Municipal external users need HTTPS host-based routing to several in-cluster apps. Operators prefer not to expose NodePorts on every worker. Which exposure model is most appropriate?

Municipal external users who need HTTPS host-based routing to several in-cluster apps—while operators prefer not to expose NodePorts on every worker—should keep Services as ClusterIP and front them with an Ingress or Gateway API controller for external HTTP routing. That model provides one front door with host and path routing to many civic apps without punching NodePorts across the worker fleet.

Using only NodePort Services for each app and requiring clients to pick random worker IPs forever is operationally painful and not the preferred host-based model. Replacing all Services with HostNetwork Pods and disabling kube-proxy cluster-wide is a dangerous anti-pattern. Relying on headless Services alone does not obtain cloud public IPs for each Pod.

Exam caveat: Ingress versus Gateway API differs in resources, but both sit in front of ClusterIP Services for L7 routing. Operational check: deploy ClusterIP Services per app, configure Ingress or HTTPRoute host rules, and verify external HTTPS without NodePort sprawl. This distinction matters on the CKA because distractors often mix adjacent objects that sound related but solve a different control-plane problem. This distinction matters on the CKA because distractors often mix adjacent objects that sound related but solve a different control-plane problem.