Add info about exposing Services to tutorial
This adds an example for how to use a LoadBalancer Service for
connecting to a Postgres cluster externally.
Issue: CrunchyData/postgres-operator-examples#21
@@ -40,6 +40,42 @@ When your Postgres cluster is initialized, PGO will bootstrap a database and Pos
All connections are over TLS. PGO provides its own certificate authority (CA) to allow you to securely connect your applications to your Postgres clusters. This allows you to use the [`verify-full` "SSL mode"](https://www.postgresql.org/docs/current/libpq-ssl.html#LIBPQ-SSL-SSLMODE-STATEMENTS) of Postgres, which provides eavesdropping protection and prevents MITM attacks. You can also choose to bring your own CA, which is described later in this tutorial in the [Customize Cluster]({{< relref "./customize-cluster.md" >}}) section.
+### Modifying Service Type
+
+By default, PGO deploys Services with the `ClusterIP` Service type. Based on how you want to expose your database, you may want to modify the Services to use a different [Service type](https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types).
+
+You can modify the Services that PGO manages from the following attributes:
+
+- `spec.service` - this manages the Service for connecting to a Postgres primary.
+- `spec.proxy.pgBouncer.service` - this manages the Service for connecting to the PgBouncer connection pooler.
+
+For example, to set the Postgres primary to use a `NodePort` service, you would add the following to your manifest:
+
+```yaml
+spec:
+ service:
+ type: NodePort
+```
+
+For our `hippo` cluster, you would see the Service type modification in the . For example:
+
+```
+kubectl -n postgres-operator get svc --selector=postgres-operator.crunchydata.com/cluster=hippo
+```
+
+will yield something similar to:
+
+```
+NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
+hippo-ha NodePort 10.96.17.210 <none> 5432:32751/TCP 2m37s
+hippo-ha-config ClusterIP None <none> <none> 2m37s
+hippo-pods ClusterIP None <none> <none> 2m37s
+hippo-primary ClusterIP None <none> 5432/TCP 2m37s
+hippo-replicas ClusterIP 10.96.151.53 <none> 5432/TCP 2m37s
+```
+
+(Note that if you are exposing your Services externally and are relying on TLS verification, you will need to use the [custom TLS]({{< relref "tutorial/customize-cluster.md" >}}#customize-tls) features of PGO).
+
## Connect an Application
For this tutorial, we are going to connect [Keycloak](https://www.keycloak.org/), an open source
