Examkin

Question

Difficulty: Very hardProvisioning Compute Engine and Kubernetes Engine Clusters

A global financial technology enterprise is designing a secure payment execution platform on Google Cloud. The architecture mandates provisioning a private Google Kubernetes Engine (GKE) cluster where worker nodes have no public IP addresses. Internal compliance requires that administrative cluster management using kubectl must strictly originate from a management VPC subnet connected via VPC Network Peering, with public access to the Kubernetes control plane completely disabled. Furthermore, containerized workloads running inside the cluster must securely consume Google Cloud API resources without embedding or downloading long-lived service account keys. Which set of provisioning actions should the cloud architect specify to fulfill these requirements while following Google Cloud best practices?

  1. Provision a private GKE cluster with the control plane private endpoint enabled and public endpoint disabled, define Control Plane Authorized Networks to include the management VPC subnet CIDR, and configure Workload Identity to map Kubernetes Service Accounts to GCP Service Accounts with least-privilege IAM roles.Answer
  2. B
    Provision a private GKE cluster with private nodes, disable Control Plane Authorized Networks to allow automatic transitive routing from the management VPC, and mount JSON service account keys as Kubernetes secrets for application pods.
  3. C
    Provision a standard GKE cluster with public endpoints restricted by Cloud Armor firewall rules, and grant the Service Account Admin role to the node service account so pods can dynamically acquire privileges.
  4. D
    Provision an unmanaged Compute Engine instance group behind an Internal HTTP(S) Load Balancer, manually install Kubernetes control plane components, and assign the primitive Editor IAM role to the default Compute Engine service account.

Answer

Provision a private GKE cluster with the control plane private endpoint enabled and public endpoint disabled, define Control Plane Authorized Networks to include the management VPC subnet CIDR, and configure Workload Identity to map Kubernetes Service Accounts to GCP Service Accounts with least-privilege IAM roles.
The correct architecture requires creating a private GKE cluster with the private endpoint enabled and public endpoint disabled for complete isolation of the API server. Configuring Control Plane Authorized Networks with the management VPC CIDR permits authorized administration over VPC Network Peering. Employing Workload Identity enables pods to access GCP services using IAM service account mapping without needing static key files.

Step-by-Step Solution

1
Evaluate private GKE control plane endpoint requirements
Disabling the public endpoint requires accessing the Kubernetes API via its internal private endpoint IP within the master peering network.
Ensures zero exposure of the GKE API server to the public internet.
2
Configure Control Plane Authorized Networks for peered network access
Explicitly authorizing the CIDR range of the management VPC allows cluster management traffic from the peered network to pass to the private control plane endpoint.
GKE private master endpoints block external CIDRs by default unless explicitly permitted through Control Plane Authorized Networks.
3
Establish secure workload authentication to Google Cloud APIs
Workload Identity allows Kubernetes Service Accounts (KSAs) to impersonate Google Service Accounts (GSAs) seamlessly without long-lived keys.
Eliminates security risks associated with storing and rotating JSON service account keys in Kubernetes secrets.

Key Concept

Private GKE Cluster Provisioning, Authorized Networks, and Workload Identity
Rate this question

Topics

Provisioning Compute Engine and Kubernetes Engine Clusters

More questions from this topic