Does Kubernetes Ingress use NodePort?
For your first question:


  When using a Kubernetes LoadBalancer or Ingress, is the normal
  NodePort used as the underlying connection point?


Technically it depends on the cloud network for LoadBalancers (e.g. Google Compute Engine does not technically require this although one may be created).  However, I believe a NodePort and ClusterIP are generally created.

For your question on the usage of NodePorts:

The short answer is yes, they are safe to use if you know what you are doing.

The longer answer is that NodePorts are great for debugging and development but have some issues in production:


You can only have one service on a port.
HTTP/HTTPS traffic may be routed through a non-standard port.
The port will be opened on all nodes.


However, NodePorts do provide some nice flexibility (from Kubernetes documentation):


  Using a NodePort gives you the freedom to set up your own load balancing solution, to configure environments that are not fully supported by Kubernetes, or even to just expose one or more nodes’ IPs directly.