<p>Cluster setup:</p>

<ul>
<li>OS: Ubuntu 18.04, w/ Kubernetes recommended install settings </li>
<li>Cluster is bootstrapped with Kubespray</li>
<li>CNI is Calico</li>
</ul>

<p>Quick Facts (when redis service ip is <code>10.233.90.37</code>):</p>

<ul>
<li>Host machine: <code>psql 10.233.90.37:6379</code> => success</li>
<li><p>Host machine: <code>psql 10.233.90.37:80</code> => success</p></li>
<li><p>Pods (in any namespace) <code>psql 10.233.90.37:6379</code> => timeout</p></li>
<li>Pods (in any namespace) <code>psql redis:6379</code> => timeout</li>
<li>Pods (in any namespace) <code>psql redis.namespace.svc.cluster.local</code> => timeout</li>
<li>Pods (in any namespace) <code>psql redis:80</code> => success</li>
<li>Pods (in any namespace) <code>psql redis.namespace.svc.cluster.local:80</code> => success</li>
</ul>

<p>Kubernetes Service (NodePort, LoadBalancer, ClusterIP) will not forward ports other than 80 and 443, for pods. The pod ports can be different, but the requests to the Service will time out if the Service port is not 80 or 443.</p>

<p>Requests from the host machine to a Kubernetes Service on ports other than 80 and 443 work. BUT requests from pods to these other ports fail.</p>

<p>Requests from pods to services on ports 80 and 443 do work.</p>

<pre class="lang-sh prettyprint-override"><code>user@host: curl 10.233.90.37:80
200 OK
user@host: curl 10.233.90.37:5432
200 OK

# ... exec into Pod
```bash
bash-4.4# curl 10.233.90.37:80
200 OK
bash-4.4# curl 10.233.90.37:5432
Error ... timeout ...
</code></pre>

<pre class="lang-sh prettyprint-override"><code>user@host: kubectl get NetworkPolicy -A
No resources found.
user@host: kubectl get PodSecurityPolicy -A
No resources found.
</code></pre>

<p>Example service:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  labels:
    app: redis
  name: redis
  namespace: namespace
spec:
  ports:
  - port: 6379
    protocol: TCP
    targetPort: 6379
    name: redis
  - port: 80
    protocol: TCP
    targetPort: 6379
    name: http
  selector:
    app: redis
  type: NodePort # I've tried ClusterIP, NodePort, and LoadBalancer
</code></pre>

<p>What's going on with this crazy Kubernetes Service port behavior!?</p>

<p>After debugging, I've found that it may be related to ufw and iptables config.</p>

<p>ufw settings (very permissive):</p>

<pre class="lang-sh prettyprint-override"><code>Status: enabled
80                         ALLOW       Anywhere
443                        ALLOW       Anywhere
6443                       ALLOW       Anywhere
2379                       ALLOW       Anywhere
2380                       ALLOW       Anywhere
10250/tcp                  ALLOW       Anywhere
10251/tcp                  ALLOW       Anywhere
10252/tcp                  ALLOW       Anywhere
10255/tcp                  ALLOW       Anywhere
179                        ALLOW       Anywhere
5473                       ALLOW       Anywhere
4789                       ALLOW       Anywhere
10248                      ALLOW       Anywhere
22                         ALLOW       Anywhere
80 (v6)                    ALLOW       Anywhere (v6)
443 (v6)                   ALLOW       Anywhere (v6)
6443 (v6)                  ALLOW       Anywhere (v6)
2379 (v6)                  ALLOW       Anywhere (v6)
2380 (v6)                  ALLOW       Anywhere (v6)
10250/tcp (v6)             ALLOW       Anywhere (v6)
10251/tcp (v6)             ALLOW       Anywhere (v6)
10252/tcp (v6)             ALLOW       Anywhere (v6)
10255/tcp (v6)             ALLOW       Anywhere (v6)
179 (v6)                   ALLOW       Anywhere (v6)
5473 (v6)                  ALLOW       Anywhere (v6)
4789 (v6)                  ALLOW       Anywhere (v6)
10248 (v6)                 ALLOW       Anywhere (v6)
22 (v6)                    ALLOW       Anywhere (v6)
</code></pre>

<p>Kubespray deployment fails with ufw disabled. Kubespray deployment succeeds with ufw enabled.</p>

<p>Once deployed, disabling ufw will allow pods to connect on ports other than 80, 443. However, the cluster crashes when ufw is disabled.</p>

<p>Any idea what's going on? Am I missing a port in ufw config.... ? Seems weird that ufw would be required for kubespray install to succeed.</p>

Shain Lafazan
<p><code>LoadBalancer</code> service exposes 1 external IP which external clients or users will use to connect with your app. In most cases, you would expect your <code>LoadBalancer</code> service to listen on port <code>80</code> for http traffic and port <code>443</code> for https. Because you would want your users to type <code>http://yourapp.com</code> or <code>https://yourapp.com</code> instead of <code>http://yourapp.com:3000</code>.</p>

<p>It looks like you are mixing different services in your Example service yaml for e.g. <code>nodePort</code> is used when service is of type <code>NodePort</code>. You may try:</p>

<pre><code>apiVersion: v1
kind: Service
metadata:
  labels:
    app: redis
    role: master
    tier: backend
  name: redis
spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 6379    // service will target containers on port 6379
    name: someName
  selector:
    app: redis
    role: master
    tier: backend
  type: LoadBalancer
</code></pre>
