in GKE)</p>
<p>And yet, my app is not available on the Node's IP, unlike in the first scenario(I did add firewall rules for all ports I'm working with including <code>80</code>, <code>5000</code>, <code>30000</code>).</p>
<p>What's the point of <code>externalIPs</code> configuration then? What does it actually do?</p>
<p><strong>Note:</strong> I'm creating a demo project, so please don't tell me about <code>LoabBalancer</code> type, I'm well aware of that and will get to that a bit later.</p>

yuranos
<p>In the <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.18/#servicespec-v1-core" rel="nofollow noreferrer">API documentation</a>, <code>externalIPs</code> is documented as (emphasis mine):</p>
<blockquote>
<p>externalIPs is a list of IP addresses for which nodes in the cluster will also accept traffic for this service. <strong>These IPs are not managed by Kubernetes. The user is responsible for ensuring that traffic arrives at a node with this IP.</strong> A common example is external load-balancers that are not part of the Kubernetes system.</p>
</blockquote>
<p>So you can put any IP address you want there, and it will show up in <code>kubectl get service</code> output, but it doesn't mean the cluster will actually accept traffic there.</p>
<p>To accept inbound traffic from outside the cluster, you need a minimum of a NodePort service; in a cloud environment a LoadBalancer service or an Ingress is a more common setup.  You can't really short-cut around these.  Conversely, a LoadBalancer isn't especially advanced or difficult, just change <code>type: LoadBalancer</code> in the configuration you already show and GKE will create the endpoint for you.  The <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/exposing-apps#creating_a_service_of_type_loadbalancer" rel="nofollow noreferrer">GKE documentation</a> has a more complete example.</p>
<p>(&quot;Inside the cluster&quot; and &quot;outside the cluster&quot; are different networks, and like other NAT setups pods can generally make outbound calls but you need specific setup to accept inbound calls.  That's what a NodePort service does, and in the standard setup a LoadBalancer service builds on top of that.)</p>
