A Kubernetes application running on a Google Kubernetes Engine (GKE) cluster requires secure access to objects in a Google Cloud Storage bucket. To follow security best practices and avoid using downloadable service account key files, an engineer must configure Workload Identity. In what sequence should the engineer execute the configuration steps to enable identity delegation for the application?
- 1Create a target Google Cloud Service Account (GSA) and grant it the required Cloud Storage permissions on the target bucket.
- 2Grant the Workload Identity User role (roles/iam.workloadIdentityUser) to the Kubernetes Service Account (KSA) principal on the GSA resource.
- 3Annotate the Kubernetes Service Account (KSA) in GKE with the email address of the target Google Cloud Service Account.
- 4Update the Kubernetes Pod specification to specify the annotated Kubernetes Service Account and deploy the pod.
Answer
The correct operational sequence is to create the Google Cloud Service Account with bucket access permissions first, grant the Workload Identity User role to the Kubernetes Service Account on the GCP Service Account next, annotate the Kubernetes Service Account with the GCP Service Account email third, and finally deploy the Pod configured with the annotated Kubernetes Service Account.
The proper administrative sequence requires provisioning the GCP service account and assigning target bucket access, granting the `roles/iam.workloadIdentityUser` role to the KSA member on that GCP service account, annotating the Kubernetes service account with the GCP service account email, and finally binding the pod spec to the annotated Kubernetes service account.
Step-by-Step Solution
Key Concept
GKE Workload Identity configuration sequence