Examkin

Soru

Zorluk: Çok zorProvisioning Compute Engine and Kubernetes Engine Clusters

An enterprise financial organization is deploying a private Google Kubernetes Engine (GKE) cluster for PCI-DSS compliant workloads. Cloud architects must grant security administrators on the corporate on-premises network access to the GKE control plane via Cloud Interconnect while keeping the control plane completely private from the public internet. Additionally, CI/CD deployment service accounts must be restricted to minimal permissions required to bind pod workloads to specific node pool identities. Which set of configuration steps meets these security and operational requirements?

  1. Configure the cluster as a private cluster with a private endpoint, enable Master Authorized Networks including the corporate on-premises CIDR blocks, and grant the CI/CD service account the Service Account User role on the node pool service account.Cevap
  2. B
    Configure the cluster as a private cluster with a private endpoint without Master Authorized Networks, relying on default VPC Peering routes, and grant the CI/CD service account the Service Account User role on the node pool service account.
  3. C
    Configure the cluster as a private cluster with a private endpoint, enable Master Authorized Networks including the corporate on-premises CIDR blocks, and grant the CI/CD service account the Service Account Admin role on the node pool service account.
  4. D
    Configure the cluster with a public control plane endpoint protected by standard VPC Firewall rules, and grant the CI/CD service account the primitive Editor role at the project level.

Cevap

The correct architecture requires provisioning a private GKE cluster with its private endpoint enabled, configuring Master Authorized Networks to permit on-premises CIDR ranges routed over Cloud Interconnect, and scoping CI/CD pipeline IAM permissions to roles/iam.serviceAccountUser on the node service account.
Private GKE clusters use Google-managed VPC peering for the control plane. Accessing the private control plane endpoint from on-premises networks connected via Cloud Interconnect requires Master Authorized Networks to be enabled with those specific CIDR blocks. In addition, scoping CI/CD deployment permissions to the Service Account User role satisfies least-privilege access when attaching node identities.

Adım Adım Çözüm

1
Analyze GKE Control Plane Private Access Requirements
Private GKE control plane endpoints reside in a Google-managed VPC. To allow corporate on-premises networks connected over Cloud Interconnect/VPN to reach this private endpoint, Master Authorized Networks must be explicitly configured with the on-premises CIDR blocks.
Without Master Authorized Networks configured for on-premises IP ranges, traffic originating outside the cluster VPC subnets will be blocked by default.
2
Determine Identity and Access Management (IAM) Privilege Bounds for CI/CD Pipelines
Deployment service accounts require permissions to assign service account identities to workloads/nodes.
Granting roles/iam.serviceAccountUser provides the minimum required permission to attach service accounts without granting administrative rights over IAM service account management (roles/iam.serviceAccountAdmin).
3
Synthesize Architecture Options
Combining private control plane endpoint authorization with minimal IAM service account assignment role satisfies security and functional constraints.
This meets both zero-public-exposure networking requirements and least-privilege identity governance policies.

Anahtar Kavram

Provisioning Private GKE Clusters and IAM Privilege Scoping
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Provisioning Compute Engine and Kubernetes Engine Clusters

Bu konudan daha fazla soru