Examkin

Soru

Zorluk: ZorAdvising Development and Operation Teams

An enterprise operations team is scaling its Google Cloud footprint and managing infrastructure deployments across multiple Google Kubernetes Engine (GKE) private clusters. Currently, operators execute Terraform from local workstations without remote state locking, utilize primitive Editor permissions, and access GKE control planes over public endpoints without restriction. As a Cloud Architect advising the operations team, which TWO architectural actions should you recommend to establish least privilege, secure cluster access, and prevent state corruption?

  1. Migrate Terraform state management to a Google Cloud Storage bucket with object versioning and state locking enabled via Cloud KMS CMEK.Cevap
  2. Restrict private GKE cluster control plane access using Authorized Networks to designated internal CIDR ranges and grant operators fine-grained roles such as Kubernetes Engine Developer alongside Service Account User permissions.Cevap
  3. C
    Assign the primitive Owner IAM role at the project resource level to operations team members to guarantee uninhibited deployment capabilities across GKE cluster resources.
  4. D
    Grant operators the Service Account Admin role across target projects so deployment daemons can freely manipulate service account keys without explicit impersonation bindings.
  5. E
    Store Terraform state files in a shared version control repository to allow developers to inspect and resolve state conflicts locally prior to pipeline execution.

Cevap

The correct recommendations are to migrate Terraform state to a Cloud Storage bucket with state locking enabled, restrict GKE control plane access via Authorized Networks, and assign fine-grained IAM roles (Kubernetes Engine Developer and Service Account User) instead of primitive or administrative roles.
Establishing Cloud Storage as a remote Terraform backend ensures state locking and automated concurrency control during pipeline execution. Restricting private GKE control plane endpoints via Authorized Networks prevents unauthorized network traffic, and applying fine-grained roles (Kubernetes Engine Developer paired with Service Account User) satisfies the principle of least privilege without granting dangerous administrative permissions.

Adım Adım Çözüm

1
Evaluate IaC state management security and reliability requirements.
Local state files or version control storage lead to state corruption during concurrent updates and leak unencrypted secrets. Utilizing a Google Cloud Storage backend with state locking ensures atomic updates and security.
Cloud Storage backends support native file locking via GCP APIs to guarantee single-writer concurrency control for Terraform state.
2
Analyze perimeter security and API access controls for GKE clusters.
Publicly exposed control plane endpoints allow network reachability from untrusted networks. Configuring Control Plane Authorized Networks limits master endpoint access exclusively to designated management VPC subnets or VPN endpoints.
Authorized Networks enforce layer-3 filtering on the GKE control plane endpoint.
3
Apply Google Cloud Identity and Access Management (IAM) least privilege guidelines.
Replace primitive Owner/Editor roles and excessive Service Account Admin roles with fine-grained predefined roles such as Kubernetes Engine Developer and Service Account User.
Service Account User permits deploying workloads under a service account without permitting service account management or key creation.

Anahtar Kavram

Advising DevOps on Secure Infrastructure Management (IaC State Backend & GKE Control Plane Security)
Bu soruyu puanla

Konular

Advising Development and Operation Teams

Bu konudan daha fazla soru