A DevOps team needs to provision a new Google Kubernetes Engine (GKE) cluster for an enterprise application while adhering to basic security and administrative access best practices. Which of the following configurations should the team implement when creating the cluster? (Select TWO.)
- Enable Control Plane Authorized Networks to restrict administrative endpoint access to authorized IP ranges.Cevap
- Create a dedicated custom IAM service account with minimal required roles to serve as the node pool identity.Cevap
- CAssign the Primitive Owner role to the cluster's default Compute Engine service account to prevent API permission issues.
- DLeave the control plane endpoint open to all public IP addresses (0.0.0.0/0) so deployment tools can access it without network restriction rules.
Cevap
The team should enable Control Plane Authorized Networks to restrict API server access to specific IP addresses and create a custom IAM service account with minimal permissions for the GKE nodes.
Enabling Control Plane Authorized Networks restricts API master endpoint access to verified IP blocks, and using a dedicated minimal custom service account for GKE node pools upholds security best practices.
Adım Adım Çözüm
Anahtar Kavram
Provisioning secure GKE clusters with control plane authorized networks and least-privilege node service accounts.