Examkin

Soru

Zorluk: OrtaProvisioning Compute Engine and Kubernetes Engine Clusters

A smart grid utility organization is automating the provisioning of a private Google Kubernetes Engine (GKE) cluster for critical infrastructure monitoring using Terraform. The deployment pipeline must ensure secure control plane access, maintain least-privilege identity access management, and protect infrastructure deployment state from concurrency conflicts. Which two configuration actions should you include in your provisioning architecture to satisfy these requirements? (Select TWO.)

  1. Configure master authorized networks on the GKE private cluster to restrict control plane access strictly to designated management subnet IP ranges.Cevap
  2. B
    Assign the primitive Editor role (roles/editor) to the deployment pipeline service account to simplify resource creation across compute and network resources.
  3. C
    Store the Terraform state file on the local runner filesystem during execution to eliminate remote backend latency.
  4. Grant the Service Account User role (roles/iam.serviceAccountUser) to the deployment pipeline identity so it can bind runtime service accounts to node pools.Cevap
  5. E
    Grant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the deployment pipeline service account so it can manage compute node service account privileges.

Cevap

Configure master authorized networks to secure the GKE private control plane endpoint, and assign the Service Account User role to the deployment pipeline identity.
Configuring master authorized networks restricts GKE control plane endpoint access exclusively to designated IP ranges, ensuring secure management access. Concurrently, granting the Service Account User role provides the necessary permissions for the provisioning pipeline to attach runtime identities to cluster nodes without granting broad administrative privileges.

Adım Adım Çözüm

1
Evaluate private GKE cluster control plane access controls.
Configuring master authorized networks limits control plane communication to specific authorized CIDR blocks, securing the endpoint even if exposed privately.
Private GKE clusters require explicit master authorized networks to prevent unauthorized internal subnets from accessing cluster administration APIs.
2
Evaluate identity and access management requirements for deployment service accounts.
Granting roles/iam.serviceAccountUser permits the deployment pipeline to provision compute instances and GKE node pools with target service accounts attached.
Least-privilege guidelines dictate granting Service Account User rather than administrative or broad primitive roles.

Anahtar Kavram

GKE Private Cluster Provisioning & IAM Least-Privilege Execution
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Provisioning Compute Engine and Kubernetes Engine Clusters

Bu konudan daha fazla soru