Google Professional Cloud Developer Question 362
Select 3Google Cloud PlatformYou are deploying a multi-tier web application to Google Kubernetes Engine (GKE). The application consists of a frontend service, a backend API, and a database. You want to ensure the following requirements are met:
- The frontend service should be accessible via a public IP address.
- The backend API should only be accessible internally by the frontend.
- The database should only be accessible to the backend API.
Which of the following configurations should you apply to meet these requirements?
- A
Expose the frontend service using a LoadBalancer type Service.
- B
Use a ClusterIP type Service for the backend API and restrict access using Network Policies.
- C
Expose the backend API using a NodePort type Service to simplify internal communication.
- D
Use a ClusterIP type Service for the database and restrict access using Network Policies.
- E
Expose the database using a LoadBalancer type Service for direct access.
Show answer and explanation
Correct answers: A, B, D
Explanation
To meet the application's requirements, the frontend service must be publicly accessible, which is achieved using a LoadBalancer type Service. The backend API and the database should remain internal to the cluster, which is best managed using ClusterIP type Services. Additionally, Network Policies can be used to enforce stricter access controls, ensuring that only the appropriate components can communicate with one another.
- A. Correct.
Correct: A LoadBalancer type Service is ideal for exposing the frontend service publicly as it provides a public IP address that routes traffic to the service.
- B. Correct.
Correct: A ClusterIP type Service ensures the backend API is only accessible within the cluster, and Network Policies can be applied to further restrict access to the frontend service.
- C. Incorrect.
Incorrect: A NodePort type Service exposes the backend API on each node's IP and a high port, which is not suitable for internal-only communication and can pose security risks.
- D. Correct.
Correct: A ClusterIP type Service ensures that the database is only accessible from within the cluster, and Network Policies can control access to allow only the backend API to communicate with it.
- E. Incorrect.
Incorrect: Exposing the database using a LoadBalancer type Service would make it publicly accessible, which is a significant security risk and does not align with the requirement to restrict database access to the backend API.