Examkin

Soru

Zorluk: ZorPlanning Google Kubernetes Engine (GKE) Cluster Architectures

A global financial compliance firm is planning a Google Kubernetes Engine (GKE) cluster architecture to host a sensitive risk-analysis workload. The platform must adhere to the following architectural and security requirements:

• The Kubernetes control plane must be private with its public endpoint disabled, allowing cluster administration solely from authorized corporate on-premises IP ranges via Cloud Interconnect.
• Cluster worker nodes must be provisioned with private IP addresses only, preventing direct inbound internet exposure.
• Pods running on worker nodes require outbound internet access to retrieve external regulatory compliance feeds, but nodes must not be assigned public IP addresses.
• Operational overhead for managing cluster node infrastructure and OS maintenance must be minimized without violating security constraints.

Which GKE cluster architecture and networking configuration should the team implement?

  1. Deploy a private GKE Autopilot cluster with the control plane public endpoint disabled, enable Master Authorized Networks using the on-premises CIDR blocks, and configure Cloud NAT on the VPC subnetwork.Cevap
  2. B
    Deploy a GKE Standard cluster with public endpoints enabled, configure node auto-provisioning to minimize node management, and rely on VPC firewall rules to restrict control plane traffic to on-premises IP ranges.
  3. C
    Deploy a private GKE Standard cluster using Spot VMs across all node pools, disable Cloud NAT, and rely on the Default Internet Gateway to route pod traffic to external data feeds.
  4. D
    Deploy a private GKE Standard cluster with a private control plane endpoint, and configure Horizontal Pod Autoscaler (HPA) to scale cluster node pool capacity when outbound data feed traffic increases.

Cevap

Deploy a private GKE Autopilot cluster with the control plane public endpoint disabled, enable Master Authorized Networks using the on-premises CIDR blocks, and configure Cloud NAT on the VPC subnetwork.
A private GKE Autopilot cluster offloads node lifecycle management while enforcing private IP address assignment across all worker nodes. Disabling the public control plane endpoint isolates the API server strictly to internal VPC and peered on-premises networks. Specifying Master Authorized Networks ensures only designated corporate IP ranges over Cloud Interconnect can send commands to the cluster API. Finally, deploying Cloud NAT on the VPC subnetwork provides necessary outbound internet connectivity for pods to download regulatory data feeds without assigning public IPs to worker nodes.

Adım Adım Çözüm

1
Evaluate cluster operational model requirements for minimizing node management overhead.
GKE Autopilot automates node provisioning, OS patching, and infrastructure scaling, minimizing operational overhead while adhering to security boundaries.
GKE Autopilot fully manages the underlying worker node infrastructure according to Google Cloud best practices.
2
Determine private cluster endpoint and authorization configuration.
Disabling the control plane public endpoint ensures the API server has only a private IP address within the VPC network. Master Authorized Networks restricts access to specified on-premises CIDR ranges.
This isolates administration traffic so it can only traverse private network connections (such as Cloud Interconnect).
3
Select the appropriate networking service for private node egress to the internet.
Cloud NAT provides Managed Network Address Translation for subnets without public IPs.
Nodes and pods remain on private IP addresses while gaining secure outbound internet access to fetch regulatory compliance data feeds.

Anahtar Kavram

GKE Private Cluster Networking and Autopilot Architecture
Bu soruyu puanla

Konular

Planning Google Kubernetes Engine (GKE) Cluster Architectures

Bu konudan daha fazla soru