<p>I'm running a Kubernetes cluster in a public cloud (Azure/AWS/Google Cloud), and I have some non-HTTP services I'd like to expose for users.</p>

<p>For HTTP services, I'd typically use an Ingress resource to expose that service publicly through an addressable DNS entry.</p>

<p>For non-HTTP, TCP-based services (e.g, a database such as PostgreSQL) how should I expose these for public consumption?</p>

<p>I considered using <code>NodePort</code> services, but this requires the nodes themselves to be publicly accessible (relying on <code>kube-proxy</code> to route to the appropriate node). I'd prefer to avoid this if possible.</p>

<p><code>LoadBalancer</code> services seem like another option, though I don't want to create a dedicated cloud load balancer for <em>each</em> TCP service I want to expose.</p>

<p>I'm aware that the <a href="https://kubernetes.github.io/ingress-nginx/user-guide/exposing-tcp-udp-services/" rel="noreferrer">NGINX Ingress controller supports exposing TCP and UDP services</a>, but that seems to require a static definition of the services you'd like to expose. For my use case, these services are being dynamically created and destroyed, so it's not possible to define these service mappings upfront in a static <code>ConfigMap</code>.</p>

cjheppell
<p>A couple of years late to reply, but here is what I did for a similar case.</p>
<p>If you don't want to use <code>LoadBalancer</code> at all, then the other option is <code>NodePort</code> as you mention. To make it externally addressable, you can have the pod associate a static IP to its node when it comes up. For example in AWS EC2 you can have an elastic IP (or static external IP in GCP) and associate it when the postgresql pod comes up in its <code>PodSpec</code> using initContainers or a separate container:</p>
<pre><code>  initContainers:
  - name: eip
    image: docker.io/amazon/aws-cli:2.7.1
    command:
    - /bin/bash
    - -xec
    - |
      INSTANCE_ID=&quot;$(curl http://169.254.169.254/latest/meta-data/instance-id)&quot;
      aws ec2 associate-address --allocation-id &quot;$EIP_ALLOCATION_ID&quot; --instance-id &quot;$INSTANCE_ID&quot;
    env:
    - name: EIP_ALLOCATION_ID
      value: &lt;your elastic IP allocation ID&gt;
    - name: AWS_REGION
      value: &lt;region&gt;
    - name: AWS_ACCESS_KEY_ID
      valueFrom:
        secretKeyRef:
          name: aws-secret
          key: accessKey
    - name: AWS_SECRET_ACCESS_KEY
      valueFrom:
        secretKeyRef:
          name: aws-secret
          key: secretKey
</code></pre>
<p>Here AWS access key and secret key are assumed to be installed in <code>aws-secret</code>. Above example uses environment variables but to be more secure you can instead mount on a volume and read in the script body and unset after use.</p>
<p>To alleviate the security concerns related to ports, one option can be to add only a node or two to the security group exposing the port, and use nodeSelector for the pod to stick it to only those nodes. Alternatively you can use &quot;aws ec2 modify-instance-attribute&quot; in the container body above to add the security group to just the node running the pod. Below is a more complete example for AWS EC2 that handles a node having multiple network interfaces:</p>
<pre><code>  containers:
  - name: eip-sg
    image: docker.io/amazon/aws-cli:2.7.1
    command:
    - /bin/bash
    - -xec
    - |
      INSTANCE_ID=$(curl http://169.254.169.254/latest/meta-data/instance-id)
      PRIVATE_IP=&quot;$(curl http://169.254.169.254/latest/meta-data/local-ipv4)&quot;
      for iface in $(curl http://169.254.169.254/latest/meta-data/network/interfaces/macs/); do
        if curl &quot;http://169.254.169.254/latest/meta-data/network/interfaces/macs/$iface/local-ipv4s&quot; | grep -q &quot;$PRIVATE_IP&quot;; then
          INTERFACE_FOR_IP=&quot;$(curl http://169.254.169.254/latest/meta-data/network/interfaces/macs/$iface/interface-id)&quot;
        fi
      done
      if [ -z &quot;$INTERFACE_FOR_IP&quot; ]; then
        aws ec2 associate-address --allocation-id &quot;$EIP_ALLOCATION_ID&quot; --instance-id &quot;$INSTANCE_ID&quot;
      else
        aws ec2 associate-address --allocation-id &quot;$EIP_ALLOCATION_ID&quot; --network-interface-id &quot;$INTERFACE_FOR_IP&quot; --private-ip-address &quot;$PRIVATE_IP&quot;
      fi
      aws ec2 modify-instance-attribute --instance-id &quot;$INSTANCE_ID&quot; --groups $FULL_SECURITY_GROUPS
      tail -f -s 10 /dev/null
    lifecycle:
      preStop:
        exec:
          command:
          - /bin/bash
          - -ec
          - |
            INSTANCE_ID=$(curl http://169.254.169.254/latest/meta-data/instance-id)
            aws ec2 modify-instance-attribute --instance-id &quot;$INSTANCE_ID&quot; --groups $DEFAULT_SECURITY_GROUPS
    env:
    - name: EIP_ALLOCATION_ID
      value: &lt;your elastic IP allocation ID&gt;
    - name: DEFAULT_SECURITY_GROUPS
      value: &quot;&lt;sg1&gt; &lt;sg2&gt;&quot;
    - name: FULL_SECURITY_GROUPS
      value: &quot;&lt;sg1&gt; &lt;sg2&gt; &lt;sg3&gt;&quot;
    - name: AWS_REGION
      value: &lt;region&gt;
    - name: AWS_ACCESS_KEY_ID
      valueFrom:
        secretKeyRef:
          name: aws-secret
          key: accessKey
    - name: AWS_SECRET_ACCESS_KEY
      valueFrom:
        secretKeyRef:
          name: aws-secret
          key: secretKey
</code></pre>
<p>You may also need to set the deployment <code>strategy</code> to be <code>Recreate</code> instead of the default of <code>RollingUpdate</code> otherwise the <code>lifecycle.preStop</code> may get invoked after the container <code>command</code> in case the deployment is restarted using <code>kubectl rollout restart deployment ...</code>.</p>
