A logistics enterprise is architecting a new Google Kubernetes Engine (GKE) cluster to handle real-time fleet telemetry processing. The cluster architecture must satisfy two specific operational requirements:
1. Eliminate manual infrastructure maintenance, such as node provisioning, OS patching, and node pool management overhead.
2. Enable pod workloads to securely access Google Cloud services (Cloud Storage and BigQuery) without managing or storing long-lived service account key credentials.
Which two architectural configurations should you choose to fulfill these requirements? (Select TWO.)
- Provision the cluster using GKE Autopilot mode to delegate node management, OS patching, and infrastructure scaling to Google Cloud.Answer
- Enable Workload Identity on the GKE cluster to associate Kubernetes Service Accounts with IAM Service Accounts for keyless authentication to Google Cloud APIs.Answer
- CDeploy a GKE Standard cluster with node auto-repair and auto-upgrade enabled on all custom node pools.
- DExport JSON service account keys, store them in Kubernetes Secrets, and mount them as environment variables inside application pods.
- EConfigure Spot VM node pools to host stateful database workloads that require continuous uptime.
Answer
The correct choices are provisioning the cluster using GKE Autopilot mode and configuring Workload Identity for keyless GCP authentication.
Deploying in GKE Autopilot mode delegates all node provisioning, maintenance, and cluster infrastructure management to Google Cloud. Additionally, enabling Workload Identity allows Kubernetes workloads to assume IAM roles securely without embedding long-lived JSON credentials in the cluster.
Step-by-Step Solution
Key Concept
Planning GKE Autopilot and Workload Identity Architectures