Google Professional Cloud Network Engineer Question 295
Select 3Google Cloud PlatformYou are setting up a Kubernetes cluster in Google Kubernetes Engine (GKE) using a Shared VPC. The cluster nodes and control plane need to communicate securely using private IPs, and you want to ensure that the cluster resides in a Service Project while leveraging the network resources from a Host Project. Which of the following are required steps to set this up correctly?
- A
Enable the Shared VPC feature in the Host Project and attach the Service Project to it.
- B
Grant the 'Compute Network User' IAM role on the Host Project to the Service Project's service account.
- C
Configure the GKE cluster in the Service Project to use Private Google Access.
- D
Grant the 'Kubernetes Engine Admin' IAM role on the Host Project to the Service Project's service account.
- E
Assign a subnet from the Host Project's Shared VPC to the GKE cluster in the Service Project.
Show answer and explanation
Correct answers: A, B, E
Explanation
To set up a GKE cluster in a Service Project using a Shared VPC, you must enable the Shared VPC feature in the Host Project and attach the Service Project to it. You also need to grant the 'Compute Network User' IAM role to the Service Project's service account, enabling it to use the Host Project's network resources. Additionally, you must assign a subnet from the Shared VPC in the Host Project to the GKE cluster in the Service Project. These steps ensure proper integration between the Service Project's GKE resources and the Host Project's Shared VPC.
- A. Correct.
Correct: Enabling the Shared VPC in the Host Project and attaching the Service Project is a fundamental requirement to use network resources from the Host Project.
- B. Correct.
Correct: The 'Compute Network User' role is required to allow the Service Project to use subnets and other network resources from the Host Project.
- C. Incorrect.
Incorrect: While Private Google Access is important for private communication, it is configured at the subnet level and is not a mandatory step specific to setting up a Shared VPC-enabled GKE cluster.
- D. Incorrect.
Incorrect: The 'Kubernetes Engine Admin' role is not required on the Host Project. This role is typically needed in the Service Project to manage GKE resources.
- E. Correct.
Correct: Assigning a subnet from the Shared VPC in the Host Project to the GKE cluster is necessary to allow the cluster to use the Host Project's networking resources.