Google Professional Cloud Network Engineer Question 306
Single answerGoogle Cloud PlatformYou are managing a GKE cluster for your organization. The cluster control plane is set up to allow access only from specific authorized networks for security purposes. A new office location requires connectivity to the cluster, and its public IP range is 203.0.113.0/24. How can you securely add this network to the list of authorized networks for the cluster's control plane?
- A
Use the gcloud command-line tool to update the cluster's authorized networks, specifying the new IP range.
- B
Edit the cluster's kubeconfig file directly to include the new office's IP range.
- C
Navigate to the Google Cloud Console, go to the Kubernetes Engine settings for the cluster, and add the new IP range to the authorized networks list.
- D
Restart the cluster control plane and reconfigure it to include the new IP range.
Show answer and explanation
Correct answer: A
Explanation
To securely add a new authorized network for the GKE cluster control plane, you must explicitly update the cluster configuration. The gcloud container clusters update command with the --master-authorized-networks flag is the appropriate method to achieve this. Editing kubeconfig files or restarting the control plane would not modify the authorized networks, and the Google Cloud Console does not currently provide a direct option for this task.
- A. Correct.
Correct. The gcloud command-line tool provides the ability to update the cluster's authorized networks. You can use the command
gcloud container clusters update [CLUSTER_NAME] --enable-master-authorized-networks --master-authorized-networks [CURRENT_RANGES],[NEW_RANGE]to add the new IP range. - B. Incorrect.
Incorrect. kubeconfig files are used for client authentication and do not configure the control plane's authorized networks.
- C. Incorrect.
Incorrect. While the Google Cloud Console provides an interface for managing many aspects of a cluster, adding authorized networks for the control plane is not directly configurable from the console.
- D. Incorrect.
Incorrect. Restarting the cluster control plane is unnecessary and does not allow you to configure authorized networks.