Examkin

Question

Difficulty: HardDeploying Infrastructure using Deployment Manager or Terraform

A cloud engineer is using Terraform to automate the deployment of a Google Kubernetes Engine (GKE) cluster into a target service project named `proj-workloads-prod`. During the pipeline execution, `terraform apply` fails with an API error stating `Google API Error 403: Kubernetes Engine API has not been used in project proj-workloads-prod or it is disabled`. The engineer had previously enabled `container.googleapis.com` in the central CI/CD administrative project `proj-pipeline-host` where the deployment pipeline service account resides, assuming that API enablement in the calling project would suffice. Which action must the engineer take to resolve this failure?

  1. Enable `container.googleapis.com` specifically in the target project `proj-workloads-prod` where the infrastructure resources are being provisioned.Answer
  2. B
    Re-enable `container.googleapis.com` in `proj-pipeline-host` and grant the Service Account User role to the target project's default compute engine service account.
  3. C
    Export a service account JSON key from `proj-workloads-prod` and supply it to the Terraform provider configuration in `proj-pipeline-host` to bypass project API restrictions.
  4. D
    Modify the organization policy to enforce API inheritance so that `proj-workloads-prod` automatically inherits enabled APIs from the parent folder.

Answer

Enable the Kubernetes Engine API (`container.googleapis.com`) specifically inside the target project where infrastructure resources are being deployed.
In Google Cloud, infrastructure service APIs (such as `container.googleapis.com`) must be explicitly enabled within the specific target project where the resources are created. Enabling the API in a caller's host project or pipeline administrative project only enables API usage for resources located in that host project.

Step-by-Step Solution

1
Identify the project context of the failed resource deployment
The Terraform configuration attempts to provision resources within `proj-workloads-prod`.
GCP service APIs control endpoint access and billing enablement on a per-project basis for resource creation.
2
Determine where the service API needs to be enabled
The required API `container.googleapis.com` must be active in `proj-workloads-prod`.
Enabling an API in an administrative host project only allows operations on resources residing within that host project.
3
Apply remediation to enable the API in the target project
Run `gcloud services enable container.googleapis.com --project=proj-workloads-prod` or include a `google_project_service` resource targeting `proj-workloads-prod` in Terraform.
This grants permission for resource creation and endpoint allocation in the target project.

Key Concept

API Enablement Location in Multi-Project Infrastructure Provisioning
Rate this question

Topics

Deploying Infrastructure using Deployment Manager or Terraform