Google Associate Cloud Engineer Question 198
Select 2Google Cloud PlatformYou are managing a Google Kubernetes Engine (GKE) cluster and need to configure it to pull container images from the Google Artifact Registry. Which of the following steps are necessary to ensure that your GKE cluster can access the Artifact Registry?
- A
Grant the GKE node service account the 'artifactregistry.reader' role for the appropriate project.
- B
Add the Artifact Registry's URL to the GKE cluster's allowed egress IPs.
- C
Configure the GKE cluster to use a static IP address for outbound connections.
- D
Ensure that the GKE cluster's VPC network is peered with the Artifact Registry's network.
- E
Enable the Artifact Registry API in the Google Cloud project where the GKE cluster is deployed.
Show answer and explanation
Correct answers: A, E
Explanation
To allow a GKE cluster to access images from the Artifact Registry, the GKE node service account must have the appropriate IAM permissions, specifically the 'artifactregistry.reader' role, to pull images. Additionally, the Artifact Registry API must be enabled in the project to use its features. Networking configurations such as egress IP adjustments, static IP settings, or VPC peering are not needed for this purpose.
- A. Correct.
Granting the 'artifactregistry.reader' role to the GKE node service account allows the nodes to authenticate and pull images from the Artifact Registry.
- B. Incorrect.
There is no need to modify egress IPs for accessing Artifact Registry as long as the correct permissions are set.
- C. Incorrect.
Using a static IP for outbound connections is not required for accessing Artifact Registry.
- D. Incorrect.
VPC peering is not necessary between the GKE cluster's network and the Artifact Registry.
- E. Correct.
Enabling the Artifact Registry API is a prerequisite for using the service within a Google Cloud project.