Examkin

Question

Difficulty: MediumInfrastructure as Code and Environment Provisioning

A healthcare company provisions isolated staging environments using Terraform running in a dedicated management Virtual Private Cloud (VPC). During an automated deployment pipeline, Terraform provisions a private Google Kubernetes Engine (GKE) cluster in a target workload VPC. The cluster creation succeeds, but subsequent Terraform steps fail when attempting to deploy cluster workloads because the Terraform runner cannot communicate with the GKE control plane. Which architectural modification should the team implement to resolve this provisioning issue while adhering to Google Cloud security and reliability best practices?

  1. Configure GKE Control Plane Authorized Networks to include the IP range of the management VPC runner subnet and ensure VPC peering or Authorized Network connectivity allows internal access to the private control plane endpoint.Answer
  2. B
    Disable the private control plane endpoint and grant the Primitive Owner role to the pipeline service account so it can bypass cluster endpoint restrictions.
  3. C
    Peer the management VPC to an intermediate transit VPC that is already peered with the cluster VPC, relying on network transitivity for control plane reachability.
  4. D
    Grant the Service Account Admin role to the pipeline service account to allow dynamic generation and injection of service account keys during provisioning.

Answer

Configure GKE Control Plane Authorized Networks to explicitly allow the management subnet CIDR containing the Infrastructure as Code runner, ensuring secure internal network access to the private master endpoint.
The correct answer addresses private GKE cluster accessibility during automated environment provisioning. Private cluster control planes drop traffic unless the source network is explicitly authorized. Adding the management VPC runner subnet CIDR to Control Plane Authorized Networks establishes secure internal connectivity needed for automated Terraform apply steps.

Step-by-Step Solution

1
Identify the cause of cluster provisioning failure
The Terraform runner cannot communicate with the private GKE control plane because the master endpoint blocks unauthorized source IP ranges by default.
Private GKE cluster control planes restrict access to authorized network ranges and internal endpoints.
2
Evaluate network routing and access controls
VPC Network Peering is non-transitive, meaning intermediate VPC hops will not route traffic to the control plane, while public endpoint exposure violates security posture.
GCP networking rules strictly prevent transitive peering and mandate least-privilege network access.
3
Authorize the runner subnet CIDR range
The IaC pipeline successfully reaches the cluster API server over internal routing to complete workload deployment steps.
Adding the runner's subnet CIDR to Control Plane Authorized Networks grants legitimate, secure deployment access.

Key Concept

Private GKE Cluster Control Plane Connectivity and IaC Provisioning
Rate this question

Topics

Infrastructure as Code and Environment Provisioning