Google Professional Cloud Network Engineer Question 308
Select 2Google Cloud PlatformYou are managing a Google Kubernetes Engine (GKE) cluster and need to restrict access to the control plane endpoint to specific IP ranges for security purposes. Which of the following steps must you take to configure authorized networks for the cluster control plane endpoint?
- A
Use the gcloud command to update the cluster with the --master-authorized-networks flag.
- B
Modify the cluster's VPC firewall rules to allow traffic only from the specified IP ranges to the control plane.
- C
Enable the 'Private Cluster' option to automatically configure authorized networks.
- D
Include the IP ranges in the 'authorizedNetworks' field when creating or updating the cluster.
- E
Ensure the IP ranges are publicly routable and do not overlap with the cluster's private IP range.
Show answer and explanation
Correct answers: A, D
Explanation
To restrict access to the GKE cluster control plane, you must configure authorized networks either at creation or through an update. This involves specifying the allowed IP ranges using the --master-authorized-networks flag in the gcloud command or by defining them in the 'authorizedNetworks' field. Modifying VPC firewall rules or enabling private clusters addresses other aspects of security but does not directly configure authorized networks for the control plane.
- A. Correct.
Correct. The --master-authorized-networks flag is used with the gcloud command to specify the IP ranges allowed to access the cluster control plane.
- B. Incorrect.
Incorrect. Modifying VPC firewall rules does not restrict access to the cluster control plane endpoint, as this is managed at the cluster level.
- C. Incorrect.
Incorrect. Enabling 'Private Cluster' restricts the control plane to private access but does not configure authorized networks for public control plane access.
- D. Correct.
Correct. The 'authorizedNetworks' field is where you explicitly define the IP ranges allowed to access the control plane when creating or updating the cluster.
- E. Incorrect.
Incorrect. While IP ranges must be publicly routable, ensuring they do not overlap with the private IP range is not a requirement for configuring authorized networks.