An enterprise logistics company is provisioning a private Google Kubernetes Engine (GKE) cluster to process high-throughput batch analytics workloads. Security compliance mandates that worker nodes must only have private IP addresses and that administrative access to the GKE control plane endpoint must be restricted strictly to an internal management subnet accessible via Cloud Interconnect. During deployment testing, engineers notice that while worker nodes lack public IP addresses, the cluster control plane public endpoint remains accessible from unauthorized external networks. Which configuration change must be implemented to fulfill the security compliance requirements?
- Enable Control Plane Authorized Networks on the GKE cluster and restrict authorized CIDR blocks exclusively to the internal management subnet range.Answer
- BRely on the private cluster configuration alone, assuming that disabling public IPs on worker nodes automatically restricts network access to the GKE control plane.
- CAssign the primitive Owner IAM role (roles/owner) to the management subnet service account to enforce perimeter network restrictions on the control plane.
- DRe-architect the workload to run on an unmanaged Compute Engine Managed Instance Group (MIG) because private GKE clusters cannot restrict control plane administrative endpoints.
Answer
Enable Control Plane Authorized Networks on the GKE cluster and restrict authorized CIDR blocks exclusively to the internal management subnet range.
Enabling Control Plane Authorized Networks on a private GKE cluster allows organizations to specify explicit CIDR ranges (such as an internal management subnet) permitted to communicate with the cluster's control plane API server. This ensures that unauthorized public or internal networks cannot reach the cluster administration endpoints.
Step-by-Step Solution
Key Concept
GKE Private Cluster Control Plane Security & Authorized Networks
Estimated Time:2m 0s