Examkin

Question

Difficulty: EasyConfiguring Service Account Impersonation and Workload Identity

What is the correct sequence of steps to configure a Kubernetes Service Account (KSA) to impersonate a Google Cloud Service Account (GSA) using GKE Workload Identity?

  1. 1Create a Google Cloud Service Account (GSA) and grant it the necessary Google Cloud IAM roles.
  2. 2Create a Kubernetes Service Account (KSA) within the GKE cluster namespace where the application workload runs.
  3. 3Allow the KSA to impersonate the GSA by granting the roles/iam.workloadIdentityUser role on the GSA to the KSA member.
  4. 4Annotate the Kubernetes Service Account with the email address of the Google Cloud Service Account.

Answer

The correct operational sequence begins with creating the Google Cloud Service Account with required permissions, followed by creating the Kubernetes Service Account in GKE, binding the Workload Identity User IAM role on the GSA to the KSA, and finally annotating the KSA with the GSA email address.
Configuring Workload Identity follows a logical top-down sequence: first provision the GCP-side Service Account with appropriate permissions, next create the GKE Kubernetes Service Account, then grant the roles/iam.workloadIdentityUser IAM role on the GSA to the KSA, and lastly annotate the KSA with the GSA email address so the GKE metadata server can exchange Kubernetes tokens for Google Cloud credentials.

Step-by-Step Solution

1
Provision the target Google Cloud Service Account (GSA)
GSA is created with the required GCP IAM permissions for backend resource access.
Before identity delegation can occur, the cloud-level service account with target permissions must exist.
2
Provision the Kubernetes Service Account (KSA)
KSA is available inside the GKE namespace.
Workloads in GKE execute under a Kubernetes identity, which requires a KSA manifest.
3
Configure the IAM Workload Identity binding
The GSA trusts the KSA principal under roles/iam.workloadIdentityUser.
This establishes the GCP security boundary permission allowing the GKE pod identity to act as the cloud service account.
4
Annotate the KSA manifest
The KSA metadata includes key iam.gke.io/gcp-service-account set to the GSA email.
The GKE metadata server reads this annotation to issue short-lived GCP tokens to pods running under this KSA.

Key Concept

GKE Workload Identity Configuration Sequence
Rate this question

Topics

Configuring Service Account Impersonation and Workload Identity

More questions from this topic