I am trying to set up TLS for a MessageSight service that has been installed on IBM Cloud Private(ICP)

ICP and MessageSight have already been installed and I was trying to see how the MessageSight has been exposed as a service (Is that a NodePort, LoadBalancer or Externalname)

$kubectl get services 
NAME                              TYPE        CLUSTER-IP     EXTERNAL-IP     PORT(S)                       AGE
messagesight-messagesight-svc     ClusterIP   10.0.241.72    168.xx.xx.xxx   9089/TCP,1883/TCP,16102/TCP   9d
messagesight-messagesightui-svc   ClusterIP   10.0.139.199   168.xx.xx.xxx   9087/TCP                      9d

The type states it is a ClusterIP however it has an external IP. I always thought an external IP is going to empty if the service type is ClusterIP. If it were a LoadBalancer i would expect to see the external IP.

Describing the service does not provide any additional information

kubectl describe svc messagesight-messagesight-svc 
Name:              messagesight-messagesight-svc
Labels:            app=messagesight
                   chart=messagesight
                   heritage=Tiller
                   release=messagesight
Annotations:       <none>
Selector:          app=messagesight,release=messagesight
Type:              ClusterIP
IP:                10.0.241.72
External IPs:      168.xx.xx.xxx
Port:              adminport  9089/TCP
TargetPort:        9089/TCP
Endpoints:         10.1.66.1:9089
Port:              messaging-1883  1883/TCP
TargetPort:        1883/TCP
Endpoints:         10.1.66.1:1883
Port:              messaging-16102  16102/TCP
TargetPort:        16102/TCP
Endpoints:         10.1.66.1:16102
Session Affinity:  None
Events:            <none>

I am able to access the service via the external-IP and ports and am puzzled as to how it is working.

I installed a Jenkins setup to make observations and the output looks good and makes sense to me

$kubectl get services 
NAME                       TYPE       CLUSTER-IP     EXTERNAL-IP   PORT(S)                          AGE
jenkins-ibm-jenki   NodePort   10.0.241.156   <none>        8080:31058/TCP,50000:31155/TCP   1d

I can see the type is NodePort and it doesn't have a corresponding externalIP.

The description of the service also give me clear insights that this service is of type NodePort

$kubectl describe svc jenkins-ibm-jenki 
Name:                     jenkins-ibm-jenki
Labels:                   app=jenkins-ibm-jenki
                          chart=ibm-jenkins-dev-1.0.2
                          component=jenkins-jenkins-master
                          heritage=Tiller
                          release=jenkins
Annotations:              helm.sh/created=1559696400
Selector:                 app=jenkins-ibm-jenki,component=jenkins-jenkins-master
Type:                     NodePort
IP:                       10.0.241.156
Port:                     http  8080/TCP
TargetPort:               8080/TCP
NodePort:                 http  31058/TCP
Endpoints:                10.1.66.89:8080
Port:                     slavelistener  50000/TCP
TargetPort:               50000/TCP
NodePort:                 slavelistener  31155/TCP
Endpoints:                10.1.66.89:50000
Session Affinity:         None
External Traffic Policy:  Cluster
Events:                   <none>