Examkin

Question

Difficulty: HardPlanning Google Kubernetes Engine (GKE) Cluster Architectures

An enterprise retail organization is planning a Google Kubernetes Engine (GKE) cluster architecture to host an event-driven inventory processing system. The architecture must satisfy the following requirements:
- Worker nodes must reside in private subnets with no public IP addresses assigned to them.
- Nodes must be able to reach external third-party vendor APIs over the internet using a fully managed Google Cloud service.
- Access to the GKE control plane master endpoint must be restricted exclusively to designated management IP addresses.
- Background batch processing workloads are stateless and fault-tolerant, and must run on compute capacity that minimizes infrastructure costs.

Which GKE cluster architecture and configuration should you select to fulfill these requirements?

  1. Provision a Private GKE cluster with Master Authorized Networks enabled, deploy Cloud NAT within the VPC network for outbound traffic, and create a dedicated node pool using Spot VMs for batch processing.Answer
  2. B
    Provision a Private GKE cluster with Master Authorized Networks enabled, rely on the Horizontal Pod Autoscaler (HPA) to provision new Compute Engine instances for outbound connectivity, and disable Cloud NAT.
  3. C
    Provision a Public GKE cluster with Master Authorized Networks disabled, deploy Cloud NAT, and create a Spot VM node pool dedicated to hosting stateful persistent database storage.
  4. D
    Provision a GKE Standard cluster in public mode, configure custom sysctl parameters on private nodes, and rely on Cluster Autoscaler to dynamically provision third-party NAT gateways for outbound traffic.

Answer

Provision a Private GKE cluster with Master Authorized Networks enabled, deploy Cloud NAT within the VPC network for outbound traffic, and create a dedicated node pool using Spot VMs for batch processing.
The correct choice configures a Private GKE cluster to keep worker nodes on private IP addresses, uses Master Authorized Networks to secure access to the cluster control plane, deploys Cloud NAT for managed outbound internet connectivity, and leverages Spot VMs in a dedicated node pool to minimize infrastructure costs for stateless, fault-tolerant batch workloads.

Step-by-Step Solution

1
Analyze network isolation and control plane security requirements.
A Private GKE cluster ensures worker nodes receive only internal private IP addresses. Enabling Master Authorized Networks restricts access to the cluster control plane to specified CIDR blocks.
Meets security requirements for private node placement and restricted control plane access.
2
Determine outbound internet access architecture for private nodes.
Deploying Cloud NAT in the VPC network provides managed, scalable outbound internet access for private nodes without assigning public IP addresses.
Meets the requirement for reaching external APIs without managing self-hosted NAT instances.
3
Select compute instance type for batch processing workloads.
Provisioning a node pool configured with Spot VMs provides deeply discounted compute capacity suitable for stateless, fault-tolerant batch workloads.
Meets the requirement to minimize infrastructure costs for resilient workloads.

Key Concept

Planning Private GKE Clusters, Cloud NAT Outbound Connectivity, Master Authorized Networks, and Spot VM Node Pools
Estimated Time:2m 0s
Rate this question

Topics

Planning Google Kubernetes Engine (GKE) Cluster Architectures

More questions from this topic