diff --git a/doc/tutorial/kubernetes/README.md b/doc/tutorial/kubernetes/README.md
index 8eee896..b59e4c5 100644
--- a/doc/tutorial/kubernetes/README.md
+++ b/doc/tutorial/kubernetes/README.md
@@ -259,8 +259,8 @@
         // Any port has the following properties.
         ports: [...{
             port:       int
-            protocol:   "TCP" | "UDP"      // from the Kubernetes definition
-            name:       "client" | string
+            protocol:   *"TCP" | "UDP"      // from the Kubernetes definition
+            name:       string | *"client"
         }]
         selector: metadata.labels // we want those to be the same
     }
@@ -427,7 +427,7 @@
     apiVersion: "extensions/v1beta1"
     kind:       "Deployment"
     _name:      Name
-    spec replicas: 1 | int
+    spec replicas: *1 | int
 }
 
 configMap <Name>: {
@@ -473,7 +473,7 @@
 // for all ports defined in all containers.
 _spec spec template spec containers: [...{
     ports: [...{
-        _export: true | false // include the port in the service
+        _export: *true | false // include the port in the service
     }]
 }]
 
@@ -482,8 +482,8 @@
 
     spec ports: [ {
         Port = p.containerPort // Port is an alias
-        port:       Port | int
-        targetPort: Port | int
+        port:       *Port | int
+        targetPort: *Port | int
     } for c in v.spec.template.spec.containers
         for p in c.ports
         if p._export ]
@@ -615,7 +615,7 @@
         "prometheus.io.port":   "\(spec.containers[0].ports[0].containerPort)"
     }
     spec containers: [{
-        ports: [{containerPort: 7080 | int}] // 7080 is the default
+        ports: [{containerPort: *7080 | int}] // 7080 is the default
     }]
 }
 EOF
@@ -690,24 +690,24 @@
 $ cat <<EOF >> kitchen/kube.cue
 
 deployment <Name> spec template spec: {
-    _hasDisks: true | bool
+    _hasDisks: *true | bool
 
     volumes: [{
-        name: "\(Name)-disk" | string
-        gcePersistentDisk pdName: "\(Name)-disk" | string
+        name: *"\(Name)-disk" | string
+        gcePersistentDisk pdName: *"\(Name)-disk" | string
         gcePersistentDisk fsType: "ext4"
     }, {
-        name: "secret-\(Name)" | string
-        secret secretName: "\(Name)-secrets" | string
+        name: *"secret-\(Name)" | string
+        secret secretName: *"\(Name)-secrets" | string
     }, ...] if _hasDisks
 
     containers: [{
         volumeMounts: [{
-            name:      "\(Name)-disk" | string
-            mountPath: "/logs" | string
+            name:      *"\(Name)-disk" | string
+            mountPath: *"/logs" | string
         }, {
-            mountPath: "/etc/certs" | string
-            name:      "secret-\(Name)" | string
+            mountPath: *"/etc/certs" | string
+            name:      *"secret-\(Name)" | string
             readOnly:  true
         }, ...]
     }] if _hasDisks // field comprehension using just "if"
diff --git a/doc/tutorial/kubernetes/manual/services/cloud.cue b/doc/tutorial/kubernetes/manual/services/cloud.cue
index 4ba6142..747fab5 100644
--- a/doc/tutorial/kubernetes/manual/services/cloud.cue
+++ b/doc/tutorial/kubernetes/manual/services/cloud.cue
@@ -14,7 +14,7 @@
 deployment <Name>: _base & {
 	// Allow any string, but take Name by default.
 	name:     string | *Name
-	kind:     "deployment" | "stateful" | "daemon"
+	kind:     *"deployment" | "stateful" | "daemon"
 	replicas: int | *1
 
 	image: string
@@ -44,14 +44,13 @@
 }
 
 service <Name>: _base & {
-	name: Name | string
+	name: *Name | string
 
 	port <Name>: {
 		name: string | *Name
 
-		port:       int
-		targetPort: int | *port
-		protocol:   *"TCP" | "UDP"
+		port:     int
+		protocol: *"TCP" | "UDP"
 	}
 
 	kubernetes: {}
@@ -65,11 +64,10 @@
 
 	// Copy over all ports exposed from containers.
 	port "\(Name)": {
-		// Set default external port to Port.
+		// Set default external port to Port. targetPort must be
+		// the respective containerPort (Port) if it differs from port.
 		port:       int | *Port
-		targetPort: int | *Port
-		// TODO(verify): jba: I don't think you need targetPort, because it's defined above in terms of port.
-		// Should probably be Port fixed.
+		targetPort: Port if port != Port
 	} for Name, Port in spec.expose.port
 
 	// Copy over the labels
diff --git a/doc/tutorial/kubernetes/quick/services/kitchen/kube.cue b/doc/tutorial/kubernetes/quick/services/kitchen/kube.cue
index c4639d8..602a713 100644
--- a/doc/tutorial/kubernetes/quick/services/kitchen/kube.cue
+++ b/doc/tutorial/kubernetes/quick/services/kitchen/kube.cue
@@ -20,7 +20,7 @@
 }
 
 deployment <Name> spec template spec: {
-	_hasDisks: true | bool
+	_hasDisks: *true | bool
 
 	volumes: [{
 		name: *"\(Name)-disk" | string
diff --git a/doc/tutorial/kubernetes/quick/services/kube.cue b/doc/tutorial/kubernetes/quick/services/kube.cue
index 09688f5..d6b4672 100644
--- a/doc/tutorial/kubernetes/quick/services/kube.cue
+++ b/doc/tutorial/kubernetes/quick/services/kube.cue
@@ -6,17 +6,17 @@
 	metadata: {
 		name: Name
 		labels: {
-			app:       Name       // by convention
-			domain:    "prod"     // always the same in the given files
-			component: _component // varies per directory
+			app:       Name
+			component: _component
+			domain:    "prod"
 		}
 	}
 	spec: {
 		// Any port has the following properties.
 		ports: [...{
 			port:     int
-			protocol: *"TCP" | "UDP" // from the Kubernetes definition
-			name:     *"client" | string
+			protocol: *"TCP" | "UDP"
+			name:     string | *"client"
 		}]
 		selector: metadata.labels // we want those to be the same
 	}
@@ -40,7 +40,7 @@
 	apiVersion: "extensions/v1beta1"
 	kind:       "Deployment"
 	_name:      Name
-	spec replicas: 1 | int
+	spec replicas: *1 | int
 }
 
 configMap <Name>: {