Professional Cloud Architect · Free Practice Question Hard
Question 10
A logistics company is developing a distributed application on Google Kubernetes Engine (GKE) to manage its global operations. The application consists of microservices running in containers that need to communicate securely with each other across multiple GKE clusters in different regions. The company also requires the ability to scale the application horizontally as demand fluctuates, while ensuring minimal latency and high availability. Additionally, the company wants to ensure that its internal traffic remains private and does not traverse the public internet. Which of the following approaches would best meet the company’s requirements for container networking?
-
A
Implement GKE with VPC-native (alias IP) mode and enable Istio for service mesh, using mTLS for securing communication between services. Configure Private Service Connect to keep internal traffic private.
-
B
Use GKE with VPC-native (alias IP) mode enabled, and configure Network Policy to restrict traffic between microservices. Deploy a multi-cluster ingress controller for cross-cluster communication.
-
C
Set up each GKE cluster with its own VPC and connect them using VPC Peering. Use Calico for network policy enforcement and rely on public IPs for cross-cluster communication.
-
D
Use GKE with private clusters and enable Kubernetes Network Policy for traffic management. Rely on Google Cloud’s default routing to manage cross-region communication between clusters.
Reveal correct answer
Correct answer: A
A.
Implementing GKE with VPC-native (alias IP) mode and enabling Istio for service mesh provides a robust solution for secure, scalable, and efficient communication between microservices. Istio’s mTLS ensures encrypted communication within the service mesh, and Private Service Connect keeps internal traffic private by avoiding the public internet. This approach meets the company’s needs for security, scalability, and low latency in a multi-region, multi-cluster environment.
B.
While VPC-native mode with Network Policy is a good practice for managing microservice communication within a GKE cluster, relying on a multi-cluster ingress controller for cross-cluster communication may introduce additional complexity and does not fully address the requirement to keep internal traffic private. This approach might also fall short in handling cross-region communication securely and efficiently.
C.
Using separate VPCs for each GKE cluster connected via VPC Peering can complicate network management and does not support transitive peering, potentially leading to routing issues. Relying on public IPs for cross-cluster communication exposes internal traffic to the public internet, which goes against the company’s requirement to keep traffic private.
D.
Private clusters and Kubernetes Network Policy are useful for securing a GKE cluster, but relying on Google Cloud’s default routing does not provide sufficient control over cross-region communication. This approach may also fail to meet the company's requirements for minimal latency and secure, private communication between microservices across different regions.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
