A DevOps engineer needs to configure GKE Workload Identity so that an application running in a Kubernetes cluster can securely access Google Cloud resources without using exported service account key files. Which TWO of the following configuration actions must be performed to complete this setup?
- Grant the roles/iam.workloadIdentityUser role on the Google Service Account to the Kubernetes Service Account member.Answer
- BDownload the service account private key file in JSON format and mount it inside the container pod.
- Annotate the Kubernetes Service Account with the email address of the Google Service Account.Answer
- DAssign the primitive Owner role (roles/owner) to the Kubernetes Service Account at the organization level.
Answer
The two required configuration actions are binding the IAM Workload Identity User role to the Kubernetes Service Account on the Google Service Account, and annotating the Kubernetes Service Account with the Google Service Account email address.
To set up GKE Workload Identity, you must authorize the Kubernetes Service Account (KSA) to impersonate the Google Service Account (GSA) by assigning the roles/iam.workloadIdentityUser role, and you must annotate the KSA with the GSA's email address so GKE pods receive short-lived credentials.
Step-by-Step Solution
Key Concept
Configuring Workload Identity between Kubernetes Service Accounts and Google Service Accounts