Examkin

Question

Difficulty: MediumDeploying Infrastructure using Deployment Manager or Terraform

A site reliability engineer is executing a Terraform configuration to provision Google Kubernetes Engine (GKE) clusters in a newly created Google Cloud project named `proj-dev-app-101`. During the `terraform apply` step, the deployment fails with an error indicating that `container.googleapis.com` is disabled. The engineer notes that the Kubernetes Engine API was previously enabled in the central administration project where their local credentials originate. Why did this deployment fail, and what action should be taken to resolve the issue?

  1. The Kubernetes Engine API must be enabled directly within the target project `proj-dev-app-101` where the resources are being provisioned.Answer
  2. B
    Enabling the API in the administration project is sufficient, but the service account executing Terraform requires the Service Usage Admin role granted at the Google Cloud Organization level.
  3. C
    Terraform cannot manage GKE resources unless an exported JSON service account key is embedded directly into the provider configuration to automatically enable missing APIs.
  4. D
    The deployment failed because the `terraform apply` command was executed without specifying the `--enable-apis=true` runtime flag.

Answer

The Kubernetes Engine API must be enabled directly within the target project `proj-dev-app-101` where the resources are being provisioned.
In Google Cloud, API enablement is scoped individually to each project. Even if deployment tools or identity credentials originate from an administration project, the specific service API (such as `container.googleapis.com`) must be enabled within the destination target project where the infrastructure resources are being provisioned.

Step-by-Step Solution

1
Identify the project context where resources are being created
Resources are targeted for creation inside `proj-dev-app-101`.
Google Cloud API enablement is scoped to individual projects where service resources reside.
2
Analyze API enablement requirements across GCP projects
Enabling an API in one project (e.g., an admin project) has no effect on target workloads in another project.
Each Google Cloud project maintains its own isolated list of enabled service APIs.
3
Select the correct remediation step
Enable `container.googleapis.com` in project `proj-dev-app-101` using `gcloud services enable container.googleapis.com --project=proj-dev-app-101` or a `google_project_service` Terraform resource.
This enables the API API control plane for the specific target project, allowing resource creation to proceed.

Key Concept

GCP Service API Enablement Project Scope
Rate this question

Topics

Deploying Infrastructure using Deployment Manager or Terraform