Google Associate Cloud Engineer Question 195
Select 2Google Cloud PlatformYou are tasked with configuring your Google Kubernetes Engine (GKE) cluster to pull container images from Google Artifact Registry. Which steps must you perform to ensure that your GKE nodes have the necessary permissions to access Artifact Registry?
- A
Create a new service account with the 'Artifact Registry Reader' role and attach it to your GKE nodes.
- B
Enable the Artifact Registry API in your Google Cloud project.
- C
Add the 'Artifact Registry Reader' role to the default Compute Engine service account used by GKE nodes.
- D
Configure a network policy in GKE to allow traffic to Artifact Registry.
- E
Set up a VPN connection between your GKE cluster and Artifact Registry.
Show answer and explanation
Correct answers: B, C
Explanation
To allow GKE nodes to pull images from Artifact Registry, you must enable the Artifact Registry API in your Google Cloud project. Additionally, you need to grant the 'Artifact Registry Reader' role to the service account used by your GKE nodes. This ensures that the GKE nodes have the necessary permissions to access and pull images from Artifact Registry. Network policies and VPN connections are not relevant to this configuration.
- A. Incorrect.
Creating a new service account is not necessary as you can use the default Compute Engine service account with the appropriate roles.
- B. Correct.
Enabling the Artifact Registry API is required so that your project can interact with Artifact Registry.
- C. Correct.
The default Compute Engine service account typically requires additional roles like 'Artifact Registry Reader' to pull images.
- D. Incorrect.
Network policies in GKE are used for controlling traffic between pods and are not related to accessing Artifact Registry.
- E. Incorrect.
A VPN connection is not needed as Artifact Registry can be accessed over the public internet by default.