Examkin

Soru

Zorluk: ZorManaging Networking Resources

A Site Reliability Engineering team maintains a Google Kubernetes Engine (GKE) cluster hosted in a custom Virtual Private Cloud (VPC) named `corp-vpc` in the `us-east1` region. An existing Cloud NAT gateway named `nat-gateway-us-east1` configured on Cloud Router `nat-router` currently handles egress traffic, but was initially deployed using the `--nat-primary-subnet-ip-ranges` flag. After adding a new secondary IP range for GKE Pods on `subnet-analytics`, traffic originating from Pods in this secondary range fails to reach external services. Which command should the engineer execute to enable Internet egress for the secondary IP range while preserving existing NAT functionality?

  1. gcloud compute routers nats update nat-gateway-us-east1 --router=nat-router --region=us-east1 --nat-all-subnet-ip-rangesCevap
  2. B
    gcloud compute nats update nat-gateway-us-east1 --region=us-east1 --nat-all-subnet-ip-ranges
  3. C
    Configure an internal HTTP(S) load balancer with nat-gateway-us-east1 as a backend service to translate secondary range traffic
  4. D
    Expand the primary CIDR block of subnet-analytics to encompass the secondary range so Cloud NAT automatically includes it

Cevap

Execute `gcloud compute routers nats update nat-gateway-us-east1 --router=nat-router --region=us-east1 --nat-all-subnet-ip-ranges` to update the Cloud NAT gateway to include all primary and secondary subnet IP ranges.
Executing `gcloud compute routers nats update` with `--nat-all-subnet-ip-ranges` reconfigures the existing Cloud NAT gateway on the designated Cloud Router so that all primary and secondary subnet IP ranges in the region (including GKE Pod ranges) are allocated source NAT addresses for internet egress.

Adım Adım Çözüm

1
Identify the cause of egress traffic failure for the GKE Pod secondary IP range.
Cloud NAT was deployed with `--nat-primary-subnet-ip-ranges`, which explicitly excludes secondary subnet ranges used by GKE Pod alias IPs.
By default or when configured with primary-only flags, Cloud NAT will not allocate source NAT addresses for secondary IP ranges.
2
Determine the proper gcloud CLI command hierarchy for modifying Cloud NAT configurations.
Cloud NAT is a sub-resource of Cloud Router, managed using `gcloud compute routers nats update`.
Executing operations directly on `gcloud compute nats` will fail due to invalid command syntax.
3
Apply the `--nat-all-subnet-ip-ranges` flag to the Cloud NAT configuration.
The gateway updates dynamically to translate traffic from both primary subnet ranges and secondary pod IP ranges without downtime.
This flag ensures complete coverage across all current and future subnets and secondary ranges within the designated VPC and region.

Anahtar Kavram

Managing Cloud NAT egress policies for secondary subnet IP ranges via gcloud CLI
Bu soruyu puanla

Konular

Managing Networking Resources

Bu konudan daha fazla soru