Google Professional Cloud DevOps Engineer Question 40
Single answerGoogle Cloud PlatformYour organization is using Google Kubernetes Engine (GKE) to run a large-scale application. The team wants to enforce a policy that ensures all Pods in the cluster have resource limits defined (CPU and memory). Which tool or approach should you use to implement and enforce this policy?
- A
Use Kubernetes Pod Security Policies to define and enforce resource limits.
- B
Implement Open Policy Agent (OPA) with Gatekeeper to validate resource limits at the admission controller level.
- C
Write a custom Kubernetes controller to monitor and enforce resource limits on running Pods.
- D
Enable Binary Authorization in GKE to enforce resource limit policies.
Show answer and explanation
Correct answer: B
Explanation
Open Policy Agent (OPA) with Gatekeeper is the correct choice because it integrates with Kubernetes admission controllers, allowing you to define custom policies, such as ensuring Pods have resource limits. This approach is both scalable and aligns with best practices for configuration and policy management in Kubernetes environments.
- A. Incorrect.
Kubernetes Pod Security Policies are used to control security-related settings for Pods, such as privileged mode or root filesystem access. They do not handle resource limit enforcement.
- B. Correct.
Open Policy Agent (OPA) with Gatekeeper allows you to define and enforce custom policies for Kubernetes, including validating resource limits at the admission controller level before Pods are created.
- C. Incorrect.
Writing a custom Kubernetes controller is a possible solution, but it requires significant development effort and is not a best practice when existing tools like OPA and Gatekeeper can handle this requirement effectively.
- D. Incorrect.
Binary Authorization in GKE is used to enforce security policies for container images, such as ensuring only trusted images are deployed. It does not enforce resource limits.