Google Professional Cloud DevOps Engineer Question 55
Select 3Google Cloud PlatformYour team is building a CI/CD pipeline to deploy containerized applications on Google Kubernetes Engine (GKE). They want to store and manage custom container images securely and ensure the pipeline can access the images efficiently. Which of the following actions should you take to properly configure Google Cloud’s Artifact Registry for this purpose?
- A
Create an Artifact Registry repository with the 'Docker' format in the same region as the GKE cluster.
- B
Enable the 'Artifact Registry API' in your Google Cloud project.
- C
Grant the 'Artifact Registry Reader' IAM role to the GKE cluster's service account.
- D
Configure a Cloud NAT gateway to allow the GKE cluster to pull images from Artifact Registry.
- E
Use the gcloud CLI to push container images directly to the GKE cluster instead of using Artifact Registry.
Show answer and explanation
Correct answers: A, B, C
Explanation
To securely manage and deploy container images in a GKE environment, you need to configure Artifact Registry appropriately. This involves creating a Docker-format repository in the same region for optimal performance, enabling the Artifact Registry API, and granting the necessary IAM permissions to the GKE cluster's service account. These steps ensure the pipeline can access and pull images securely and efficiently. Additional configurations, such as a Cloud NAT gateway, are unnecessary for this use case.
- A. Correct.
Correct: Creating an Artifact Registry repository with the 'Docker' format in the same region as the GKE cluster ensures low-latency access and compatibility with containerized applications.
- B. Correct.
Correct: The 'Artifact Registry API' must be enabled for the Artifact Registry to function within the Google Cloud project.
- C. Correct.
Correct: Granting the 'Artifact Registry Reader' IAM role to the GKE cluster's service account is required to allow the cluster to pull images stored in Artifact Registry.
- D. Incorrect.
Incorrect: Configuring a Cloud NAT gateway is not necessary because GKE can access Artifact Registry directly without the need for a NAT gateway.
- E. Incorrect.
Incorrect: Pushing container images directly to the GKE cluster bypasses Artifact Registry and is not a recommended practice. Artifact Registry is designed specifically for secure and efficient image storage.