A team runs a Redis cache Pod that only other Pods inside the same cluster need to reach. They want a stable virtual IP and DNS name for the cache, but the cache must never be reachable from outside the cluster. Which Service type meets this requirement with the least exposure?
- AA ClusterIP Service, which allocates an internal virtual IP and cluster DNS name reachable only from within the cluster. Correct
- BA NodePort Service, which reserves a port on every node so internal Pods can connect through any node address reliably.
- CA LoadBalancer Service, which provisions an external cloud load balancer to front the cache with a stable public address.
- DAn ExternalName Service, which maps the cache name to an external DNS record through a returned CNAME entry.
Why A is correct: ClusterIP provides a stable internal virtual IP and DNS record while remaining unreachable from outside the cluster, which exactly matches an internal-only cache.
Why B is wrong: NodePort is tempting because it also gives a stable target, but it opens a port on every node's external IP, exposing the cache beyond the cluster, which the requirement forbids.
Why C is wrong: LoadBalancer looks safe because it also yields a stable address, but it provisions an externally reachable cloud load balancer, violating the internal-only constraint.
Why D is wrong: ExternalName seems relevant because it involves DNS, but it aliases to an external hostname rather than fronting an in-cluster Pod, so it does not expose the local cache at all.