Examkin

Question

Difficulty: HardProvisioning Compute Engine and Kubernetes Engine Clusters

A digital media organization is provisioning a private Google Kubernetes Engine (GKE) cluster in a dedicated Virtual Private Cloud (VPC) to run containerized video processing microservices. To comply with strict corporate governance, administrative access to the cluster control plane must be restricted exclusively to a specified corporate network CIDR block (172.16.50.0/24172.16.50.0/24). Additionally, automated continuous integration/continuous delivery (CI/CD) worker virtual machines running in Compute Engine must be permitted to attach a dedicated service account to workloads without having privileges to alter service account IAM policies. Which combination of configuration steps should the cloud architect perform to provision this environment correctly?

  1. Enable control plane authorized networks on the private GKE cluster configured with 172.16.50.0/24172.16.50.0/24, and grant the Service Account User role (`roles/iam.serviceAccountUser`) on the target service account to the CI/CD worker instances.Answer
  2. B
    Provision the private GKE cluster with default control plane settings, and rely solely on VPC Service Controls perimeters to block unauthorized master endpoint access while granting the Editor role (`roles/editor`) to the CI/CD worker instances.
  3. C
    Enable control plane authorized networks on the private GKE cluster configured with 172.16.50.0/24172.16.50.0/24, and grant the Service Account Admin role (`roles/iam.serviceAccountAdmin`) on the target service account to the CI/CD worker instances.
  4. D
    Deploy an unmanaged Compute Engine instance group running Kubernetes control plane binaries to bypass private GKE control plane endpoint restrictions, and grant the Service Account User role (`roles/iam.serviceAccountUser`) to the worker instances.

Answer

Enable control plane authorized networks on the private GKE cluster specifying the designated subnet range (172.16.50.0/24172.16.50.0/24), and grant the Service Account User role (`roles/iam.serviceAccountUser`) to the CI/CD worker instances.
Enabling control plane authorized networks on a private GKE cluster ensures that only specified CIDR blocks (such as 172.16.50.0/24172.16.50.0/24) can reach the cluster's API server. Coupling this network security control with the Service Account User role (`roles/iam.serviceAccountUser`) allows compute workers to act as or attach the service account to deployed resources without giving them authority to alter service account configurations or security policies.

Step-by-Step Solution

1
Configure Control Plane Endpoint Security
Control plane authorized networks are enabled on the private GKE cluster with CIDR 172.16.50.0/24172.16.50.0/24.
This restricts HTTPS access to the GKE cluster master endpoint so that only traffic originating from the authorized corporate network range can communicate with the Kubernetes API server.
2
Apply Least-Privilege IAM Roles for Workload Provisioning
The CI/CD worker instances are granted `roles/iam.serviceAccountUser` on the deployment service account.
This enables the CI/CD pipeline to bind and use the dedicated service account when creating pods or compute instances while withholding administrative management permissions over the service account object.

Key Concept

Provisioning Private GKE Clusters with Control Plane Authorized Networks and Least-Privilege IAM Roles
Estimated Time:2m 0s
Rate this question

Topics

Provisioning Compute Engine and Kubernetes Engine Clusters

More questions from this topic