A telemetry agent exposes a proprietary TCP protocol on port 7000 and must be reachable from outside the cluster. Why is a standard Ingress rule a poor primary choice?
Select an answer to reveal the explanation.
Short Explanation
Ingress is an HTTP concierge, not a generic TCP tunnel. For a weird binary protocol on 7000, look at NodePort, LoadBalancer, or other TCP options instead of forcing Ingress rules.
Full Explanation
A telemetry agent that exposes a proprietary TCP protocol on port 7000 and must be reachable from outside the cluster is a poor fit for a standard Ingress rule as the primary choice because Ingress is designed for HTTP/HTTPS routing (hosts, paths, TLS Secrets for HTTPS websites). Non-HTTP TCP applications usually need an appropriate Service type such as NodePort or LoadBalancer, or another TCP exposure mechanism documented by the platform (TCP passthrough features, Gateway API TCP routes where available)—not HTTP path rules.
Ingress does not require hostPort 7000 on every node before TCP works. Ingress is not limited to targeting only headless Services. Ingress also does not automatically convert all TCP into HTTP/2 so that any TCP application works unchanged through HTTP Ingress rules.
Exam caveat: recognize HTTP-versus-TCP exposure questions and do not force proprietary TCP into path-based Ingress. Operational check: expose the telemetry agent with LoadBalancer or NodePort (or a documented TCP mode), verify TCP clients connect on 7000, and reserve Ingress for HTTP municipal UIs and APIs. Update the city telemetry architecture diagram to show Service-based TCP exposure rather than Ingress hostnames.