Examkin

Question

Difficulty: MediumPlanning Google Kubernetes Engine (GKE) Cluster Architectures

A healthcare technology company is planning its Google Kubernetes Engine (GKE) cluster architecture to host an electronic health record integration system. The application requires strict network security, meaning cluster nodes must only have private internal IP addresses with restricted egress access through Cloud NAT. Additionally, the infrastructure team wants to eliminate manual worker node management, node provisioning, and security patching overhead without needing custom Linux kernel configurations. Which GKE cluster architectural design best satisfies these operational and security requirements?

  1. Deploy a GKE Autopilot private cluster configured with Cloud NAT for controlled egress.Answer
  2. B
    Deploy a GKE Standard cluster using default public node pools and configure node OS patching via custom scripts.
  3. C
    Deploy a GKE Standard cluster using Spot VM node pools to handle cluster node lifecycle management automatically.
  4. D
    Deploy a GKE Standard cluster and rely on the Horizontal Pod Autoscaler (HPA) to automatically provision and patch worker node instances.

Answer

Deploy a GKE Autopilot private cluster configured with Cloud NAT for controlled egress.
GKE Autopilot provides a hands-off cluster experience where Google manages node infrastructure, provisioning, scaling, and patching. Configuring Autopilot as a private cluster ensures worker nodes are assigned internal IP addresses only, fulfilling the requirement for network isolation combined with minimal operational maintenance.

Step-by-Step Solution

1
Analyze operational overhead requirements
GKE Autopilot provides a fully managed infrastructure environment where Google handles node creation, auto-scaling, security patching, and OS maintenance.
The requirement specifies eliminating worker node management overhead without requiring custom Linux kernel parameters.
2
Analyze network security requirements
Configuring the cluster as a Private Cluster ensures nodes receive private internal IP addresses only, while Cloud NAT provides outbound connectivity for essential updates and external API calls.
Nodes must not have public IP addresses exposed directly to the internet.
3
Synthesize optimal cluster architecture
Combining GKE Autopilot with Private Cluster topology and Cloud NAT meets all management and security constraints.
This strategy fulfills both zero node-management overhead and private network isolation constraints.

Key Concept

GKE Autopilot vs Standard and Private Cluster Architecture
Rate this question

Topics

Planning Google Kubernetes Engine (GKE) Cluster Architectures

More questions from this topic