code: func (proxier *Proxier) claimNodePort(ip net.IP, port int, protocol v1.Protocol, owner proxy.ServicePortName) error {
  	proxier.portMapMutex.Lock()
  	defer proxier.portMapMutex.Unlock()
  
  	// TODO: We could pre-populate some reserved ports into portMap and/or blacklist some well-known ports
  
  	key := portMapKey{ip: ip.String(), port: port, protocol: protocol}
  	existing, found := proxier.portMap[key]
  	if !found {
  		// Hold the actual port open, even though we use iptables to redirect
  		// it.  This ensures that a) it's safe to take and b) that stays true.
  		// NOTE: We should not need to have a real listen()ing socket - bind()
  		// should be enough, but I can't figure out a way to e2e test without
  		// it.  Tools like 'ss' and 'netstat' do not show sockets that are
  		// bind()ed but not listen()ed, and at least the default debian netcat
  		// has no way to avoid about 10 seconds of retries.
  		socket, err := proxier.makeProxySocket(protocol, ip, port)
  		if err != nil {
  			return fmt.Errorf("can't open node port for %s: %v", key.String(), err)
  		}
  		proxier.portMap[key] = &portMapValue{owner: owner, socket: socket}
  		klog.V(2).Infof("Claimed local port %s", key.String())
  		return nil
  	}
  	if existing.owner == owner {
  		// We are idempotent
  		return nil
  	}
  	return fmt.Errorf("Port conflict detected on port %s.  %v vs %v", key.String(), owner, existing)
  }
docs: // Marks a port as being owned by a particular service, or returns error if already claimed.
  // Idempotent: reclaiming with the same owner is not an error