<p dir="auto">(Kubernetes 1.2)</p>
<p dir="auto">Consider the following <code class="notranslate">secret</code> definition:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="{
    &quot;kind&quot;: &quot;Secret&quot;,
    &quot;apiVersion&quot;: &quot;v1&quot;,
    &quot;metadata&quot;: {
        &quot;name&quot;: &quot;rails&quot;
    },
    &quot;data&quot;: {
        &quot;db.conf&quot;: &quot;cmVkYWN0ZWQK&quot;,
        &quot;dbdotconf&quot;: &quot;cmVkYWN0ZWQK&quot;
    },
    &quot;type&quot;: &quot;Opaque&quot;
}"><pre class="notranslate"><code class="notranslate">{
    "kind": "Secret",
    "apiVersion": "v1",
    "metadata": {
        "name": "rails"
    },
    "data": {
        "db.conf": "cmVkYWN0ZWQK",
        "dbdotconf": "cmVkYWN0ZWQK"
    },
    "type": "Opaque"
}
</code></pre></div>
<p dir="auto"><code class="notranslate">kubectl get secrets rails -o "jsonpath={.data['db.conf']}"</code> returns:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="error: error executing jsonpath &quot;{.data['db.conf']}&quot;: db is not found"><pre class="notranslate"><code class="notranslate">error: error executing jsonpath "{.data['db.conf']}": db is not found
</code></pre></div>
<p dir="auto">while <code class="notranslate">kubectl get secrets rails -o "jsonpath={.data['dbdotconf']}"</code> works.</p>
<p dir="auto"><strong>What keywords did you search in Kubernetes issues before filing this one?</strong> (If you have found any duplicates, you should instead reply there.): 'remove load balancer'</p>
<hr>
<p dir="auto">BUG REPORT</p>
<p dir="auto"><strong>Kubernetes version</strong> (use <code class="notranslate">kubectl version</code>):</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="Client Version: version.Info{Major:&quot;1&quot;, Minor:&quot;3&quot;, GitVersion:&quot;v1.3.7&quot;, GitCommit:&quot;a2cba278cba1f6881bb0a7704d9cac6fca6ed435&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2016-09-12T23:15:30Z&quot;, GoVersion:&quot;go1.6.2&quot;, Compiler:&quot;gc&quot;, Platform:&quot;darwin/amd64&quot;}
Server Version: version.Info{Major:&quot;1&quot;, Minor:&quot;3&quot;, GitVersion:&quot;v1.3.7&quot;, GitCommit:&quot;a2cba278cba1f6881bb0a7704d9cac6fca6ed435&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2016-09-12T23:08:43Z&quot;, GoVersion:&quot;go1.6.2&quot;, Compiler:&quot;gc&quot;, Platform:&quot;linux/amd64&quot;}"><pre class="notranslate"><code class="notranslate">Client Version: version.Info{Major:"1", Minor:"3", GitVersion:"v1.3.7", GitCommit:"a2cba278cba1f6881bb0a7704d9cac6fca6ed435", GitTreeState:"clean", BuildDate:"2016-09-12T23:15:30Z", GoVersion:"go1.6.2", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"3", GitVersion:"v1.3.7", GitCommit:"a2cba278cba1f6881bb0a7704d9cac6fca6ed435", GitTreeState:"clean", BuildDate:"2016-09-12T23:08:43Z", GoVersion:"go1.6.2", Compiler:"gc", Platform:"linux/amd64"}
</code></pre></div>
<p dir="auto"><strong>Environment</strong>:</p>
<ul dir="auto">
<li><strong>Cloud provider or hardware configuration</strong>: Google Cloud (GKE)</li>
<li><strong>OS</strong> (e.g. from /etc/os-release):</li>
</ul>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="NAME=&quot;Alpine Linux&quot;
ID=alpine
VERSION_ID=3.4.0
PRETTY_NAME=&quot;Alpine Linux v3.4&quot;
HOME_URL=&quot;http://alpinelinux.org&quot;
BUG_REPORT_URL=&quot;http://bugs.alpinelinux.org&quot;"><pre class="notranslate"><code class="notranslate">NAME="Alpine Linux"
ID=alpine
VERSION_ID=3.4.0
PRETTY_NAME="Alpine Linux v3.4"
HOME_URL="http://alpinelinux.org"
BUG_REPORT_URL="http://bugs.alpinelinux.org"
</code></pre></div>
<ul dir="auto">
<li><strong>Kernel</strong> (e.g. <code class="notranslate">uname -a</code>):</li>
</ul>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="Linux ga-redis-cache 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt25-2 (2016-04-08) x86_64 Linux"><pre class="notranslate"><code class="notranslate">Linux ga-redis-cache 3.16.0-4-amd64 #1 SMP Debian 3.16.7-ckt25-2 (2016-04-08) x86_64 Linux
</code></pre></div>
<ul dir="auto">
<li><strong>Install tools</strong>: Google Cloud SDK</li>
<li><strong>Others</strong>:</li>
</ul>
<p dir="auto"><strong>What happened</strong>:</p>
<p dir="auto">I have a service that I configured with an external load balancer with specific firewall rules.</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="apiVersion: v1
kind: Service
metadata:
  name: ga-redis-cache
  labels:
    service: redis
    purpose: cache
spec:
