An enterprise organization is deploying an automated infrastructure pipeline using Terraform to provision core compute infrastructure in Google Cloud. The deployment includes private Google Kubernetes Engine (GKE) clusters for microservices and Managed Instance Groups (MIGs) for batch processing workloads. Security compliance policies dictate two strict requirements:
1. Access to the GKE cluster control plane endpoint for management traffic (`kubectl`) must be restricted exclusively to an internal management CIDR range () without exposing management endpoints to unauthorized networks.
2. The continuous deployment service account executing compute resource creation must attach application service accounts to compute instances without gaining privileges to modify service account IAM policies or impersonate high-privilege roles.
Which TWO deployment and security configuration choices must be implemented to fulfill these requirements? (Select TWO)
- Enable Master Authorized Networks on the private GKE cluster and explicitly add the IP range to the authorized network configuration.Answer
- Grant the deployment pipeline service account the `roles/iam.serviceAccountUser` role on the specific target workload service accounts.Answer
- CProvision the GKE cluster as a private cluster without Master Authorized Networks enabled, relying on default VPC network firewall rules to block internet access to the control plane.
- DGrant the deployment pipeline service account the `roles/iam.serviceAccountAdmin` role to ensure it has required permissions to provision and manage Compute Engine instance service accounts.
- EStore the Terraform infrastructure state file in an ephemeral local directory on the CI/CD runner host to speed up compute resource provisioning operations.