A system administrator needs to securely provision a private Google Kubernetes Engine (GKE) cluster for an internal enterprise application. The cluster control plane must be accessible only from designated administrative jump-hosts, and deployment scripts must follow the principle of least privilege. Which TWO configuration steps should you take?
- Enable Control Plane Authorized Networks on the GKE cluster and specify the IP address ranges of the administrative jump-hosts.Cevap
- Grant the Service Account User role (roles/iam.serviceAccountUser) to the deployment service account so it can attach runtime service accounts to node pools.Cevap
- CLeave the cluster control plane publicly accessible without restrictions to simplify remote management.
- DAssign the Project Owner primitive role (roles/owner) to the deployment service account to prevent permission errors.
- EGrant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the GKE worker nodes.
Cevap
The correct configuration steps are enabling Control Plane Authorized Networks with designated administrative IP ranges and granting the Service Account User role to the deployment service account.
Securing a private GKE cluster requires enforcing Control Plane Authorized Networks to limit master endpoint access exclusively to designated management IP ranges. In addition, applying the Service Account User role to the deployment identity grants only the necessary permission to assign runtime service accounts to worker nodes without exposing administrative IAM capabilities.
Adım Adım Çözüm
Anahtar Kavram
Provisioning secure private GKE clusters using Control Plane Authorized Networks and least-privilege IAM service account roles.