Google Professional Cloud Network Engineer Question 328
Select 3Google Cloud PlatformYou are deploying a new application in Google Kubernetes Engine (GKE) that handles sensitive customer data. To ensure compliance with your organization's security policies, you need to restrict traffic between certain pods in the cluster. You plan to use GKE Network Policies to accomplish this. Which of the following steps are required to successfully create and apply a network policy in GKE?
- A
Enable the Network Policy feature in the GKE cluster during cluster creation or upgrade.
- B
Install a third-party network policy controller, such as Calico, in the GKE cluster.
- C
Define a NetworkPolicy resource in a Kubernetes YAML file to specify ingress and egress rules.
- D
Ensure all pods involved in the policy have the correct labels that match the NetworkPolicy selectors.
- E
Set up an external load balancer to enforce the network policy rules.
Show answer and explanation
Correct answers: A, C, D
Explanation
To create and apply GKE Network Policies, you must first enable the Network Policy feature in the cluster. Then, you define the policies in YAML files using the NetworkPolicy resource, specifying ingress and egress rules. Finally, pod labels must align with the selectors defined in the NetworkPolicy for the rules to take effect. External load balancers or third-party controllers are not required for basic GKE Network Policy functionality.
- A. Correct.
Correct: GKE clusters need the Network Policy feature enabled during cluster creation or upgrade to support Kubernetes NetworkPolicy resources.
- B. Incorrect.
Incorrect: GKE has built-in support for Network Policies, so you do not need to install a third-party controller unless you require additional features not provided by GKE.
- C. Correct.
Correct: Network Policies are created as Kubernetes resources using YAML configurations, which define ingress and/or egress rules.
- D. Correct.
Correct: Network Policies use pod labels to determine which pods the rules apply to. Without proper labeling, the policy will not function as intended.
- E. Incorrect.
Incorrect: Network Policies are enforced at the pod network level within the cluster and do not depend on external load balancers.