Examkin

Question

Difficulty: HardProvisioning Compute Engine and Kubernetes Engine Clusters

A global healthcare technology company is deploying a HIPAA-compliant patient monitoring platform on Google Cloud. As the principal cloud architect, you must provision private Google Kubernetes Engine (GKE) clusters using Terraform in a shared Virtual Private Cloud (VPC) environment, ensuring strict control plane isolation, least-privilege automation, and reliable IaC state management. Which THREE architectural configurations and deployment practices should you implement to satisfy these security and operational requirements?

  1. Enable Control Plane Authorized Networks on the GKE private cluster and restrict access to the CIDR blocks of your management bastion hosts and CI/CD runners.Answer
  2. Store the Terraform state in a Cloud Storage backend configured with Object Versioning and state locking enabled via a remote backend configuration.Answer
  3. Grant the deployment pipeline service account the Service Account User role (roles/iam.serviceAccountUser) on the dedicated GKE node service account.Answer
  4. D
    Grant the GKE node service account the primitive Editor role (roles/editor) to ensure node pools can dynamically provision required cloud storage and network resources.
  5. E
    Maintain Terraform state files in local storage within the CI/CD container workspace to avoid external network storage overhead during deployment steps.

Answer

The correct implementation requires securing the GKE master endpoint with Control Plane Authorized Networks, using Cloud Storage with versioning and state locking for Terraform state management, and granting the Service Account User role to the CI/CD pipeline service account.
Securing a private GKE cluster deployment with Terraform demands three core architectural controls: restricting control plane administrative access via Control Plane Authorized Networks, configuring centralized Terraform state management in Cloud Storage with locking and versioning enabled, and delegating service account usage rights to CI/CD pipelines via the dedicated Service Account User role instead of elevated admin or primitive roles.

Step-by-Step Solution

1
Configure GKE control plane security bounds
Control Plane Authorized Networks limits master endpoint reachability to explicitly listed internal or management IP addresses.
Prevents unauthorized administrative access to the Kubernetes control plane endpoint.
2
Implement secure IaC state management
Terraform backend uses Cloud Storage with object versioning and state locking.
Ensures concurrent deployment safety and disaster recovery capability for infrastructure state.
3
Apply least-privilege IAM permissions for pipeline execution
The deployment service account receives roles/iam.serviceAccountUser to impersonate and assign node service accounts.
Adheres to enterprise compliance by withholding broad Service Account Admin or primitive project roles.

Key Concept

Provisioning secure GKE private clusters using Infrastructure as Code (Terraform) requires enforcing control plane authorized networks, centralized remote state locking, and least-privilege IAM role assignments for deployment service accounts.
Rate this question

Topics

Provisioning Compute Engine and Kubernetes Engine Clusters

More questions from this topic