Examkin

Question

Difficulty: HardPlanning Google Kubernetes Engine (GKE) Cluster Architectures

An enterprise media organization is planning a Google Kubernetes Engine (GKE) cluster architecture to host an internal microservices platform. The architecture must satisfy two specific infrastructure requirements:

1. The cluster control plane management API must be accessible exclusively from the organization's on-premises administrative network CIDR block (10.200.0.0/1610.200.0.0/16) via Cloud VPN, blocking all public internet access to the control plane.
2. Cluster worker nodes must be provisioned without public IP addresses, yet workloads must maintain outbound internet connectivity to pull external container images and transmit telemetry.

Which TWO architectural configurations should the team include in their GKE cluster plan? (Select TWO.)

  1. Enable Private Cluster mode with a private control plane endpoint, and configure Master Authorized Networks specifying 10.200.0.0/1610.200.0.0/16.Answer
  2. Provision Cloud NAT within the VPC network region hosting the private cluster subnets.Answer
  3. C
    Generate long-lived service account JSON keys and store them on worker node disks to authorize external image pulls.
  4. D
    Configure a Horizontal Pod Autoscaler (HPA) to scale cluster nodes dynamically whenever outbound network bandwidth limits are reached.
  5. E
    Provision the cluster in GKE Autopilot mode with public node IPs and create VPC ingress firewall rules to block public internet traffic to the nodes.

Answer

To satisfy both enterprise security requirements, the architecture team must enable a Private Cluster with a private control plane endpoint restricted via Master Authorized Networks to the on-premises CIDR block (10.200.0.0/16), and deploy Cloud NAT within the VPC network to provide outbound internet connectivity for private nodes.
Configuring a private GKE cluster with a private control plane endpoint and Master Authorized Networks limits API access to the specified on-premises network range (10.200.0.0/16). Additionally, provisioning Cloud NAT in the VPC provides private cluster nodes with outbound internet egress capabilities required for pulling external images without granting them public IP addresses.

Step-by-Step Solution

1
Analyze control plane access requirements
Disabling public endpoint access and enabling private endpoint with Master Authorized Networks for 10.200.0.0/16 locks down API access exclusively to the internal management network.
Master Authorized Networks restricts access to the GKE control plane endpoint to specified IP ranges, ensuring secure management over Cloud VPN.
2
Analyze node networking and outbound internet access requirements
Nodes provisioned in a private GKE cluster receive only internal IP addresses. To access external internet resources without exposing nodes to inbound traffic, Cloud NAT is required.
Cloud NAT performs Network Address Translation for private subnet instances, granting egress internet access without assigning public IP addresses to nodes.

Key Concept

Private GKE Cluster Topology, Control Plane Master Authorized Networks, and Cloud NAT Egress Architecture
Rate this question

Topics

Planning Google Kubernetes Engine (GKE) Cluster Architectures

More questions from this topic