A library kiosk NodePort Service must preserve the client source IP for audit logs and avoid an extra SNAT hop on nodes that have local endpoints. Which Service field setting supports that goal?
Select an answer to reveal the explanation.
Short Explanation
Want the original visitor IP on the kiosk logs? externalTrafficPolicy: Local keeps external traffic on nodes that actually run the Pod and skips the extra hop that rewrites the source. Session affinity and headless Services solve different problems.
Full Explanation
A library kiosk NodePort Service that must preserve the client source IP for audit logs and avoid an extra SNAT hop on nodes that have local endpoints should set externalTrafficPolicy: Local. With Local, externally arriving traffic stays on nodes that have local endpoints and the client source IP is preserved, which matters when municipal audit trails key off the true client address rather than a masqueraded node address.
sessionAffinity: None only controls sticky sessions and does not preserve source IP for external traffic. publishNotReadyAddresses: true publishes NotReady Pods into Endpoints but does not change external SNAT behavior. clusterIP: None creates a headless Service and removes the ClusterIP load-balancer path; it is not the externalTrafficPolicy knob for source IP preservation on NodePort or LoadBalancer Services.
Exam caveat: Local can drop packets that arrive on nodes without local ready endpoints—understand that availability tradeoff versus the default Cluster policy, which may SNAT and hide client IPs. Operational check: set externalTrafficPolicy: Local on the NodePort Service, send a request from a known client IP, and verify application audit logs record that IP; kubectl describe svc should show External Traffic Policy: Local. Capture the audit requirement in the library kiosk security design notes for future reviewers.