An enterprise is designing a multi-tenant microservice architecture hosted on Google Kubernetes Engine (GKE). Several partner organizations need private, unidirectional access to specific backend services hosted in the enterprise's VPC. The architecture must satisfy the following technical requirements: Backend Pods in GKE must receive natively routable VPC IP addresses to enable container-native load balancing with direct Pod routing. Partner VPC networks must connect securely to the services without exposing the rest of the enterprise VPC network. Connectivity must function seamlessly even if partner VPC networks use overlapping RFC 1918 IP address spaces with the enterprise VPC. Which architecture should the cloud architect implement?

Deploy a VPC-native GKE cluster using alias IP ranges, expose the workload through an internal load balancer as a published service, and have partners connect using Private Service Connect endpoints.: What This Architecture Is This architecture combines VPC-native GKE clusters with Private Service Connect (PSC) to deliver high-performance, container-native load balancing and secure cross-VPC service publication. How It Meets the Requirements Container-Native Routing: VPC-native GKE clusters assign Pod IP addresses from secondary subnet ranges using alias IP ranges. This makes Pod IPs natively routable within the VPC and allows internal load balancers to route traffic directly to Pod network endpoint groups (NEGs) without extra node-level hops or intermediate translation. Service-Oriented Network Security: Private Service Connect creates a service-level abstraction using a producer-consumer model. Consumers in partner VPCs target a dedicated private endpoint IP in their own network, which grants access solely to the published service rather than opening access to the producer's wider VPC network. Overlapping IP Space Support: PSC relies on software-defined source network address translation (NAT) at the host machine level. Because consumer traffic is translated before entering the producer network, both networks can operate with conflicting or overlapping RFC 1918 CIDR blocks without routing collisions. Key Advantages Direct Data Path: Avoids additional kube-proxy hops by utilizing container-native load balancing directly to individual Pod endpoints. Granular Authorization: Enables explicit consumer project allowlisting and eliminates broader network exposure. Operational Simplicity: Removes the requirement to coordinate non-overlapping IP address schemes across external business partners. Line-Rate Performance: Traffic travels directly between physical compute hosts without traversing intermediate network appliances.

StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Gke Vpc Native Private Service Connect Architecture

Section: Cloud-native networking (e.g., virtual private cloud [VPC], peering, firewalls, load balancers, routing, container networking, shared VPC, and Private Service Connect)

An enterprise is designing a multi-tenant microservice architecture hosted on Google Kubernetes Engine (GKE). Several partner organizations need private, unidirectional access to specific backend services hosted in the enterprise's VPC.

The architecture must satisfy the following technical requirements:

Backend Pods in GKE must receive natively routable VPC IP addresses to enable container-native load balancing with direct Pod routing.
Partner VPC networks must connect securely to the services without exposing the rest of the enterprise VPC network.
Connectivity must function seamlessly even if partner VPC networks use overlapping RFC 1918 IP address spaces with the enterprise VPC.

Which architecture should the cloud architect implement?

...

Deploy a routes-based GKE cluster, expose the application using a NodePort Service, and configure VPC Network Peering between the enterprise VPC and partner VPCs.

...

Deploy a VPC-native GKE cluster, create an External Application Load Balancer with Cloud Armor security policies, and require partner traffic to route over the public internet.

...

Deploy a private GKE cluster configured with Cloud NAT, establish High Availability Cloud VPN tunnels to each partner VPC, and configure BGP dynamic routing.

...

Deploy a VPC-native GKE cluster using alias IP ranges, expose the workload through an internal load balancer as a published service, and have partners connect using Private Service Connect endpoints.

...

Explanations

What This Architecture Is

This architecture combines VPC-native GKE clusters with Private Service Connect (PSC) to deliver high-performance, container-native load balancing and secure cross-VPC service publication.

How It Meets the Requirements

Container-Native Routing: VPC-native GKE clusters assign Pod IP addresses from secondary subnet ranges using alias IP ranges. This makes Pod IPs natively routable within the VPC and allows internal load balancers to route traffic directly to Pod network endpoint groups (NEGs) without extra node-level hops or intermediate translation.
Service-Oriented Network Security: Private Service Connect creates a service-level abstraction using a producer-consumer model. Consumers in partner VPCs target a dedicated private endpoint IP in their own network, which grants access solely to the published service rather than opening access to the producer's wider VPC network.
Overlapping IP Space Support: PSC relies on software-defined source network address translation (NAT) at the host machine level. Because consumer traffic is translated before entering the producer network, both networks can operate with conflicting or overlapping RFC 1918 CIDR blocks without routing collisions.

Key Advantages

Direct Data Path: Avoids additional kube-proxy hops by utilizing container-native load balancing directly to individual Pod endpoints.
Granular Authorization: Enables explicit consumer project allowlisting and eliminates broader network exposure.
Operational Simplicity: Removes the requirement to coordinate non-overlapping IP address schemes across external business partners.
Line-Rate Performance: Traffic travels directly between physical compute hosts without traversing intermediate network appliances.

View source documentation

Professional Cloud Architect

Gke Vpc Native Private Service Connect Architecture

Professional Cloud Architect

Gke Vpc Native Private Service Connect Architecture

What This Architecture Is

How It Meets the Requirements

Key Advantages

Related questions

Ask Scout