  ports:
  - port: 6379
    protocol: TCP
  selector:
    service: redis
    purpose: cache
  type: LoadBalancer
  loadBalancerSourceRanges:
  # IP address changed for security; real IP address is routeable
  - 192.168.1.1/32"><pre class="notranslate"><code class="notranslate">apiVersion: v1
kind: Service
metadata:
  name: ga-redis-cache
  labels:
    service: redis
    purpose: cache
spec:
  ports:
  - port: 6379
    protocol: TCP
  selector:
    service: redis
    purpose: cache
  type: LoadBalancer
  loadBalancerSourceRanges:
  # IP address changed for security; real IP address is routeable
  - 192.168.1.1/32
</code></pre></div>
<p dir="auto">We were ready to remove the external access so I changed the configuration to remove the load balancer:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="apiVersion: v1
kind: Service
metadata:
  name: ga-redis-cache
  labels:
    service: redis
    purpose: cache
spec:
  ports:
  - port: 6379
    protocol: TCP
  selector:
    service: redis
    purpose: cache"><pre class="notranslate"><code class="notranslate">apiVersion: v1
kind: Service
metadata:
  name: ga-redis-cache
  labels:
    service: redis
    purpose: cache
spec:
  ports:
  - port: 6379
    protocol: TCP
  selector:
    service: redis
    purpose: cache
</code></pre></div>
<p dir="auto">And ran <code class="notranslate">kubectl apply -f</code> and got an error about an invalid port:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="proto: no encoder for TypeMeta unversioned.TypeMeta [GetProperties]
proto: tag has too few fields: &quot;-&quot;
proto: no coders for struct *reflect.rtype
proto: no encoder for sec int64 [GetProperties]
proto: no encoder for nsec int32 [GetProperties]
proto: no encoder for loc *time.Location [GetProperties]
proto: no encoder for Time time.Time [GetProperties]
proto: no coders for intstr.Type
proto: no encoder for Type intstr.Type [GetProperties]
The Service &quot;ga-redis-cache&quot; is invalid.
spec.ports[0].nodePort: Invalid value: 30179: may not be used when `type` is 'ClusterIP'"><pre class="notranslate"><code class="notranslate">proto: no encoder for TypeMeta unversioned.TypeMeta [GetProperties]
proto: tag has too few fields: "-"
proto: no coders for struct *reflect.rtype
proto: no encoder for sec int64 [GetProperties]
proto: no encoder for nsec int32 [GetProperties]
proto: no encoder for loc *time.Location [GetProperties]
proto: no encoder for Time time.Time [GetProperties]
proto: no coders for intstr.Type
proto: no encoder for Type intstr.Type [GetProperties]
The Service "ga-redis-cache" is invalid.
spec.ports[0].nodePort: Invalid value: 30179: may not be used when `type` is 'ClusterIP'
</code></pre></div>
<p dir="auto"><strong>What you expected to happen</strong>:<br>
I expected Kubernetes to remove the load balancer from the service and convert back to internal balancing for access from the cluster only.</p>
<p dir="auto"><strong>How to reproduce it</strong> (as minimally and precisely as possible):<br>
See configuration files above.</p>
<p dir="auto"><strong>Anything else do we need to know</strong>:<br>
I tried this with another service and got repeated result, just a different port:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="proto: no encoder for TypeMeta unversioned.TypeMeta [GetProperties]
proto: tag has too few fields: &quot;-&quot;
proto: no coders for struct *reflect.rtype
proto: no encoder for sec int64 [GetProperties]
proto: no encoder for nsec int32 [GetProperties]
proto: no encoder for loc *time.Location [GetProperties]
proto: no encoder for Time time.Time [GetProperties]
proto: no coders for intstr.Type
proto: no encoder for Type intstr.Type [GetProperties]
The Service &quot;keylime-redis-cache&quot; is invalid.
spec.ports[0].nodePort: Invalid value: 32537: may not be used when `type` is 'ClusterIP'"><pre class="notranslate"><code class="notranslate">proto: no encoder for TypeMeta unversioned.TypeMeta [GetProperties]
proto: tag has too few fields: "-"
proto: no coders for struct *reflect.rtype
proto: no encoder for sec int64 [GetProperties]
proto: no encoder for nsec int32 [GetProperties]
proto: no encoder for loc *time.Location [GetProperties]
proto: no encoder for Time time.Time [GetProperties]
proto: no coders for intstr.Type
proto: no encoder for Type intstr.Type [GetProperties]
The Service "keylime-redis-cache" is invalid.
spec.ports[0].nodePort: Invalid value: 32537: may not be used when `type` is 'ClusterIP'
</code></pre></div>