Chapter 21 — worked answers

1. Two different listeners

AdvertiseAddress identifies the node/agent communication surface, not a workload listener. addressHost extracts its hostname; endpointURL combines that host with PublicHostPort. Using the agent port would send application requests to the wrong listener even when the node is healthy.

2. TLS scope is explicit

route.TLS adds router.TLS, while endpointURL always constructs an HTTP backend URL. Certificate provisioning and gateway-to-worker encryption are separate deployment responsibilities. The source supports client-facing TLS intent without proving either certificate issuance or internal encryption.

3. Observe each hop

Save the provider JSON and exact backend. Request the application's local published port from its worker, then from the gateway's network context, then request the gateway with the configured Host/path. Compare agent probe origin and gateway origin. A firewall or topology failure can preserve local health while blocking the gateway, so neither observation invalidates the other.

4. Extension acceptance needs ownership

For IPAM, crash after allocation but before task acknowledgement, restart with durable task identity, and verify address ownership is recovered without duplicate allocation or orphan leakage. A CNI variant similarly repeats ADD/DEL after response loss with pinned plugins and bounded execution. These are proposed extension tests, not mechanisms currently supplied by orch.

Return to Chapter 21.