Examkin

Question

Difficulty: HardProvisioning Compute Engine and Kubernetes Engine Clusters

An enterprise SaaS platform is provisioning a private Google Kubernetes Engine (GKE) cluster to execute secure background analytics workloads. Organization security policy mandates that worker nodes must not be assigned public IP addresses and that management access to the GKE control plane must be strictly restricted to an internal management subnet (10.200.0.0/24). During automated deployment, node provisioning completes successfully, but administrators report that kubectl commands issued from bastion hosts within 10.200.0.0/24 are blocked when reaching the control plane. Additionally, the CI/CD pipeline service account used for deployment has been granted roles/iam.serviceAccountAdmin to allow compute instances to attach to custom service accounts. Which combination of architectural modifications should you recommend to resolve the control plane connectivity failure while enforcing least privilege IAM access?

  1. Enable Control Plane Authorized Networks on the GKE cluster, adding 10.200.0.0/24 to the allowed IP ranges, and replace roles/iam.serviceAccountAdmin on the deployment service account with roles/iam.serviceAccountUser targeting the node service account.Answer
  2. B
    Disable the private control plane endpoint to allow external cluster management, and assign the primitive Owner role to the deployment service account to ensure full resource attach rights.
  3. C
    Configure Control Plane Authorized Networks using 0.0.0.0/0 to permit all administrative traffic, while maintaining roles/iam.serviceAccountAdmin on the CI/CD pipeline service account for provisioning.
  4. D
    Replace the GKE cluster with unmanaged Compute Engine Virtual Machine instances in a single zone and grant the Security Admin role globally to the pipeline service account.

Answer

Enable Control Plane Authorized Networks on the GKE cluster specifying 10.200.0.0/24, and grant roles/iam.serviceAccountUser to the deployment pipeline service account.
Enabling Control Plane Authorized Networks with the management subnet CIDR 10.200.0.0/24 allows management traffic from internal bastion hosts to reach the private GKE control plane API endpoint. Replacing the Service Account Admin role with the Service Account User role enforces the principle of least privilege, providing the deployment pipeline with the necessary permission to attach the node service account without granting full IAM management rights.

Step-by-Step Solution

1
Identify the cause of control plane access blocking on a private GKE cluster
Recognize that private GKE clusters block master endpoint access by default unless authorized network CIDR ranges are explicitly configured.
Control Plane Authorized Networks allows specific CIDRs (such as 10.200.0.0/24) to reach the Kubernetes API master endpoint.
2
Evaluate IAM permissions required for service account attachment during compute provisioning
Determine that roles/iam.serviceAccountUser is the exact minimal permission required for a provisioning identity to attach a target service account to compute instances or node pools.
Granting roles/iam.serviceAccountAdmin provides excessive administrative capabilities over service account keys and IAM policies.

Key Concept

Private GKE Cluster Endpoint Security and Service Account IAM Privilege Boundaries
Estimated Time:2m 0s
Rate this question

Topics

Provisioning Compute Engine and Kubernetes Engine Clusters

More questions from this topic