Google Professional Cloud Network Engineer Question 323
Select 2Google Cloud PlatformYou are configuring a Google Kubernetes Engine (GKE) cluster in Google Cloud. The cluster has multiple workloads that need to communicate with external services on the internet. To ensure proper routing and comply with security policies, you need to configure Source NAT (SNAT) using an IP masquerade policy. Which two configurations are necessary to implement this setup correctly?
- A
Enable IP masquerading for all internal pod-to-pod traffic within the cluster.
- B
Specify non-masquerade CIDR ranges in an IP masquerade configuration file.
- C
Enable IP masquerading for traffic destined for external IP addresses.
- D
Disable IP masquerading for traffic within the cluster's VPC network.
- E
Attach a Cloud NAT gateway to the GKE cluster for external traffic.
Show answer and explanation
Correct answers: B, C
Explanation
To configure SNAT for a GKE cluster, you need to use an IP masquerade policy to control which traffic gets NATed. Specifically, you must define non-masquerade CIDR ranges to avoid SNAT for internal traffic, and you must ensure that masquerading is enabled for traffic going to external IP addresses. These configurations enable proper routing and secure communication with external services while maintaining internal communications as is.
- A. Incorrect.
Enabling IP masquerading for all internal pod-to-pod traffic is not recommended, as pod-to-pod communication within the cluster typically doesn't require SNAT and should use the original source IP for proper routing.
- B. Correct.
Specifying non-masquerade CIDR ranges in an IP masquerade configuration file is necessary to define which IP ranges should not be masqueraded (e.g., internal traffic). This is an essential part of setting up SNAT for GKE.
- C. Correct.
Enabling IP masquerading for traffic destined for external IP addresses ensures that outbound traffic to the internet uses a NATed IP address, which is a core requirement for SNAT.
- D. Incorrect.
Disabling IP masquerading for traffic within the cluster's VPC network is not a required step for configuring SNAT. In fact, this may prevent expected masquerading behavior for traffic leaving the cluster.
- E. Incorrect.
Attaching a Cloud NAT gateway is not required to configure SNAT using IP masquerade policies. Cloud NAT is a separate service for managing NAT at the VPC level, not at the cluster level.