Google Professional Cloud Network Engineer Question 303
Select 3Google Cloud PlatformYou are deploying a Google Kubernetes Engine (GKE) private cluster for your organization's production environment. The cluster must meet the following requirements:
- The control plane should not be exposed to the public internet.
- Nodes should communicate with the control plane privately using internal IPs.
- Developers should be able to access the Kubernetes API from a secure on-premises network using a private endpoint.
Which of the following steps must you take to properly configure the private cluster to meet these requirements?
- A
Enable the private endpoint for the cluster's control plane.
- B
Disable public endpoint access for the control plane.
- C
Enable IP aliasing for the GKE cluster.
- D
Set up a VPN or Interconnect between your on-premises network and the Google Cloud VPC hosting the cluster.
- E
Configure a NAT gateway for internet access from the cluster's nodes.
Show answer and explanation
Correct answers: A, B, D
Explanation
To configure a private GKE cluster with a private control plane endpoint, you must enable the private endpoint, disable public endpoint access, and establish a secure connection (e.g., VPN or Interconnect) between your on-premises network and the Google Cloud VPC. These steps ensure secure access to the Kubernetes API server without exposing the control plane to the public internet. Additional configurations like IP aliasing or NAT gateway setup are not directly relevant to the scenario requirements.
- A. Correct.
Correct: Enabling the private endpoint ensures that the Kubernetes API server can be accessed securely through a private IP address, meeting the requirement for private communication with the control plane.
- B. Correct.
Correct: Disabling public endpoint access ensures that the control plane is not exposed to the public internet, satisfying the security requirement.
- C. Incorrect.
Incorrect: While IP aliasing is required for GKE clusters, it is not directly related to the private control plane endpoint configuration described in this scenario.
- D. Correct.
Correct: A VPN or Interconnect is necessary to enable private communication between the on-premises network and the Google Cloud VPC, allowing secure access to the private endpoint.
- E. Incorrect.
Incorrect: Configuring a NAT gateway is not required for the control plane or API access. NAT is typically used to enable outbound internet access for the cluster's nodes, which is not mentioned as a requirement in this scenario.