Examkin

Question

Difficulty: Very hardDeploying and Managing Google Kubernetes Engine (GKE) Clusters and Workloads

An administrator needs to configure Workload Identity on a Google Kubernetes Engine (GKE) cluster to allow a pod to access Cloud Storage without downloading service account keys. Arrange the steps in the correct operational sequence from first to last to complete this configuration.

  1. 1Create a Google Service Account (GSA) in IAM and assign the required IAM permissions to it.
  2. 2Create a Kubernetes Service Account (KSA) inside the target GKE cluster namespace.
  3. 3Add the `roles/iam.workloadIdentityUser` IAM binding on the GSA to grant access to the KSA principal.
  4. 4Annotate the KSA with the email address of the created GSA (`iam.gke.io/gcp-service-account=GSA_EMAIL`).
  5. 5Deploy the application workload manifest configured with `spec.template.spec.serviceAccountName` set to the KSA name.

Answer

The correct operational sequence is: 1) Create the Google Service Account (GSA) in IAM and grant required IAM roles. 2) Create the Kubernetes Service Account (KSA) in the GKE namespace. 3) Add the roles/iam.workloadIdentityUser IAM binding on the GSA for the KSA principal. 4) Annotate the KSA with the GSA email address. 5) Deploy the application workload specifying the KSA in the pod specification.
To securely grant GKE workloads access to GCP services via Workload Identity without exportable keys, you must first establish the GCP IAM identity (GSA), create the cluster identity (KSA), bind the KSA to the GSA using the `roles/iam.workloadIdentityUser` IAM role, annotate the KSA with the GSA email, and finally deploy the workload referencing the KSA in its pod specification.

Step-by-Step Solution

1
Provision the IAM Google Service Account
A GSA identity with specific GCP resource access permissions is created.
GCP resource permissions (such as Storage Object Viewer) must be attached to a Google Cloud IAM identity.
2
Provision the Kubernetes Service Account in GKE
A KSA identity is registered inside the cluster's target namespace.
Pods running inside GKE authenticate internally using Kubernetes Service Accounts.
3
Configure the IAM Workload Identity User policy binding
The GSA authorizes the GKE Workload Identity member principal `serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]` to impersonate it.
IAM must explicitly permit the specific cluster KSA principal to assume the identity of the GSA.
4
Annotate the KSA with the GSA email address
The metadata annotation `iam.gke.io/gcp-service-account` is added to the KSA.
The GKE metadata server reads this annotation to map token requests from pods using this KSA to the correct GSA.
5
Deploy the workload referencing the KSA
Pods run with the KSA specified under `spec.template.spec.serviceAccountName` and obtain short-lived OAuth 2.0 access tokens.
The workload specification links pod execution to the configured identity mapping.

Key Concept

Configuring Workload Identity in Google Kubernetes Engine
Rate this question

Topics

Deploying and Managing Google Kubernetes Engine (GKE) Clusters and Workloads