Separating internal and external services

Internal services are services that are accessed directly only by other services or jobs in the cluster (or administrators that log in and run ad-hoc tools). There are also workloads that are not accessed at all. These workloads may watch for some events and perform their function without exposing any API.

But some services need to be exposed to users or external programs. Let’s look at a fake Hue service that manages a list of reminders for a user. It doesn’t really do much - just returns a fixed list of reminders - but we’ll use it to illustrate how to expose services. I already pushed a hue-reminders image to DockerHub:

docker push g1g1/hue-reminders:3.0

Deploying an internal service

Here is the deployment, which is very similar to the Hue-learner deployment, except that I dropped the annotations, env, and resources sections, kept just one or two labels to save space, and added a ports section to the container. That...