Examkin

Question

Difficulty: EasyProvisioning Compute Engine and Kubernetes Engine Clusters

A cloud administrator provisions a private Google Kubernetes Engine (GKE) cluster for an internal enterprise application. After establishing an active VPN connection to the VPC, the administrator attempts to manage the cluster using `kubectl` from an on-premises management workstation, but connection attempts to the cluster master endpoint time out. Which configuration issue is the cause of this connection failure?

  1. The control plane authorized networks feature is enabled on the cluster, but the on-premises workstation subnet was omitted from the allowed IP ranges.Answer
  2. B
    The service account attached to the GKE cluster node pool was not granted the primitive Owner role on the Google Cloud project.
  3. C
    The Infrastructure as Code pipeline stored the Terraform state file in an unversioned local directory instead of a Cloud Storage backend.
  4. D
    The project exceeded its regional Compute Engine CPU quota when auto-repairing node instances.

Answer

The control plane authorized networks feature is enabled on the cluster, but the on-premises workstation subnet was omitted from the allowed IP ranges.
In Google Kubernetes Engine (GKE), private clusters allow restricting access to the control plane endpoint via Control Plane Authorized Networks. When this feature is active, traffic from IP addresses outside specified CIDR blocks is blocked by default, causing client connections via `kubectl` to time out even if underlying VPC/VPN routing is functional.

Step-by-Step Solution

1
Identify the resource component and symptoms described in the scenario.
The user is attempting to reach a private GKE cluster control plane over VPN via kubectl, but experiencing connection timeouts.
Private GKE control plane endpoints enforce explicit network security controls beyond standard VPC routing.
2
Evaluate GKE control plane security settings.
Control Plane Authorized Networks acts as an IP firewall for the GKE master endpoint.
If authorized networks are enabled, any source IP outside the configured CIDR blocks is dropped at the control plane proxy layer.
3
Determine the necessary remediation.
Add the management workstation CIDR block to the control plane authorized networks list.
This allows master endpoint access while keeping unauthorized VPC traffic restricted.

Key Concept

GKE Private Cluster Control Plane Authorized Networks
Rate this question

Topics

Provisioning Compute Engine and Kubernetes Engine Clusters

More questions from this topic