Examkin

Question

Difficulty: MediumProvisioning Compute Engine and Kubernetes Engine Clusters

An enterprise platform engineering team is establishing an automated pipeline to deploy a private Google Kubernetes Engine (GKE) cluster and a fleet of Compute Engine virtual machines in a designated Virtual Private Cloud (VPC). The security compliance policy dictates two requirements: administrative traffic to the GKE control plane must be restricted strictly to specified internal subnet IP ranges, and the CI/CD pipeline's service account must be allowed to configure compute resources to run under dedicated workload service accounts without granting administrative control over those service accounts. Which two configuration actions should you implement to meet these requirements? (Select TWO)

  1. Enable Control Plane Authorized Networks on the GKE cluster and add the internal management subnet CIDR blocks to the authorized list.Answer
  2. B
    Grant the deployment pipeline service account the Service Account Admin role (roles/iam.serviceAccountAdmin) at the project level.
  3. C
    Leave Control Plane Authorized Networks disabled and rely exclusively on Identity and Access Management (IAM) role bindings to block network connectivity to the master endpoint.
  4. Grant the deployment pipeline service account the Service Account User role (roles/iam.serviceAccountUser) on the target workload service accounts.Answer
  5. E
    Assign the primitive Editor role (roles/editor) to the deployment pipeline service account to ensure automated provisioning of compute resources is unhindered.

Answer

To enforce control plane network boundaries and follow least privilege for deployment accounts, enable Control Plane Authorized Networks on the private GKE cluster with internal CIDR ranges and grant the CI/CD service account the Service Account User role on the workload service accounts.
The solution requires configuring network security and IAM authorization according to GCP best practices. Enabling Control Plane Authorized Networks restricts cluster API master endpoint access to explicit internal subnet ranges. Concurrently, granting the Service Account User role (roles/iam.serviceAccountUser) allows the deployment service account to attach workload identities to provisioned compute resources while adhering strictly to the principle of least privilege.

Step-by-Step Solution

1
Configure network access controls for the GKE cluster control plane endpoint.
Control Plane Authorized Networks limits master endpoint access exclusively to specified internal management subnet CIDRs.
Preventing unauthorized network ingress to the cluster master endpoint requires network-level access control via authorized network settings.
2
Assign IAM roles for service account usage to the deployment pipeline account.
Granting roles/iam.serviceAccountUser allows the pipeline to attach service accounts to VMs and GKE node pools without granting permissions to manage service account keys or policies.
This satisfies least privilege by separating service account administration from service account usage.

Key Concept

Provisioning private GKE clusters with control plane authorized networks and least-privilege IAM service account usage controls.
Rate this question

Topics

Provisioning Compute Engine and Kubernetes Engine Clusters

More questions from this topic