<p>So, according to <a href="https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/" rel="nofollow noreferrer">Kubernetes documentation</a>, when you have an external LoadBalancer service set with <code>externalTrafficPolicy=Local</code>, you can explicitly define a healthCheckNodePort.</p>
<p>If I understood correctly, since LB services with this specific externalTrafficPolicy are unable to determine if a pod is running inside of a node, this healthCheckNodePort should be used to evaluate just that. As a result, a properly set healthCheckNodePort should avoid situations in which our request is routed to improper nodes.</p>
<p>An example would be the image below, extracted from <a href="https://www.asykim.com/blog/deep-dive-into-kubernetes-external-traffic-policies" rel="nofollow noreferrer">https://www.asykim.com/blog/deep-dive-into-kubernetes-external-traffic-policies</a>. If I properly understood this concept, the healthCheckNodePort should let the LB know that all traffic should be directed to the left node, as the right one doesn't have a pod to handle it.</p>
<p><a href="https://i.stack.imgur.com/0HjGf.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/0HjGf.png" alt="enter image description here" /></a></p>
<p>My question here is: how does the proxy attached to healthCheckNodePort checks for the pod existence? Is this something I should implement from my side, or is Kubernetes auto-assigned port able to handle this health-check on its own? It seems weirdly convenient that any port number would do, so I would like some more insight on how this works.</p>

Pedro Martins de Souza
<p>It's actually very simple; I report a part of OpenShift documentation:</p>
<blockquote>
<p>healthCheckNodePort specifies the healthcheck nodePort for the service. This only applies when type is set to LoadBalancer and externalTrafficPolicy is set to Local. If a value is specified, is in-range, and is not in use, it will be used. If not specified, a value will be automatically allocated. <strong>External systems (e.g. load-balancers) can use this port to determine if a given node holds endpoints for this service or not. If this field is specified when creating a Service which does not need it, creation will fail. This field will be wiped when updating a Service to no longer need it (e.g. changing type).</strong></p>
</blockquote>
<p><a href="https://docs.openshift.com/container-platform/4.10/rest_api/network_apis/service-v1.html" rel="nofollow noreferrer">https://docs.openshift.com/container-platform/4.10/rest_api/network_apis/service-v1.html</a></p>
<p>From the point of view of the <strong>kube-proxy</strong>, this always responds to packets sent to the health check node port.</p>
<p>I suggest you take a look at this example:
<a href="https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-type-loadbalancer" rel="nofollow noreferrer">https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-type-loadbalancer</a></p>
