Examkin

Soru

Zorluk: OrtaProvisioning Compute Engine and Kubernetes Engine Clusters

An energy utility corporation is setting up a secure telemetry processing platform on Google Cloud. The architecture requires a private Google Kubernetes Engine (GKE) cluster for microservices and a Managed Instance Group (MIG) of Compute Engine VMs for legacy batch processing. The operations team will administer the private GKE cluster control plane remotely from an on-premises administrative subnet (10.150.0.0/2410.150.0.0/24) over Cloud Interconnect. Automated deployment pipelines using a dedicated service account will provision both the compute infrastructure and workloads. Which TWO configuration steps are required to ensure secure provisioning and access according to Google recommended practices?

  1. Enable Control Plane Authorized Networks on the GKE cluster and include the on-premises subnet CIDR block (10.150.0.0/2410.150.0.0/24).Cevap
  2. Grant the deployment pipeline service account the Service Account User role (`roles/iam.serviceAccountUser`) on the runtime service accounts assigned to the compute instances.Cevap
  3. C
    Grant the deployment pipeline service account the Service Account Admin role (`roles/iam.serviceAccountAdmin`) at the project level.
  4. D
    Leave Control Plane Authorized Networks disabled to allow default internal VPC routing for master management without IP filtering.
  5. E
    Store the deployment Terraform state file in a local git repository attached to the deployment runner instance without object versioning.

Cevap

Enable Control Plane Authorized Networks specifying the on-premises CIDR block (10.150.0.0/2410.150.0.0/24), and grant the deployment pipeline service account the Service Account User role (`roles/iam.serviceAccountUser`) on the runtime service accounts.
To securely provision and manage the infrastructure, the private GKE control plane endpoint must restrict administrative access to known management networks via Control Plane Authorized Networks. Additionally, automated pipelines deploying VMs or Kubernetes node pools attached to custom runtime service accounts require the `roles/iam.serviceAccountUser` role to bind those identities without granting full administrative ownership over the service accounts.

Adım Adım Çözüm

1
Configure control plane security for the private GKE cluster
Authorized network entry added for 10.150.0.0/2410.150.0.0/24
Private GKE control plane endpoints require explicit authorized IP ranges to restrict HTTPS access to designated management subnets.
2
Configure IAM roles for compute resource provisioning
Pipeline service account is granted `roles/iam.serviceAccountUser`
When automated tools launch compute instances or node pools bound to a specific runtime service account, the executing identity must have permission to attach (use) that service account.

Anahtar Kavram

GKE Private Cluster Control Plane Protection and IAM Service Account User Delegation
Bu soruyu puanla

Konular

Provisioning Compute Engine and Kubernetes Engine Clusters

Bu konudan daha fazla soru