Google Professional Cloud Network Engineer Question 326
Single answerGoogle Cloud PlatformYou are managing a Google Kubernetes Engine (GKE) cluster for your organization. The cluster runs several microservices, and you want to ensure that the 'frontend' pods can only communicate with the 'backend' pods over port 8080. All other forms of communication between pods in the cluster should be denied. Which approach should you take to implement this requirement?
- A
Create a GKE network policy that allows traffic from pods with the 'frontend' label to pods with the 'backend' label on port 8080, and ensure no other policies allow broader access.
- B
Create a firewall rule in Google Cloud to allow traffic between the 'frontend' and 'backend' pods over port 8080.
- C
Use Kubernetes pod security policies to restrict communication between pods in the cluster.
- D
Create a GKE network policy that denies all traffic by default and then explicitly allows traffic from 'frontend' pods to 'backend' pods on port 8080.
Show answer and explanation
Correct answer: A
Explanation
GKE network policies are the correct tool for controlling pod-to-pod communication in a Kubernetes cluster. They allow you to define rules based on pod labels, namespaces, and ports. By creating a network policy that allows traffic from 'frontend' to 'backend' pods on port 8080, you can enforce the required restriction while GKE's default deny behavior ensures no unintended traffic is allowed.
- A. Correct.
This is the correct approach. GKE network policies provide fine-grained control over pod-to-pod communication in a cluster. By creating a policy that explicitly allows traffic from 'frontend' to 'backend' on port 8080, you achieve the desired restriction while denying all other traffic by default.
- B. Incorrect.
Firewall rules in Google Cloud operate at the network level, not at the Kubernetes pod level. While they can control VM-level traffic, they cannot implement restrictions specific to pod labels.
- C. Incorrect.
Pod security policies are used for controlling security-related aspects of pods, such as privilege escalation and volume usage, but they do not manage network traffic.
- D. Incorrect.
While denying all traffic by default is a good practice, GKE network policies are already deny-by-default unless explicitly allowed. Adding an explicit deny rule is redundant in this case.