Google Professional Cloud Network Engineer Question 299
Select 3Google Cloud PlatformYou are deploying a Kubernetes cluster in Google Kubernetes Engine (GKE) in a Shared VPC environment. The cluster will be used by multiple teams, and you want to ensure proper network isolation and centralized network management. Which steps must you take to correctly set up the GKE cluster with Shared VPC?
- A
Enable Shared VPC and assign the host project.
- B
Grant the 'Network Admin' IAM role on the host project to the GKE cluster's service account.
- C
Configure the GKE cluster to use subnets from the Shared VPC in the host project.
- D
Allocate separate IP ranges for Pods and Services when configuring the cluster.
- E
Create a separate VPC for each team's workloads to ensure network isolation.
Show answer and explanation
Correct answers: A, C, D
Explanation
To set up a GKE cluster with Shared VPC, the Shared VPC must first be enabled, and the host project must be assigned. The GKE cluster should be configured to use the appropriate subnets from the Shared VPC, ensuring it inherits the network policies and centralized management benefits. Additionally, separate IP ranges for Pods and Services must be allocated to avoid conflicts and maintain proper network isolation within the Shared VPC.
- A. Correct.
Correct: Enabling Shared VPC and assigning the host project is a necessary step to set up the Shared VPC environment. This allows the GKE cluster in the service project to use resources from the host project.
- B. Incorrect.
Incorrect: Granting the 'Network Admin' IAM role to the GKE cluster's service account is not required. Instead, specific roles like 'Network User' are typically assigned to the service project to allow access to Shared VPC resources.
- C. Correct.
Correct: Configuring the GKE cluster to use subnets from the Shared VPC in the host project is crucial for leveraging the Shared VPC setup. This ensures that the cluster can access the network resources managed centrally in the host project.
- D. Correct.
Correct: Allocating separate IP ranges for Pods and Services is a best practice to avoid IP conflicts and ensure proper network functionality in the Shared VPC environment.
- E. Incorrect.
Incorrect: Creating a separate VPC for each team's workloads is not aligned with the purpose of Shared VPC. Shared VPC is designed to provide centralized network management and shared resources, eliminating the need for multiple VPCs.