Google Professional Cloud Network Engineer Question 288
Select 3Google Cloud PlatformYou are tasked with configuring a Google Kubernetes Engine (GKE) cluster for a workload that requires internal communication between pods and also needs to expose a service externally to the internet. As part of the configuration, you want to ensure the cluster is secure and highly available. Which of the following steps should you include in your configuration?
- A
Enable VPC-native (alias IP) networking for the GKE cluster.
- B
Use a public IP address for all Kubernetes nodes to simplify external access.
- C
Configure Network Policies to control traffic between pods.
- D
Deploy an HTTPS Load Balancer and expose the service using an Ingress resource.
- E
Disable authentication for the Kubernetes API to simplify cluster management.
Show answer and explanation
Correct answers: A, C, D
Explanation
To configure and maintain a Google Kubernetes Engine (GKE) cluster with internal communication, external exposure, security, and high availability, you must enable VPC-native (alias IP) networking to integrate with Google Cloud's networking features, configure Network Policies to secure pod-to-pod traffic, and use an HTTPS Load Balancer with an Ingress resource for controlled and secure external service exposure. Avoid insecure practices, such as public IPs for all nodes and disabling authentication for the Kubernetes API.
- A. Correct.
Enabling VPC-native (alias IP) networking allows for better pod-to-pod communication, IP address management, and integration with Google Cloud networking features, which is crucial for secure and efficient internal communication.
- B. Incorrect.
Using a public IP address for all nodes exposes the cluster to potential security risks. Best practice is to use private IPs for nodes and manage external access through controlled mechanisms like load balancers and Ingress.
- C. Correct.
Network Policies allow you to define fine-grained rules for traffic between pods, enhancing the security of internal communication within the cluster.
- D. Correct.
An HTTPS Load Balancer with an Ingress resource is the recommended way to expose services externally in a secure and scalable manner.
- E. Incorrect.
Disabling authentication for the Kubernetes API poses a significant security risk. Authentication should always be enabled and properly configured to protect the cluster management interface.