Examkin

Question

Difficulty: MediumConfiguring Service Account Impersonation and Workload Identity

A platform engineering team is configuring Workload Identity on a Google Kubernetes Engine (GKE) cluster to enable passwordless authentication to Google Cloud resources. A pod running in the namespace `data-pipeline` uses the Kubernetes service account `exporter-ksa` and needs to write files to Cloud Storage. The target Google service account `[email protected]` has already been assigned the Cloud Storage Object Creator role on the destination bucket. Which IAM role binding configuration is required on `storage-writer-sa` to allow the Kubernetes workload to impersonate it?

  1. Grant the Workload Identity User role (roles/iam.workloadIdentityUser) to serviceAccount:prod-analytics.svc.id.goog[data-pipeline/exporter-ksa] on storage-writer-sa.Answer
  2. B
    Export a service account JSON key file for storage-writer-sa and mount it as a Kubernetes Secret inside the data-pipeline pod.
  3. C
    Grant the Owner primitive role (roles/owner) to serviceAccount:[email protected] at the project level.
  4. D
    Grant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to the Kubernetes service account at the organization level so permissions inherit automatically.

Answer

Grant the Workload Identity User role (roles/iam.workloadIdentityUser) to serviceAccount:prod-analytics.svc.id.goog[data-pipeline/exporter-ksa] on storage-writer-sa.
To enable a GKE workload to act as a Google Service Account, GKE Workload Identity maps the Kubernetes service account to the Google service account. This is achieved by granting the `roles/iam.workloadIdentityUser` role on the target Google service account to the member formatted as `serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]`.

Step-by-Step Solution

1
Identify the principal and target resource in the GKE Workload Identity relationship
The target resource is the Google Service Account (GSA) `[email protected]`. The principal is the Kubernetes Service Account (KSA) `exporter-ksa` in namespace `data-pipeline`.
Workload Identity requires mapping a specific Kubernetes service account identity to a specific Google Cloud service account.
2
Construct the fully qualified workload identity member identifier
The member syntax is `serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]`, which evaluates to `serviceAccount:prod-analytics.svc.id.goog[data-pipeline/exporter-ksa]`.
Google Cloud IAM recognizes Kubernetes service accounts via the Workload Identity pool principal format.
3
Apply the appropriate IAM role on the target Google service account
Assign `roles/iam.workloadIdentityUser` to the KSA member on the GSA.
The Workload Identity User role grants permission to exchange KSA tokens for short-lived GSA credentials, satisfying the keyless access requirement.

Key Concept

Configuring Workload Identity bindings between Kubernetes Service Accounts (KSA) and Google Service Accounts (GSA)
Rate this question

Topics

Configuring Service Account Impersonation and Workload Identity

More questions from this topic