Examkin

Question

Difficulty: MediumPlanning Google Kubernetes Engine (GKE) Cluster Architectures

A media streaming company is architecting a Google Kubernetes Engine (GKE) cluster to host its customer billing microservices. Security policy strictly mandates that worker nodes must not have public IP addresses exposed to the internet. However, container pods running on these nodes must be able to initiate outbound connections to external third-party payment processing APIs and pull images from Google Container Registry/Artifact Registry. Which GKE cluster network design should the cloud engineer recommend?

  1. Provision a Private GKE Cluster with private node IP addresses, and configure Cloud NAT on the subnetwork to enable outbound internet access.Answer
  2. B
    Provision a Public GKE Cluster and use Horizontal Pod Autoscaler (HPA) to dynamically assign external public IP addresses only when outbound API requests occur.
  3. C
    Provision a Standard GKE Cluster with public node IPs, but configure Spot VM node pools exclusively so that public IP exposure is temporary.
  4. D
    Provision a GKE Autopilot cluster and disable Google Cloud APIs in the project to prevent pods from making outbound external internet requests.

Answer

Provision a Private GKE Cluster with private node IP addresses, and configure Cloud NAT on the subnetwork to enable outbound internet access.
Configuring a Private GKE Cluster ensures that cluster nodes only receive internal private IP addresses, preventing direct inbound access from the internet. Enabling Cloud NAT on the VPC subnetwork enables workloads on those private nodes to safely initiate outbound connections to external services, such as payment APIs and container registries, without assigning public IPs to worker nodes.

Step-by-Step Solution

1
Analyze security requirements for worker node IP assignment.
Nodes must have private IP addresses only, which requires creating a Private GKE cluster.
Private GKE clusters prevent nodes from receiving public IP addresses, satisfying the security policy prohibiting direct inbound public internet exposure.
2
Determine the network egress mechanism for pods needing external internet access.
Cloud NAT must be enabled on the VPC subnetwork hosting the GKE cluster nodes.
Cloud NAT performs Network Address Translation, allowing private node instances and pods to reach external endpoints (like third-party payment APIs) without giving public IP addresses to the nodes.

Key Concept

Private GKE Cluster Architecture with Cloud NAT for Outbound Egress
Rate this question

Topics

Planning Google Kubernetes Engine (GKE) Cluster Architectures

More questions from this topic