A healthcare enterprise is provisioning a private Google Kubernetes Engine (GKE) cluster in GCP to execute clinical processing workloads. The architecture must enforce strict security controls: administrative API access to the GKE control plane must be restricted exclusively to the corporate management subnet () routed over Dedicated Interconnect, and pods must authenticate to Google Cloud SQL instances without using static service account keys or relying on node-level identities. Which TWO configuration actions should the Cloud Architect execute to satisfy these security requirements?
- Enable Control Plane Authorized Networks on the GKE cluster and specify as an authorized IP range.Answer
- Enable Workload Identity on the GKE cluster and bind the Kubernetes service account to a Google Cloud service account with minimal IAM roles.Answer
- CDisable the public endpoint on the cluster while leaving Control Plane Authorized Networks disabled, relying on default VPC Peering routing to limit access.
- DAssign the primitive Editor role (roles/editor) to the Compute Engine default service account attached to the GKE node pool.
- EGrant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the GKE node pool service account so pods can generate short-lived credentials.
Answer
The Cloud Architect must enable Control Plane Authorized Networks specifying the corporate subnet , and enable Workload Identity to map Kubernetes service accounts to GCP service accounts for keyless Cloud SQL authentication.
Enabling Control Plane Authorized Networks restricts administrative endpoint access strictly to specified IP ranges like the corporate management subnet (). Enabling Workload Identity provides secure pod-level authentication to Google Cloud SQL using IAM service accounts without downloading or managing static security keys.
Step-by-Step Solution
Key Concept
Private GKE Cluster Hardening and Workload Identity Federation
Estimated Time:2m 30s