Gke Config Sync Gitops Multi Cluster Encryption

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your enterprise operates a hybrid and multi-cloud infrastructure consisting of multiple Google Kubernetes Engine (GKE) clusters managed under a centralized fleet. You are implementing a GitOps continuous delivery workflow using Config Sync and Kustomize to continuously enforce declarative cluster configurations, network policies, and security baselines across all environments.

Your security team has established the following operational requirements:

All inter-node data plane traffic across the multi-cluster fleet must have transparent in-transit encryption enabled.
Declarative configuration drift must be automatically reconciled from a centralized Git repository.
Cross-cluster node communication spanning distinct VPC subnets must be supported without communication failures or policy conflicts.

Which configuration strategy should you implement?

Configure Eventarc triggers to monitor Pub/Sub topics and execute gcloud container clusters update commands to apply runtime encryption whenever configuration drift is detected.

Configure Config Sync with Kustomize overlays targeting Standard GKE clusters with Dataplane V2 inter-node transparent encryption enabled, ensure total fleet nodes remain under 500, avoid FQDN network policies, and declaratively maintain cross-subnet firewall rules.

Grant the Kubernetes Engine Default Node Service Agent the securitycentermanagement.admin role, and deploy Config Sync to push Packet Mirroring and Pod CIDR-based VPC firewall policies to all clusters.

Deploy GKE Autopilot clusters across all environments, configure Config Sync to sync an unstructured repository, and enable FQDN network policies alongside inter-node transparent encryption.

Professional Cloud DevOps Engineer

Gke Config Sync Gitops Multi Cluster Encryption

Related questions