An organization is deploying a financial processing application on a Google Kubernetes Engine (GKE) private cluster. Company security policy dictates that the cluster's control plane must not accept administrative traffic over the public internet, and administrative commands must only originate from a dedicated management subnet in your Virtual Private Cloud (VPC). Which configuration should you implement to satisfy these security requirements while maintaining administrative access?
- Enable private endpoint access on the cluster control plane and configure Master Authorized Networks with the CIDR range of the management subnet.Answer
- BDisable public endpoint access on the cluster control plane without defining Master Authorized Networks or network routes from the management subnet.
- CAssign the primitive IAM Owner role to the cluster administrative service account to bypass control plane endpoint network restrictions.
- DReplace the GKE cluster with an unmanaged Compute Engine Virtual Machine instance group to avoid managing Kubernetes control plane endpoints.
Answer
Enable private endpoint access on the cluster control plane and configure Master Authorized Networks with the CIDR range of the management subnet.
Enabling private control plane access combined with Master Authorized Networks ensures that only traffic originating from specified internal CIDR blocks (the management subnet) can connect to the Kubernetes API server.
Step-by-Step Solution
Key Concept
GKE Private Cluster Control Plane Security & Authorized Networks