A system administrator has deployed a private Cloud DNS zone named services.internal in a host Google Cloud Virtual Private Cloud (VPC) network named vpc-production. A separate analytics workload runs in another VPC network named vpc-analytics within the same organization. Compute Engine instances located in vpc-analytics are currently unable to resolve domain names ending in .services.internal. You need to enable domain name resolution for instances in vpc-analytics while minimizing infrastructure complexity and avoiding unnecessary DNS peering overhead. Which configuration step must be performed to meet this requirement?
- Update the existing services.internal private DNS zone configuration in Cloud DNS to add vpc-analytics to the list of authorized VPC networks.Answer
- BEstablish VPC Network Peering between vpc-production and vpc-analytics, as private Cloud DNS zones automatically sync across peered VPC networks.
- CEnable the Cloud DNS API in the host project for vpc-analytics and create a DNS peering zone in vpc-production that targets vpc-analytics as the peer network.
- DAdd a custom egress VPC firewall rule in vpc-analytics with priority 65535 allowing UDP port 53 traffic to the internal metadata IP address of vpc-production.
Answer
Update the existing services.internal private DNS zone configuration in Cloud DNS to add vpc-analytics to the list of authorized VPC networks.
In Google Cloud DNS, a private DNS zone can be made accessible to multiple VPC networks by adding those networks to the zone's authorized networks list. Once authorized, instances in vpc-analytics can resolve hostnames in services.internal directly through their local metadata DNS server.
Step-by-Step Solution
Key Concept
Cloud DNS Private Zone Authorized Networks