Examkin

Question

Difficulty: MediumProvisioning Compute Engine and Kubernetes Engine Clusters

An enterprise software team is provisioning a private Google Kubernetes Engine (GKE) cluster in Google Cloud to process internal HR data. The cluster control plane must be isolated from public network access, allowing administrative gcloud and kubectl commands strictly from designated on-premise management subnet ranges via Cloud VPN. Additionally, automated deployment pipelines provisioning the node pools must adhere to the principle of least privilege when configuring service account bindings. Which TWO actions should you take to provision this cluster environment securely?

  1. Enable Control Plane Authorized Networks on the GKE cluster and specify the designated on-premise CIDR blocks.Answer
  2. B
    Disable Control Plane Authorized Networks to allow IAM roles to govern all network-level access automatically without IP restrictions.
  3. Grant the deployment pipeline identity the Service Account User role (roles/iam.serviceAccountUser) on the custom node service account.Answer
  4. D
    Assign the Service Account Admin role (roles/iam.serviceAccountAdmin) to the deployment pipeline identity to attach service accounts to nodes.
  5. E
    Assign the primitive Editor role (roles/editor) to the custom GKE node service account to allow automatic API endpoint discovery.

Answer

To configure a private GKE cluster isolated to corporate management subnets under least privilege, you must enable Control Plane Authorized Networks with designated on-premise CIDR blocks and grant the deployment pipeline identity the Service Account User role on the custom node service account.
Enabling Control Plane Authorized Networks restricts API server endpoint access to explicit CIDR blocks (such as corporate subnets reaching Google Cloud over VPN). For identity management, granting the Service Account User role to the provisioning pipeline satisfies least privilege by permitting the pipeline to assign the custom service account to GKE nodes without giving administrative authority to modify IAM service accounts.

Step-by-Step Solution

1
Identify network security controls for private GKE control plane endpoints.
Control Plane Authorized Networks must be enabled to filter incoming cluster management traffic down to approved corporate CIDR ranges.
IAM authentication alone does not prevent network-level reachability; authorized networks establish an endpoint IP firewall.
2
Determine the minimal IAM permissions required for infrastructure pipelines to attach compute identities.
Assign roles/iam.serviceAccountUser to the deployment identity.
This allows the pipeline to bind the service account to compute instances/node pools without granting administrative control over IAM resources.

Key Concept

Private GKE Cluster Endpoint Security and IAM Least Privilege Service Account Delegation
Rate this question

Topics

Provisioning Compute Engine and Kubernetes Engine Clusters

More questions from this topic