Advertised enode information is seen differently by peers

[IvanWeber42]

I'm running geth nodes on Azure cloud, with each node being a k8s pod. The Azure cluster nodes have external IPs which are then attached to our node, and we create NodePorts to expose the discovery port. I set the following arguments:

• '--nat=extip:$(EXTERNAL_IP)'
• '--discovery.port=$(GETH_P2P_PORT)

After startup I can see that enode of my node is as follows:
enode://b9712ce7041f82a2dd592aecd05ea920547b987051667b51401599eacbd267ad931f9474b5ef6f436858b67d3be2e1e618e80871625ccd35d0df029b5152410e@XXX.XXX.XXX.XXX:30303?discport=30509

I can then test with nc and verify that my node is reachable from the outside. However when my node starts peering, other node will record its information as:
enode://b9712ce7041f82a2dd592aecd05ea920547b987051667b51401599eacbd267ad931f9474b5ef6f436858b67d3be2e1e618e80871625ccd35d0df029b5152410e@YYY.YYY.YYY.YYY:45579

This essentially makes the node undiscoverable, since other nodes will see a meaningless IP:Port combination instead of the one set by the startup parameters.

Why is this happening? Shouldn't the node advertise the enode information set during the geth startup?

[MqllR]

Is the enode address enode://b9712ce7041f82a2dd592aecd05ea920547b987051667b51401599eacbd267ad931f9474b5ef6f436858b67d3be2e1e618e80871625ccd35d0df029b5152410e@YYY.YYY.YYY.YYY:45579 seen from the remote node an inbound or outbound ? If inbound, 45579 is the dynamically opened TCP port.
BTW, you might certainly want to expose the RLPx layer (--port=$(GETH_P2P_PORT))

[IvanWeber42]

Hi,

I did manage to get the inbound connections to work recently by changing the implementation to use publicly reachable LoadBalancers instead of NodePorts.

Is the enode address enode://b9712ce7041f82a2dd592aecd05ea920547b987051667b51401599eacbd267ad931f9474b5ef6f436858b67d3be2e1e618e80871625ccd35d0df029b5152410e@YYY.YYY.YYY.YYY:45579 seen from the remote node an inbound or outbound ? If inbound, 45579 is the dynamically opened TCP port.
BTW, you might certainly want to expose the RLPx layer (--port=$(GETH_P2P_PORT))

It was inbound yes, our own node failed to get any inbound peers itself. The port was also set to the default value of 30303.