Google Professional Cloud Network Engineer Question 298
Select 3Google Cloud PlatformYou are tasked with setting up a GKE (Google Kubernetes Engine) cluster in a Shared VPC environment. The DevOps team needs the cluster nodes to use a subnet from the Shared VPC in a host project, while the cluster itself resides in a service project. Which of the following steps are required to properly configure this setup?
- A
Grant the 'compute.networkUser' role on the subnet in the host project to the GKE service account in the service project.
- B
Ensure that the Shared VPC is enabled on the host project before creating the cluster.
- C
Grant the 'Kubernetes Engine Admin' role to the service account of the host project.
- D
Specify the subnet from the host project when creating the GKE cluster in the service project.
- E
Create a firewall rule in the host project to allow communication between the control plane and the nodes.
Show answer and explanation
Correct answers: A, B, D
Explanation
To set up a GKE cluster in a Shared VPC environment, the subnet from the host project must be explicitly specified, and the GKE service account in the service project needs the 'compute.networkUser' role on that subnet. Additionally, the Shared VPC must be enabled on the host project. These configurations ensure that the cluster nodes can properly use the Shared VPC resources. The 'Kubernetes Engine Admin' role and manual firewall rules are not required for this specific scenario.
- A. Correct.
Correct: The GKE service account in the service project must have the 'compute.networkUser' role on the subnet in the host project to use the subnet for the cluster nodes.
- B. Correct.
Correct: The Shared VPC must be enabled on the host project before resources in the service project can use it.
- C. Incorrect.
Incorrect: The 'Kubernetes Engine Admin' role is not required for the host project service account. This role is generally granted to users or service accounts managing the GKE cluster itself.
- D. Correct.
Correct: When creating the GKE cluster in the service project, you need to explicitly specify the subnet from the host project for the cluster nodes.
- E. Incorrect.
Incorrect: While firewall rules are important for communication, GKE automatically manages the necessary rules for control plane and node communication in Shared VPC setups.