Google Professional Cloud Network Engineer Question 322
Select 2Google Cloud PlatformYou are designing a Google Kubernetes Engine (GKE) cluster for a workload that needs to communicate with external APIs on the internet. The external APIs require requests to originate from a fixed set of IP addresses. You want to configure Source NAT (SNAT) using IP Masquerade policies to ensure that the workload's outgoing traffic uses a specific range of IP addresses. Which of the following actions should you take to meet the requirement?
- A
Create a Cloud NAT gateway with a specific range of external IP addresses and associate it with the GKE cluster.
- B
Enable IP Masquerading in the GKE cluster to translate pod IP addresses into node IP addresses.
- C
Configure an IP Masquerade policy to exclude the pod CIDR range from masquerading.
- D
Specify a custom route table for the GKE cluster to route traffic through a virtual machine acting as a NAT gateway.
- E
Add an annotation to your Kubernetes services to specify public IP addresses for outgoing traffic.
Show answer and explanation
Correct answers: A, B
Explanation
To ensure outgoing traffic from a GKE cluster uses a fixed range of external IP addresses, you need a Cloud NAT gateway with the desired IP range. Additionally, IP Masquerading must be enabled to translate pod IP addresses into node IP addresses, allowing outgoing traffic to be routed through the Cloud NAT gateway. Misconfigured IP Masquerade policies or relying on other network components (e.g., custom route tables or service annotations) will not achieve the desired outcome.
- A. Correct.
This is correct because creating a Cloud NAT gateway with a specific range of external IP addresses ensures outgoing traffic is routed through the selected IP range.
- B. Correct.
This is correct because enabling IP Masquerading ensures that pod traffic is translated to node IP addresses, making it compatible with Cloud NAT.
- C. Incorrect.
This is incorrect because excluding the pod CIDR range from masquerading would prevent proper translation of pod IPs to node IPs, causing traffic to fail.
- D. Incorrect.
This is incorrect because custom route tables are not required for GKE clusters with Cloud NAT, as routing is managed by Google Cloud.
- E. Incorrect.
This is incorrect because Kubernetes service annotations control service-specific traffic but do not affect outgoing traffic from pods.