Google Professional Cloud Network Engineer Question 297
Select 3Google Cloud PlatformYou are setting up a Google Kubernetes Engine (GKE) cluster in a project that is part of a Shared VPC architecture. The Shared VPC is hosted in a separate project managed by your networking team. The GKE cluster must use a subnet from the Shared VPC. What steps are required to ensure the GKE cluster can be successfully created and function properly?
- A
Grant the GKE service account the 'Compute Network User' role on the Shared VPC host project.
- B
Ensure the Shared VPC subnet you want to use is in the same region as the GKE cluster.
- C
Enable the 'Kubernetes Engine API' in both the Shared VPC host project and the service project.
- D
Grant the GKE service account the 'Kubernetes Engine Admin' role on the service project.
- E
Create a firewall rule in the Shared VPC host project to allow traffic between the GKE cluster and the control plane.
Show answer and explanation
Correct answers: A, B, E
Explanation
To create a GKE cluster using a subnet from a Shared VPC, the service account for GKE must be granted the 'Compute Network User' role on the Shared VPC host project. Additionally, the subnet must be in the same region as the cluster, and appropriate firewall rules need to be created in the Shared VPC host project to ensure communication between the GKE cluster and the Kubernetes control plane. While enabling the 'Kubernetes Engine API' is necessary, it is only required in the service project where the cluster is being created, not in the Shared VPC host project.
- A. Correct.
Correct. The GKE service account requires the 'Compute Network User' role on the Shared VPC host project to use the subnet for the cluster.
- B. Correct.
Correct. Subnets used by GKE clusters must be in the same region as the cluster itself.
- C. Incorrect.
Incorrect. The 'Kubernetes Engine API' only needs to be enabled in the service project, not in the Shared VPC host project.
- D. Incorrect.
Incorrect. The 'Kubernetes Engine Admin' role is not required for setting up the cluster with a Shared VPC. It is used for cluster management, not VPC access.
- E. Correct.
Correct. Firewall rules must be configured in the Shared VPC host project to allow communication between the GKE cluster (created in the service project) and the Kubernetes control plane.