A 911 workload sets hostNetwork: true and unexpectedly conflicts with ports already used on the node. What side effect should operators remember?
Select an answer to reveal the explanation.
Short Explanation
hostNetwork means the Pod borrows the node’s network jacket—including the pockets already holding port keys. Expect collisions and different networking rules of the road.
Full Explanation
hostNetwork: true places Pod network namespaces on the host network namespace, so container ports can collide with host processes and change Service/CNI assumptions. 911 workloads using hostNetwork should remember they borrow the node's network jacket—including pockets already holding port keys. hostNetwork does not disable all RBAC checks for that Pod's ServiceAccount; authorization remains. hostNetwork does not force every Service in the namespace to become ExternalName. hostNetwork does not store Pod logs inside etcd instead of the node filesystem. Exam caveat: hostNetwork pods may bypass some NetworkPolicy behaviors depending on CNI. Use sparingly for system components, not routine apps. Operational check: Inventory host ports with ss before deploying, avoid conflicting listen ports, document why 911 needs hostNetwork, and prefer ordinary Pod networking when possible. In municipal production practice, record the finding in the incident ticket with command output snippets, confirm the fix under change control, and re-validate the user-facing civic service before closing the change window. In municipal production practice, record the finding in the incident ticket with command output snippets, confirm the fix under change control, and re-validate the user-facing civic service before closing the change window.