Google Professional Cloud Network Engineer Question 34
Select 2Google Cloud PlatformYou are designing a Google Kubernetes Engine (GKE) cluster for a large-scale application that requires hundreds of pods per node and high scalability. The cluster will use VPC-native networking. Which of the following must you consider when planning the networking configuration for the cluster?
- A
Allocate sufficient secondary IP address ranges in the VPC for both pods and services.
- B
Ensure the primary VPC subnet has enough IP addresses to accommodate all pods and services.
- C
Use alias IPs to assign unique IP addresses to pods within the secondary range.
- D
Verify that the GKE control plane has private access enabled for additional security.
- E
Plan for a private Google Access configuration to allow pods to access Google APIs securely.
Show answer and explanation
Correct answers: A, C
Explanation
When planning networking for a GKE cluster with VPC-native mode, you must allocate secondary IP ranges in the VPC for pods and services. These ranges ensure that the cluster can scale efficiently while maintaining unique IP addresses for each pod. Alias IPs are used in VPC-native clusters for pod networking and are essential for scalability. The primary subnet is not used for pods or services in this configuration, and while private access configurations can enhance security, they are not directly related to the planning of secondary ranges or scaling considerations.
- A. Correct.
Correct: Allocating sufficient secondary IP address ranges to support pods and services is essential for VPC-native clusters. Without adequate ranges, the cluster will not be able to scale properly.
- B. Incorrect.
Incorrect: Pods and services in a VPC-native GKE cluster do not use the primary VPC subnet. Instead, they use the secondary IP address ranges allocated to the cluster.
- C. Correct.
Correct: Alias IPs are a key feature of VPC-native GKE clusters, allowing each pod to have a unique IP address from the allocated secondary range.
- D. Incorrect.
Incorrect: While private access to the GKE control plane can enhance security, it is not a mandatory consideration for networking design related to pod and service IP addressing.
- E. Incorrect.
Incorrect: Private Google Access is useful for accessing Google APIs securely but is not directly related to the planning of secondary ranges or GKE networking for scaling.