Question

A network administrator manages a Shared VPC host project. A development team in an attached service project needs to deploy a VPC-native GKE cluster that requires a dedicated primary subnet plus two secondary ranges (Pods and Services). The administrator wants to grant the development team the minimum permissions necessary to consume the networking resources while retaining full control over subnet and range creation. What should the administrator do?

Accepted Answer

Create the subnet and its secondary ranges in the host project, then grant the service project team the Compute Network User role on that specific subnet.

Answer

Grant the service project team the Compute Network Admin role at the host project level so they can create the subnet and secondary ranges themselves.

Answer

Create the subnet in the host project but instruct the team to create the secondary ranges in the service project during cluster creation.

Answer

Grant the service project team the Compute Shared VPC Admin role so they can attach ranges and deploy the cluster.