Google Professional Cloud Network Engineer Question 302
Select 3Google Cloud PlatformYou are tasked with creating a private GKE (Google Kubernetes Engine) cluster in a project. The cluster must restrict access to its control plane to a specific set of internal IP ranges while ensuring the nodes do not have external IPs. Which of the following configurations should you apply to meet these requirements?
- A
Enable the private cluster option when creating the GKE cluster.
- B
Configure a specific CIDR range for the master authorized networks.
- C
Ensure that the nodes are created with external IPs to allow outgoing internet traffic.
- D
Set up a Cloud NAT to allow internet access for the nodes without external IPs.
- E
Disable the master authorized networks feature to make the control plane fully private.
Show answer and explanation
Correct answers: A, B, D
Explanation
To create a private GKE cluster with restricted access to the control plane and nodes without external IPs, you need to enable the private cluster feature, configure the master authorized networks with specific CIDR ranges, and use Cloud NAT to ensure nodes can access the internet without external IPs. Disabling master authorized networks is not suitable because it would prevent configuring access to the control plane for a specific set of IP ranges.
- A. Correct.
Enabling the private cluster option ensures that the nodes in the cluster do not have external IPs and the control plane is accessible only via private IPs.
- B. Correct.
Configuring a CIDR range for the master authorized networks allows you to restrict access to the control plane to specific internal IP ranges.
- C. Incorrect.
Creating nodes with external IPs would violate the requirement to have nodes without external IPs. This option is incorrect.
- D. Correct.
Setting up a Cloud NAT allows nodes without external IPs to access the internet for things like pulling container images or applying updates. This is necessary for proper functionality.
- E. Incorrect.
Disabling the master authorized networks feature would make the control plane fully private, but this would prevent the configuration of specific CIDR ranges for access, which violates the requirements. This option is incorrect.