Examkin

Question

Difficulty: HardDeploying and Managing Google Kubernetes Engine (GKE) Clusters and Workloads

An engineering team is attempting to deploy a stateless microservice to a Google Kubernetes Engine (GKE) Autopilot cluster. The Kubernetes Deployment manifest includes a Pod specification that configures a `hostPath` volume to write cache files directly to the host node directory `/var/cache/app`. When the team executes `kubectl apply -f deployment.yaml`, the Kubernetes API server rejects the request. The team must deploy the application on GKE Autopilot using container best practices while adhering to Google Cloud security boundaries. Which change should the team make to resolve this deployment issue?

  1. Replace the `hostPath` volume with an `emptyDir` volume in the Pod specification to provide temporary storage without accessing the host filesystem.Answer
  2. B
    Convert the existing cluster operational mode to GKE Standard by running `gcloud config set container/cluster_mode standard` before reapplying the manifest.
  3. C
    Update the local kubeconfig context by running `gcloud config set container/use_client_certificate true` to bypass cluster admission control policies.
  4. D
    Add a `nodeSelector` specifying Spot VM node pools in the Deployment manifest, as Spot nodes permit unrestricted host filesystem mounts.

Answer

Replace the hostPath volume with an emptyDir volume in the Pod specification to provide temporary storage without accessing the host filesystem.
In GKE Autopilot, Google manages the underlying nodes, security hardening, and host OS. To guarantee node integrity, Autopilot restricts privileged operations, including custom `hostPath` volume mounts. Replacing `hostPath` with an `emptyDir` volume provides the workload with scratch/cache storage isolated to the pod without breaking Autopilot security guardrails.

Step-by-Step Solution

1
Analyze the error cause on GKE Autopilot
GKE Autopilot manages node provisioning and security automatically. It enforces baseline pod security policies that prohibit mounting arbitrary host OS paths via `hostPath` volumes.
Host filesystem access undermines container isolation and managed node security.
2
Select a Kubernetes storage mechanism supported by GKE Autopilot
Using an `emptyDir` volume or a persistent volume claim (PVC) allocates storage dedicated to the pod lifetime or managed persistent disks.
An `emptyDir` volume satisfies the requirement for temporary cache storage while remaining fully compliant with Autopilot security boundaries.

Key Concept

GKE Autopilot Workload Security Constraints and Storage Mechanisms
Estimated Time:2m 0s
Rate this question

Topics

Deploying and Managing Google Kubernetes Engine (GKE) Clusters and Workloads