Google Professional Cloud Network Engineer Question 285
Select 3Google Cloud PlatformYou have been tasked with deploying a Google Kubernetes Engine (GKE) cluster for a production workload. The workload requires high availability, private cluster networking, and secure access from on-premises systems. Which of the following configurations should you implement when setting up the cluster?
- A
Enable private Google access and configure a Cloud NAT for the cluster.
- B
Deploy the cluster in multiple regions and use a multi-zonal configuration.
- C
Enable Kubernetes API server authorized networks and restrict access to your on-premises CIDR ranges.
- D
Use a public endpoint for the GKE API to simplify access from on-premises systems.
- E
Enable VPC-native (alias IP) networking for the cluster.
Show answer and explanation
Correct answers: A, C, E
Explanation
To meet the requirements of high availability, private networking, and secure access for a production GKE cluster, you should enable private Google access with Cloud NAT to allow secure internet access, configure Kubernetes API server authorized networks to limit access to your on-premises CIDR ranges, and enable VPC-native networking to streamline integration with Google Cloud networks. These configurations align with best practices for deploying secure and reliable GKE clusters in production environments.
- A. Correct.
Correct: Enabling private Google access and configuring a Cloud NAT ensures that the nodes and workloads within the private cluster can access the internet for essential operations (e.g., pulling container images) without exposing the nodes to the public internet.
- B. Incorrect.
Incorrect: While deploying clusters across multiple regions can improve fault tolerance, it is not a recommended practice for GKE high availability. A better approach is to use a multi-zonal configuration (within the same region) to distribute workloads across zones.
- C. Correct.
Correct: Enabling Kubernetes API server authorized networks and restricting access to specific CIDR ranges (like your on-premises network) ensures secure and controlled access to the cluster's API server.
- D. Incorrect.
Incorrect: A public endpoint for the GKE API introduces unnecessary exposure to the cluster, which could lead to security vulnerabilities. For production workloads, private endpoints are recommended.
- E. Correct.
Correct: Enabling VPC-native (alias IP) networking is a best practice for GKE clusters as it improves IP address allocation, allows better integration with Google Cloud VPCs, and simplifies network management.