Your DevOps team needs to provision a Google Kubernetes Engine (GKE) cluster for an internal administration service. The control plane endpoint must not be exposed to the public internet, but cluster administrators must be able to run cluster management commands from specific on-premises corporate IP addresses. Which deployment configuration should you provision to meet these access requirements?
- Provision a private GKE cluster with public endpoint access disabled and enable control plane authorized networks for the corporate IP ranges.Answer
- BProvision a private GKE cluster with default network settings and grant administrators primitive Owner roles to secure the public control plane endpoint.
- CProvision a standard GKE cluster with public endpoints and rely on Cloud IAM permissions without configuring control plane authorized networks.
- DProvision a Compute Engine Managed Instance Group with GKE Enterprise components installed manually using local unversioned state files.
Answer
Provisioning a private GKE cluster with public endpoint access disabled and control plane authorized networks configured for the corporate IP ranges satisfies both privacy and administrative access requirements.
Provisioning a private GKE cluster with public endpoints disabled isolates the control plane to private IP addresses. Enabling control plane authorized networks allows specified corporate IP ranges to securely access the Kubernetes API server via authorized routing.
Step-by-Step Solution
Key Concept
Private GKE Cluster Endpoint Security and Master Authorized Networks