A healthcare enterprise is deploying a containerized analytics microservice on Google Cloud. The architecture team needs to provision a compute solution that minimizes operational management overhead, ensures compute nodes are strictly isolated from the public internet without public IP addresses, and enables container workloads to securely access Cloud Storage using least-privilege IAM permissions. Which combination of provisioning steps should the cloud architect recommend? (Select TWO)
- Provision a Google Kubernetes Engine (GKE) Autopilot cluster configured as a private cluster.Answer
- Configure Workload Identity on the GKE cluster and map the Kubernetes service account to a dedicated IAM service account with granular permissions.Answer
- CGrant the primitive Editor role (roles/editor) to the default Compute Engine service account attached to the cluster node pools.
- DStore the Terraform state file for cluster infrastructure provisioning in unversioned local directory storage on the deployment host.
- EDeploy public GKE node pools while omitting control plane authorized networks to allow unrestricted cluster management.
Answer
The correct recommendations are provisioning a private GKE Autopilot cluster and configuring Workload Identity mapped to a dedicated IAM service account with granular permissions.
Provisioning a private GKE Autopilot cluster satisfies both operational efficiency and network isolation requirements by eliminating manual node management and keeping node IPs internal. Configuring Workload Identity ensures pods obtain short-lived tokens associated with specific IAM service accounts, enforcing least-privilege security for Cloud Storage access.
Step-by-Step Solution
Key Concept
Provisioning GKE Private Autopilot Clusters with Workload Identity
Estimated Time:2m 0s