Why should a normal ClusterIP Service-backed civic app avoid hostNetwork and hostPID?
Select an answer to reveal the explanation.
Short Explanation
hostNetwork/hostPID mean sharing the node's hallway and process list—great for rare system agents, awful for a normal Service app. ClusterIP, probes, and in-cluster DNS work fine without those host shares.
Full Explanation
hostNetwork and hostPID place a Pod in the node's network or PID namespaces, reducing isolation and expanding attack surface. Ordinary applications exposed via Services should use the Pod network and container PID namespace. ClusterIP traffic, probes, and cluster DNS do not require host namespaces.