GCP-CLOUD-ARCHITECT practice question 1 of 10

Your organization uses Google Kubernetes Engine (GKE) and Amazon Elastic Kubernetes Service (EKS) to manage a complex Kubernetes environment across…

Domain Managing implementation

Your organization uses Google Kubernetes Engine (GKE) and Amazon Elastic Kubernetes Service (EKS) to manage a complex Kubernetes environment across multiple cloud providers. You need to deploy a solution that streamlines configuration management, enforces security policies, and ensures consistent application deployment across all of the environments. You want to follow Google- recommended practices. What should you do?

Answer options

A: Leverage Argo CD for GitOps-based continuous delivery and Open Policy Agent (OPA) for policy enforcement, and develop a controller for multi-cluster configuration management.

B: Deploy Customize for configuration customization. Config Sync with multiple Git repositories, and a script to enforce security policies.

C: Utilize Config Sync as part of GKE to synchronize configurations from a centralized repository, and utilize Policy Controller to enforce policies using OPA Gatekeeper. Correct answer

D: Deploy Crossplane for managing cloud resources as Kubernetes objects. FluxCD for GitOps-based configuration synchronization, and Kyverno for policy enforcement.

Correct Answer:

C. Utilize Config Sync as part of GKE to synchronize configurations from a centralized repository, and utilize Policy Controller to enforce policies using OPA Gatekeeper.

Explanation

The Google-recommended practice for managing configuration and policy across a multi-cloud Kubernetes environment (GKE and EKS) is to use the components of GKE Enterprise. Config Sync enables GitOps-style configuration management, automatically synchronizing cluster configurations from a central Git repository to ensure consistency. Policy Controller, a managed service based on OPA Gatekeeper, allows for the creation and enforcement of centralized policies across all connected clusters. This combination provides a robust, declarative, and consistent approach to multi-cluster governance.

Why Incorrect

A. This option involves developing a custom controller, which is not a managed, Google-recommended practice and adds significant development and maintenance overhead.
B. Relying on a custom script for security policy enforcement is not a scalable or reliable solution compared to a dedicated policy engine like Policy Controller.
D. While FluxCD and Kyverno are valid open-source tools, Config Sync and Policy Controller are the specific, integrated, and managed solutions recommended by Google for this use case.

References

1. Google Cloud Documentation, "Config Sync overview". This document states, "Config Sync lets you use a common configuration for all your clusters... You can also use Config Sync with Anthos clusters on AWS [EKS]."

2. Google Cloud Documentation, "Policy Controller overview". This document explains that Policy Controller "enforces programmable policies for your clusters" and is "based on the open source Open Policy Agent (OPA) Gatekeeper project."

3. Google Cloud Solutions, "Modern CI/CD with GKE Enterprise". This guide details how Config Sync and Policy Controller are integral parts of a secure software supply chain, providing "centralized configuration" and "enforceable policies" for multi-cluster environments.

Keep practicing

Take the free GCP-CLOUD-ARCHITECT practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test