title: Why is Azure Load Balancer created by AKS set up to direct traffic to port 80 and 443 on nodes rather than nodeports opened by a service?
body: <p>I have an AKS cluster with an nginx ingress controller. Controller has created a service with a type LoadBalancer and Ports section looks like this (from <code>kubectl get service</code>):</p>
  
  <blockquote>
    <p>80:31141/TCP</p>
  </blockquote>
  
  <p>If I understand things correctly port 80 is a ClusterIp port that is not reachable from the outside but port 31141 is a port that is a NodePort and is reachable from outside. So I would assume that an Azure Load Balancer is sending traffic to this 31141 port.</p>
  
  <p>I was surprised to find that Azure Load Balancer is set up with a rule:</p>
  
  <pre><code>frontendPort: 80
  backendPort: 80
  probe (healthCheck): 31141
  </code></pre>
  
  <p>So it actually does use the nodeport but only as a healthcheck and all traffic is sent to port 80 which presumably functions the same way as 31141.</p>
  
  <p>A curious note is that if I try to reach the node IP at port 80 from a pod I only get "connection refused", but I suppose it does work if traffic comes from a load balancer.</p>
  
  <p>I was not able to find any information about this on internet, so the question is how this really works and why is ALB doing it this way?</p>
  
  <p>P.S. I don't have troubles with connectivity, it works. I am just trying to understand how and why it does behind the scenes.</p>