Google Professional Cloud Network Engineer Question 321
Single answerGoogle Cloud PlatformYou are configuring a Kubernetes cluster on Google Kubernetes Engine (GKE) to allow Pods in a private cluster to communicate with external services on the internet. The cluster is configured with private nodes and uses Cloud NAT for internet access. You want to ensure that Pods use the node’s primary internal IP address for SNAT when accessing external services. Which configuration step should you take?
- A
Enable IP Masquerade agent and configure it to exclude the Pod IP CIDR range from SNAT.
- B
Disable IP Masquerade agent and configure Cloud NAT to handle all outbound traffic.
- C
Enable IP Masquerade agent and configure it to apply SNAT for all traffic, including traffic to private IP ranges.
- D
Use a dedicated external IP address pool in Cloud NAT for all Pods.
Show answer and explanation
Correct answer: A
Explanation
In private GKE clusters, Pods usually communicate with external services by using SNAT through Cloud NAT. By enabling the IP Masquerade agent and excluding the Pod IP CIDR range from SNAT, the Pods’ traffic is correctly routed through the node's primary internal IP address, which is then handled by Cloud NAT for internet access. This approach ensures efficient and consistent routing of outbound traffic.
- A. Correct.
Correct. Enabling the IP Masquerade agent and excluding the Pod IP CIDR range ensures that Pods use the node’s primary internal IP for SNAT, allowing proper outbound traffic routing via Cloud NAT.
- B. Incorrect.
Incorrect. Disabling the IP Masquerade agent would prevent the configuration of SNAT rules, leading to potential routing issues for outbound traffic.
- C. Incorrect.
Incorrect. Configuring SNAT for all traffic, including traffic to private IP ranges, would unnecessarily masquerade traffic that does not require SNAT.
- D. Incorrect.
Incorrect. Using a dedicated external IP address pool in Cloud NAT is not required in this scenario because Cloud NAT can already use the node's primary internal IP for outbound traffic.