Exercise 1: Which Course 1 Capstone Limitation Each Addition Resolves — Possible Solution
====================================================================

k8s1-12's own closing section named its simplifications honestly. Three
of those are resolved directly by this chapter:

(a) THE STATEFULSET resolves the database's simplified Deployment+PVC
    setup. Per k8s1-12's own warn-box, a plain Deployment managing a
    database pod gives no stable identity and no guaranteed one-to-one
    relationship between a pod and its storage across restarts/scaling
    -- a new pod could, in principle, attach to the wrong volume. The
    StatefulSet from k8s2-1 fixes this with volumeClaimTemplates (one
    dedicated PVC per pod, tied to that pod's stable ordinal identity)
    and a headless Service, giving the database exactly the guarantees
    a Deployment never could.

(b) THE NETWORKPOLICY resolves a gap that was never even flagged as a
    known limitation in k8s1-12 -- the database was reachable from any
    pod in the cluster with network access to its Service, not just
    the backend. Chapter 5's NetworkPolicy, applied here, restricts
    ingress to the database to only pods matching the backend's label
    selector, closing a real security exposure that existed silently
    throughout the entire Course 1 capstone.

(c) THE HPA resolves the capstone's fixed replica count for the
    backend. k8s1-12's Deployment specified a static number of
    replicas regardless of actual load -- meaning it was either
    over-provisioned (wasting cost) or under-provisioned (dropping
    requests) any time real traffic diverged from that fixed guess.
    Chapter 6's HPA replaces the static number with a target
    utilization percentage and a capped replica range, so the backend
    scales toward actual demand instead of a guess made at
    deploy time.

WHY THIS WORKS AS AN ANSWER
------------------------------
Each addition is tied to a SPECIFIC, concrete limitation from the prior
capstone (not a generic "this makes it better" claim), and (b) is
correctly identified as a gap that existed even though Course 1 never
explicitly flagged it -- showing the security exposure was real, not
just a named-and-deferred item.