title: how to connect a kubernetes pod to the outside world without a forwarding rule (google container engine)
body: <p>I'm using Google's Container Engine service, and got a pod running a server listening on port 3000. I set up the service to connect port 80 to that pod's port 3000. I am able to curl the service using its local and public ip from within the node, but not from outside. I set up a firewall rule to allow port 80 and send it to the node, but I keep getting 'connection refused' from outside the network. I'm trying to do this without a forwarding rule, since there's only one pod and it looked like forwarding rules cost money and do load balancing. I think the firewall rule works, because when I add the <code>createExternalLoadBalancer: true</code> to the service's spec, the external IP created by the forwarding rule works as expected. Do I need to do something else? Set up a route or something?</p>
  
  <p>controller.yaml</p>
  
  <pre><code>kind: ReplicationController
  apiVersion: v1beta3
  metadata:
      name: app-frontend
      labels:
          name: app-frontend
          app: app
          role: frontend
  spec:
      replicas: 1
      selector:
          name: app-frontend
      template:
          metadata:
              labels:
                  name: app-frontend
                  app: app
                  role: frontend
          spec:
              containers:
                  - name: node-frontend
                    image: gcr.io/project_id/app-frontend
                    ports:
                      - name: app-frontend-port
                        containerPort: 3000
                        targetPort: 3000
                        protocol: TCP
  </code></pre>
  
  <p>service.yaml</p>
  
  <pre><code>kind: Service
  apiVersion: v1beta3
  metadata:
    name: app-frontend-service
    labels:
      name: app-frontend-service
      app: app
      role: frontend
  spec:
    ports:
      - port: 80
        targetPort: app-frontend-port
        protocol: TCP
    publicIPs:
     - 123.45.67.89
    selector:
      name: app-frontend
  </code></pre>
  
  <hr>
  
  <p><strong>Edit (additional details):</strong>
  Creating this service adds these additional rules, found when I run <code>iptables -L -t nat</code></p>
  
  <pre><code>Chain KUBE-PORTALS-CONTAINER (1 references)
  target     prot opt source               destination         
  REDIRECT   tcp  --  anywhere             10.247.247.206       /* default/app-frontend-service: */ tcp dpt:http redir ports 56859
  REDIRECT   tcp  --  anywhere             89.67.45.123.bc.googleusercontent.com  /* default/app-frontend-service: */ tcp dpt:http redir ports 56859
  Chain KUBE-PORTALS-HOST (1 references)
  target     prot opt source               destination         
  DNAT       tcp  --  anywhere             10.247.247.206       /* default/app-frontend-service: */ tcp dpt:http to:10.241.69.28:56859
  DNAT       tcp  --  anywhere             89.67.45.123.bc.googleusercontent.com  /* default/app-frontend-service: */ tcp dpt:http to:10.241.69.28:56859
  </code></pre>
  
  <p>I don't fully understand iptables, so I'm not sure how the destination port matches my service. I found that the DNS for <code>89.67.45.123.bc.googleusercontent.com</code> resolves to <code>123.45.67.89</code>.</p>
  
  <p>kubectl get services shows the IP address and port I specified:</p>
  
  <pre><code>NAME                             IP(S)               PORT(S)
  app-frontend-service             10.247.243.151      80/TCP
                                   123.45.67.89
  </code></pre>
  
  <p>Nothing recent from external IPs is showing up in  /var/log/kube-proxy.log </p>