Examkin

Question

Difficulty: HardDeploying and Managing Google Kubernetes Engine (GKE) Clusters and Workloads

An enterprise architecture team is setting up a new Google Kubernetes Engine (GKE) environment to host two distinct workloads: a stateful, non-fault-tolerant database proxy service that requires uninterrupted availability, and a set of stateless background batch processing workers that can easily tolerate sudden instance terminations. The team also requires all workloads to securely access Google Cloud APIs like Cloud Storage without creating or downloading long-lived service account JSON keys. Which deployment architecture and configuration strategy should the team implement to satisfy these requirements?

  1. Deploy a GKE Standard cluster with two node pools: a standard node pool with regular Compute Engine VMs for the stateful proxy service, and a separate node pool configured with Spot VMs for the batch workers. Enable Workload Identity on the cluster and bind Kubernetes Service Accounts to IAM Service Accounts.Answer
  2. B
    Deploy a GKE Standard cluster with a single node pool comprised entirely of Spot VMs for both the proxy service and batch workers to minimize compute costs, and store exported service account JSON keys in Kubernetes Secrets.
  3. C
    Deploy a GKE Autopilot cluster and configure both the stateful proxy and batch processing workloads as Spot pods, while mounting service account JSON key files directly into the containers using Persistent Disks.
  4. D
    Deploy a GKE Standard cluster with a standard node pool, configure Horizontal Pod Autoscaler (HPA) to automatically convert database proxy pods into Spot instances during low traffic, and execute `gcloud config set` inside containers to authenticate to GCP services.

Answer

Deploy a GKE Standard cluster with a standard node pool of regular VMs for the stateful proxy service and a Spot VM node pool for batch workers, while enabling Workload Identity for keyless Google Cloud IAM authentication.
The solution properly separates node pool characteristics based on workload fault tolerance (regular VMs for stateful proxy vs Spot VMs for batch processing) and enforces Workload Identity for keyless, secure GCP service access.

Step-by-Step Solution

1
Analyze workload availability requirements
Stateful, non-fault-tolerant services must run on regular (on-demand) VM node pools to prevent sudden eviction. Batch processing jobs can run on Spot VM node pools to optimize costs.
Spot VMs can be reclaimed by Google Cloud at any time with a 30-second termination notice, making them unsuitable for critical non-fault-tolerant services.
2
Select security authentication mechanism
Enable Workload Identity on the cluster and map Kubernetes Service Accounts (KSAs) to IAM Service Accounts (ISAs).
Workload Identity eliminates the need to generate, export, or manage long-lived service account JSON keys.
3
Select cluster configuration mode
Provision a GKE Standard cluster with dedicated node pools matching each workload profile.
Explicit node pool management allows fine-grained control over underlying node VM types (Spot vs Regular).

Key Concept

GKE Workload Identity and Node Pool Selection Strategy
Rate this question

Topics

Deploying and Managing Google Kubernetes Engine (GKE) Clusters and Workloads