Google Professional Cloud DevOps Engineer Question 207
Select 2Google Cloud PlatformYour company is using Google Cloud's Artifact Registry to store and manage container images. You have been tasked with setting up a secure process for deploying containerized applications to Google Kubernetes Engine (GKE). Which steps should you take to ensure that GKE nodes can securely pull images from your private Artifact Registry repository?
- A
Grant the Artifact Registry Reader role to the GKE node service account.
- B
Enable the Artifact Registry API in your Google Cloud project.
- C
Use the gcloud auth configure-docker command to authenticate GKE nodes.
- D
Ensure that the Artifact Registry repository and GKE cluster are in the same region.
- E
Add a Docker authentication key file to your Kubernetes cluster as a Secret.
Show answer and explanation
Correct answers: A, B
Explanation
To securely pull images from Artifact Registry to GKE, you need to grant the GKE node service account the appropriate IAM permissions (e.g., Artifact Registry Reader) and ensure that the Artifact Registry API is enabled in your project. These steps allow GKE nodes to authenticate and access private repositories seamlessly, leveraging Google's integrated IAM system.
- A. Correct.
Correct. Granting the Artifact Registry Reader role to the GKE node service account allows the nodes to securely pull images from the private repository.
- B. Correct.
Correct. The Artifact Registry API must be enabled in the project to use its features, including hosting and accessing images.
- C. Incorrect.
Incorrect. The gcloud auth configure-docker command is used for local development machines to configure Docker authentication, not for GKE nodes.
- D. Incorrect.
Incorrect. While it is recommended to keep resources like Artifact Registry and GKE geographically close to reduce latency, it is not a security or functional requirement for pulling images.
- E. Incorrect.
Incorrect. While Docker authentication key files can be used in some Kubernetes setups, they are unnecessary when using Google Cloud services like Artifact Registry and GKE with proper IAM configuration.