Examkin

Question

Difficulty: MediumProvisioning Compute Engine and Kubernetes Engine Clusters

A logistics enterprise is provisioning a private Google Kubernetes Engine (GKE) cluster to host internal microservices. The cluster nodes are created with private IP addresses only, and the cluster control plane is configured with a private endpoint. The platform operations team needs to administer the cluster using kubectl from an on-premises workstation connected to Google Cloud via Cloud VPN. However, connection attempts to the private control plane endpoint are failing. Which configuration change must be made to grant the on-premises workstation access to the private cluster control plane?

  1. Enable Control Plane Authorized Networks on the GKE cluster and add the on-premises network CIDR range to the allowed IP ranges.Answer
  2. B
    Rely on default private cluster peering and avoid configuring Control Plane Authorized Networks, assuming VPC routing automatically opens control plane access to all connected networks.
  3. C
    Grant the primitive Owner IAM role (roles/owner) to the platform operations service account to override network firewall rules.
  4. D
    Grant the Service Account Admin role (roles/iam.serviceAccountAdmin) on the node service account to the administrative users.

Answer

Enable Control Plane Authorized Networks on the GKE cluster and add the on-premises network CIDR range to the allowed IP ranges.
Enabling Control Plane Authorized Networks on a private GKE cluster allows administrators to specify exact CIDR blocks—such as on-premises workstation subnets connected via Cloud VPN—that are permitted to reach the private Kubernetes control plane endpoint.

Step-by-Step Solution

1
Identify network requirements for private GKE control plane access.
By default, private GKE control planes only accept connections from internal VPC subnets and approved IP ranges.
Traffic originating from an on-premises network over Cloud VPN originates from an external CIDR block outside the cluster's VPC subnet.
2
Configure control plane network authorization controls.
Enabling Control Plane Authorized Networks and adding the corporate network CIDR block explicitly permits kubectl traffic from the on-premises workstation to the private master endpoint.
Control Plane Authorized Networks restrict endpoint access to specified IP ranges regardless of whether the endpoint is public or private.

Key Concept

GKE Private Cluster Control Plane Authorized Networks
Rate this question

Topics

Provisioning Compute Engine and Kubernetes Engine Clusters

More questions from this topic