You might want to let your metrics system scrape a private endpoint published on a different port. Or you might have management task that you want to restrict

You might want to let your metrics system scrape a private endpoint published on a different port. Or you might have management task that you want to restrict to your internal network. Possible if you delegate to network hardware, but sometimes those asks are a PITA.