GKE External Load Balancer with Named Ports and NEGs
Short answer
B Reference the GCE_VM_IP_PORT NEG in the backend configuration and specify the http-api named port for traffic.
Question
What should you do?
Key Takeaways
The question tests the understanding that GKE automatically creates GCE_VM_IP_PORT NEGs for services, enabling direct pod access via named ports for load balancer backends.
Learn how to configure an external HTTP(S) load balancer for GKE by using GCE_VM_IP_PORT NEGs and named ports to achieve port independence and optimal routing.
Common mistake: Choosing Option A (Node Instance Group) is a common error because it ignores the performance benefits of direct pod routing and fails to utilize the automated NEG management provided by GKE.
Expert Analysis
The scenario requires exposing a GKE microservice via an external HTTP(S) load balancer while maintaining port independence. The core principle here is the integration between Google Cloud Load Balancing and GKE using Network Endpoint Groups (NEGs).
When a Kubernetes Service of type LoadBalancer or NodePort is created in GKE, the GKE controller automatically provisions a GCE_VM_IP_PORT NEG. This NEG contains the IP addresses and ports of the individual Pods running the service endpoints. By attaching this specific NEG to the backend service of the HTTP(S) load balancer, traffic is routed directly to the Pods, bypassing the node network layer for lower latency.
To ensure port independence, the named port defined in the Pod spec (http-api) must be mapped within the NEG configuration. This allows the load balancer to reference the logical name 'http-api' rather than a hardcoded numeric port (e.g., 8080). If the application port changes, only the pod specification needs updating; the load balancer configuration remains valid as long as the named port mapping persists.
Option A suggests using a node instance group, which routes traffic to nodes rather than pods, increasing latency and complexity. Option C mentions a GCE_VM_IP NEG, which is typically used for serverless or VM-based backends without port specificity, not standard GKE pod ports. Option D advocates for hardcoding the port number, which violates the requirement for port independence and best practices. Therefore, referencing the auto-created GCE_VM_IP_PORT NEG and specifying the named port is the correct approach.
Exam Strategy
When configuring GKE load balancers, always look for references to NEGs (Network Endpoint Groups). Specifically, distinguish between GCE_VM_IP (for VMs/serverless) and GCE_VM_IP_PORT (for Pods). For port independence, verify that the solution uses named port mappings within the NEG rather than hardcoded numbers.
Frequently Asked Questions
Why use GCE_VM_IP_PORT NEG instead of Node Instance Group?
What happens if the container port changes?
Community Votes
100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
ulkerra 👍 1 Answered BNEG will send traffic directly to the Pod. This will reduce latency
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All PCNE Questions
Access 80 questions with complete answers and detailed explanations.
View Full PCNE Practice Test →