A enterprise security team is provisioning a private Google Kubernetes Engine (GKE) cluster to host sensitive online payment processing services. The architectural requirements specify that the cluster control plane must only accept administrative traffic from a designated corporate management subnet, and pods running inside the cluster must access Cloud Storage buckets without mounting long-lived service account key files. Which of the following configuration choices should the cloud architect implement during cluster provisioning? (Select TWO.)
- Enable Control Plane Authorized Networks on the cluster and restrict access to the CIDR block of the corporate management subnet.Answer
- Enable Workload Identity on the GKE cluster and bind Kubernetes service accounts to dedicated Google Cloud service accounts.Answer
- CGrant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the Compute Engine default service account assigned to cluster worker nodes.
- DStore the deployment pipeline's Terraform state file on an unencrypted local disk of the provisioning workstation to accelerate apply execution.
- EAssign the primitive Owner role to the cluster's worker node service accounts to simplify Cloud Storage bucket authorization.
Answer
The correct configurations are to enable Control Plane Authorized Networks specifying the corporate management subnet CIDR, and to enable Workload Identity to map Kubernetes service accounts to Google Cloud service accounts.
Configuring Control Plane Authorized Networks ensures that the GKE master API server accepts administrative requests strictly from approved internal IP ranges. Combining this with Workload Identity allows pod workloads to authenticate natively to GCP services like Cloud Storage using temporary, auto-rotated tokens under least privilege rules.
Step-by-Step Solution
Key Concept
Provisioning secure private GKE clusters using Control Plane Authorized Networks and Workload Identity.
Estimated Time:2m 0s