A biomedical research organization is designing a Google Kubernetes Engine (GKE) cluster architecture on Google Cloud to host two distinct workloads. The first workload is a core API service that requires custom Linux kernel parameters (`sysctl`) configured on the host nodes and guaranteed instance availability. The second workload consists of large-scale, fault-tolerant batch analysis jobs that run statelessly and must be executed at the lowest possible compute cost. Enterprise security rules mandate that cluster nodes must not have public IP addresses and access to the Kubernetes control plane API endpoint must be strictly restricted to the organization's on-premises network CIDR via Cloud VPN. Which cluster architecture meets all technical, operational, and security requirements?
- Deploy a GKE Standard regional cluster configured as a Private Cluster with private endpoint access only, enable Control Plane Authorized Networks specifying the on-premises CIDR, create a Standard node pool for the core API service, and add a secondary Spot VM node pool for the batch analysis jobs.Cevap
- BDeploy a GKE Autopilot regional cluster configured as a Private Cluster, configure Control Plane Authorized Networks for the on-premises CIDR, and deploy both workloads using targeted Pod resource requests and Spot Pod annotations.
- CDeploy a GKE Standard regional cluster configured as a Private Cluster with private endpoints, and host both the core API service and the batch analysis jobs on a single shared Spot VM node pool to maximize cost savings.
- DDeploy a GKE Standard zonal cluster with public node IPs, enable Cloud Armor security policies to restrict API access to the on-premises CIDR, and configure node auto-provisioning with Preemptible VMs for all workloads.