Examkin

Question

Difficulty: HardPlanning Google Kubernetes Engine (GKE) Cluster Architectures

A biomedical research organization is designing a Google Kubernetes Engine (GKE) cluster architecture on Google Cloud to host two distinct workloads. The first workload is a core API service that requires custom Linux kernel parameters (`sysctl`) configured on the host nodes and guaranteed instance availability. The second workload consists of large-scale, fault-tolerant batch analysis jobs that run statelessly and must be executed at the lowest possible compute cost. Enterprise security rules mandate that cluster nodes must not have public IP addresses and access to the Kubernetes control plane API endpoint must be strictly restricted to the organization's on-premises network CIDR via Cloud VPN. Which cluster architecture meets all technical, operational, and security requirements?

  1. Deploy a GKE Standard regional cluster configured as a Private Cluster with private endpoint access only, enable Control Plane Authorized Networks specifying the on-premises CIDR, create a Standard node pool for the core API service, and add a secondary Spot VM node pool for the batch analysis jobs.Answer
  2. B
    Deploy a GKE Autopilot regional cluster configured as a Private Cluster, configure Control Plane Authorized Networks for the on-premises CIDR, and deploy both workloads using targeted Pod resource requests and Spot Pod annotations.
  3. C
    Deploy a GKE Standard regional cluster configured as a Private Cluster with private endpoints, and host both the core API service and the batch analysis jobs on a single shared Spot VM node pool to maximize cost savings.
  4. D
    Deploy a GKE Standard zonal cluster with public node IPs, enable Cloud Armor security policies to restrict API access to the on-premises CIDR, and configure node auto-provisioning with Preemptible VMs for all workloads.

Answer

Deploying a GKE Standard regional cluster configured as a Private Cluster with private control plane endpoint access, setting Control Plane Authorized Networks to the on-premises CIDR, and provisioning separate Standard and Spot VM node pools for the respective workloads.
GKE Standard mode allows full node configuration including custom OS kernel parameters (`sysctl`). Configuring the cluster as a Private Cluster with private endpoint access and Control Plane Authorized Networks satisfies all security constraints by removing public node IPs and restricting control plane access. Utilizing a separate Spot VM node pool for batch analysis minimizes compute costs without impacting the core API service.

Step-by-Step Solution

1
Evaluate operational cluster mode requirements.
GKE Standard mode must be chosen over Autopilot because GKE Autopilot restricts node-level host access and custom sysctl kernel parameter modifications.
The core API service explicitly requires custom Linux kernel tuning.
2
Evaluate network security constraints.
Configure a Private Cluster with Private Endpoint access enabled and Control Plane Authorized Networks restricted to the on-premises CIDR block.
This prevents public IP assignment to nodes and blocks public access to the Kubernetes API server.
3
Design node pool architecture based on workload characteristics.
Create a standard, persistent node pool for the core API service and a dedicated Spot VM node pool for the stateless batch processing workload.
Spot VMs offer significant cost discounts for fault-tolerant jobs but should not host workloads requiring guaranteed availability.

Key Concept

Planning GKE Cluster Infrastructure & Node Pool Strategies
Rate this question

Topics

Planning Google Kubernetes Engine (GKE) Cluster Architectures

More questions from this topic