Examkin

Soru

Zorluk: OrtaAdvising Development and Operation Teams

A retail organization's platform operations team is supporting a dev team that deploys microservices to a private Google Kubernetes Engine (GKE) cluster using an external CI/CD runner. During automated deployment pipeline runs, the build stage succeeds, but the deployment step fails to connect to the cluster's control plane API server. The operations team wants to enable the CI/CD pipeline to deploy container updates securely without exposing the control plane to public internet traffic generally. Which architectural advice should you provide to the development and operations teams?

  1. Configure Control Plane Authorized Networks on the private GKE cluster to explicitly allow access from the specific external IP CIDR block of the CI/CD deployment runners.Cevap
  2. B
    Disable the private endpoint on the GKE control plane to allow the API server to accept incoming connections from any public internet IP address.
  3. C
    Grant the primitive Owner role (roles/owner) to the service account used by the deployment pipeline to bypass control plane network access limitations.
  4. D
    Assign the Service Account Admin role (roles/iam.serviceAccountAdmin) to the deployment runner service account so it can modify IAM policies dynamically during deployment.

Cevap

Configure Control Plane Authorized Networks on the private GKE cluster to allow traffic specifically from the CI/CD deployment runner IP addresses.
Configuring Control Plane Authorized Networks allows platform teams to specify exact public IP ranges (such as those belonging to CI/CD deployment systems) authorized to access the private GKE cluster's API endpoint, fulfilling both security and deployment automation requirements.

Adım Adım Çözüm

1
Identify the root cause of the deployment connection failure.
The private GKE cluster control plane endpoint blocks inbound traffic originating from unauthorized external IP addresses.
Private GKE clusters restrict control plane API access by default to protect cluster administration endpoints.
2
Evaluate secure access options that maintain security boundaries and least privilege.
Configuring Control Plane Authorized Networks allows specific CIDR ranges (the CI/CD runner IPs) to reach the API server without exposing it to the open internet.
This balances pipeline automation requirements with robust perimeter security best practices on GCP.

Anahtar Kavram

Advising Development and Operation Teams on Private GKE Cluster Control Plane Access
Bu soruyu puanla

Konular

Advising Development and Operation Teams

Bu konudan daha fazla soru