Examkin

Question

Difficulty: HardProvisioning Compute Engine and Kubernetes Engine Clusters

A financial technology enterprise is establishing an automated deployment pipeline to provision a hybrid compute workload on Google Cloud. The solution requires private Google Kubernetes Engine (GKE) clusters for microservices and Managed Instance Groups (MIGs) for batch calculations, managed declaratively via Infrastructure as Code (IaC). To ensure secure master access, proper identity isolation, and resilient infrastructure state management during provisioning, which TWO actions should the Cloud Architect incorporate into the design?

  1. Configure Control Plane Authorized Networks on the private GKE cluster to restrict access to the cluster master endpoint to explicit, authorized internal administrative CIDR ranges.Answer
  2. Grant the deployment pipeline service account the Service Account User role (roles/iam.serviceAccountUser) on the specific workload service account assigned to the Compute Engine instances.Answer
  3. C
    Omit Control Plane Authorized Networks configuration and rely exclusively on private node IP isolation to secure cluster management communications.
  4. D
    Store the primary Terraform state file in ephemeral local storage on the CI/CD runner to avoid network overhead and external state locking mechanisms.
  5. E
    Assign the primitive Owner role (roles/owner) to the Compute Engine node service account to ensure compute instances have sufficient permission to interact with all cloud resources.

Answer

The Cloud Architect must configure Control Plane Authorized Networks on the private GKE cluster to restrict control plane endpoint access to specified CIDR blocks, and grant the CI/CD deployment service account the Service Account User role on the dedicated workload service account.
Configuring Control Plane Authorized Networks restricts API server access to specified internal networks, preventing unauthorized access to the cluster master. Granting the Service Account User role on the target service account enables the deployment pipeline to launch Compute Engine instances under that identity while strictly adhering to least privilege principles.

Step-by-Step Solution

1
Analyze control plane endpoint security for private GKE clusters.
Determined that private clusters still require Control Plane Authorized Networks to limit master endpoint access strictly to authorized administrative CIDRs.
Private node IP isolation does not automatically restrict network access to the GKE API server endpoint.
2
Evaluate service account privilege delegation for automated compute provisioning.
Identified that the deployment pipeline requires `roles/iam.serviceAccountUser` scoped to the compute workload service account.
This allows the automated worker to provision instances bound to the workload identity without conferring excessive primitive or administrative privileges.
3
Eliminate risky provisioning practices related to state persistence and IAM over-privileging.
Rejected local state storage and primitive Owner role assignments.
Infrastructure state must be held in remote backends like Cloud Storage with object locking, and instance service accounts must follow least privilege.

Key Concept

GKE Private Cluster Master Protection and IAM Service Account User Scoping
Rate this question

Topics

Provisioning Compute Engine and Kubernetes Engine Clusters

More questions from this topic