A retail platform is migrating its core ordering microservices to Google Cloud. Security policies mandate that cluster worker nodes must not have public IP addresses and that administrative access to the cluster control plane must be restricted exclusively to the enterprise's corporate management subnet () connected via Cloud VPN. Which deployment strategy should a cloud architect select when provisioning the Google Kubernetes Engine (GKE) cluster to meet these requirements?
- Provision a GKE private cluster with master authorized networks enabled, adding the 10.50.0.0/24 CIDR block to the allowed authorized ranges.Cevap
- BProvision a GKE private cluster with a private control plane endpoint only, without configuring control plane authorized networks.
- CProvision a standard GKE cluster with public node pools across multiple zones and assign the IAM Owner role to the cluster's default service account.
- DDeploy the workload to a Compute Engine Managed Instance Group (MIG) across regions without requesting regional compute quota increases prior to deployment.
Cevap
Provision a GKE private cluster with master authorized networks enabled, adding the 10.50.0.0/24 CIDR block to the allowed authorized ranges.
The correct strategy is to provision a GKE private cluster and enable master authorized networks with the management CIDR range (10.50.0.0/24). A private cluster ensures worker nodes only have private IP addresses, preventing public internet exposure. Master authorized networks restrict HTTPS access to the Kubernetes control plane strictly to specified CIDR blocks, fulfilling both compliance constraints.
Adım Adım Çözüm
Anahtar Kavram
Provisioning GKE Private Clusters with Master Authorized Networks