A cloud engineer needs to deploy a containerized microservice to an existing Google Kubernetes Engine (GKE) cluster using kubectl. Running kubectl commands currently fails because the local environment lacks authentication credentials for the cluster. Additionally, the microservice requires access to Cloud Storage buckets and must adhere to Google Cloud security best practices by avoiding long-lived downloaded service account keys. Which TWO actions should the cloud engineer perform?
- Execute gcloud container clusters get-credentials to fetch cluster endpoints and update the local kubeconfig file.Answer
- Enable Workload Identity on the GKE cluster and bind the Kubernetes ServiceAccount to a Google Cloud IAM ServiceAccount.Answer
- CExecute gcloud config set container/cluster to automatically populate authentication tokens for kubectl authorization.
- DGenerate a service account JSON key file, upload it as a Kubernetes Secret, and mount it as a file volume inside the Pod.
Answer
The cloud engineer must execute gcloud container clusters get-credentials to update the local kubeconfig context, and configure Workload Identity by binding the Kubernetes ServiceAccount to a Google Cloud IAM ServiceAccount.
To interact with a GKE cluster using kubectl, administrators must run gcloud container clusters get-credentials to write cluster access context into their kubeconfig file. For secure GCP resource access, Workload Identity is the Google-recommended approach to grant Kubernetes ServiceAccounts permissions to IAM ServiceAccounts without static keys.
Step-by-Step Solution
Key Concept
GKE Cluster Credential Retrieval and Keyless IAM Authentication via Workload Identity
Estimated Time:1m 30s