Google Professional Cloud Network Engineer Question 324
Single answerGoogle Cloud PlatformYour organization has deployed a Google Kubernetes Engine (GKE) cluster for hosting internal microservices. The pods require outbound internet access to retrieve necessary libraries, but the organization's security policy mandates that all outbound traffic must use a specific external IP for identification and compliance. You need to configure this setup. What should you do?
- A
Configure a Cloud NAT with a static external IP and associate it with the GKE cluster's subnet.
- B
Enable IP Masquerade on the GKE cluster and define the specific external IP for outbound traffic.
- C
Manually assign the specific external IP to each pod's configuration.
- D
Use a firewall rule to allow egress traffic from the cluster and specify the external IP.
Show answer and explanation
Correct answer: A
Explanation
To meet the requirement of using a specific external IP for outbound internet traffic, you should configure a Cloud NAT with a static external IP and associate it with the GKE cluster's subnet. Cloud NAT allows GKE workloads to access the internet securely and ensures all egress traffic uses the assigned external IP. IP Masquerade is typically used for managing internal traffic NAT rules, and manual assignment of external IPs or using firewall rules is not a valid solution in this scenario.
- A. Correct.
This is the correct choice because Cloud NAT can be configured with a static external IP, and it ensures outbound traffic from the GKE cluster uses this IP while maintaining scalability and security.
- B. Incorrect.
This is incorrect. IP Masquerade allows customization of source IP NAT for internal traffic but does not directly assign a specific external IP for outbound internet access.
- C. Incorrect.
This is incorrect. Assigning external IPs manually to pods is not a valid or scalable method and is not supported by GKE.
- D. Incorrect.
This is incorrect. Firewall rules in Google Cloud control traffic permissions but do not control or assign specific external IPs for egress traffic.