Google Professional Cloud Network Engineer Question 305
Single answerGoogle Cloud PlatformYou are managing a GKE cluster for your organization's development team. For security purposes, you need to restrict access to the Kubernetes API server (control plane) of the cluster so that only specific IP ranges can interact with it. How can you achieve this?
- A
Configure authorized networks for the cluster's control plane using the GCP Console or gcloud CLI.
- B
Configure Kubernetes Network Policies to restrict access to the control plane.
- C
Deploy a firewall rule to block all traffic to the control plane except for specific IP ranges.
- D
Modify the kubeconfig file to include only the allowed IP ranges.
Show answer and explanation
Correct answer: A
Explanation
To restrict access to the Kubernetes API server (control plane), you must configure authorized networks, which define specific IP ranges that are allowed to connect to the control plane. This can be done using the GCP Console or the gcloud CLI. Other options, such as using Network Policies, firewall rules, or modifying kubeconfig, do not achieve this objective.
- A. Correct.
This is correct. Configuring authorized networks for the Kubernetes API server (control plane) allows you to restrict access to only specific IP ranges. This can be done using the GCP Console or the gcloud CLI.
- B. Incorrect.
This is incorrect. Kubernetes Network Policies are used to control traffic between Pods within the cluster and cannot restrict access to the Kubernetes control plane.
- C. Incorrect.
This is incorrect. Firewall rules alone cannot control access to the Kubernetes API server. Authorized networks are the appropriate method for this purpose.
- D. Incorrect.
This is incorrect. Modifying the kubeconfig file does not restrict access to the control plane but instead configures how a client interacts with it.