Examkin

Question

Difficulty: Very hardProgrammatic GCP Interaction via SDK, CLI, and APIs

An enterprise microservice running on an on-premises Kubernetes cluster must programmatically access Google Cloud Storage and Cloud Spanner APIs. Enterprise compliance policies strictly prohibit downloading, exporting, or storing long-lived service account JSON key files anywhere on-premises or within deployment manifests. Furthermore, administrative scripts running in automated CI/CD pipelines via the gcloud CLI must execute operations as a targeted service account without managing key files. Which TWO implementation steps must you configure to satisfy these programmatic authentication and CLI requirements?

  1. Configure Workload Identity Federation to exchange Kubernetes service account OIDC tokens for short-lived Google Cloud federated credentials for the application SDK.Answer
  2. Configure the gcloud CLI in the CI/CD pipeline using the --impersonate-service-account flag to execute administrative commands via short-lived service account tokens.Answer
  3. C
    Export a service account JSON key, encode it as a Kubernetes Secret, and mount it to set the GOOGLE_APPLICATION_CREDENTIALS environment variable inside the application container.
  4. D
    Grant the application service account the primitive Owner role at the project level to bypass IAM credential delegation constraints during API invocation.
  5. E
    Store the unencrypted local gcloud execution state and auth tokens in an unversioned shared local file repository across deployment pipeline runners.

Answer

Workload Identity Federation should be configured for the on-premises Kubernetes cluster to allow programmatic SDK authentication using short-lived OIDC tokens. For the gcloud CLI automation in CI/CD, service account impersonation should be enabled via the --impersonate-service-account flag.
Combining Workload Identity Federation for containerized SDK workloads with gcloud service account impersonation for automated scripts establishes a completely keyless programmatic interaction model. Workload Identity Federation exchanges external OIDC tokens for short-lived Google Cloud credentials, while gcloud impersonation generates short-lived tokens on the fly without storing long-lived service account JSON keys.

Step-by-Step Solution

1
Establish keyless identity federation for the application SDK
Configure Workload Identity Federation using an Workload Identity Pool and Provider mapped to the on-premises Kubernetes cluster's OIDC issuer.
This avoids downloading long-lived service account JSON keys while allowing Application Default Credentials (ADC) to exchange OIDC tokens for Google OAuth2 access tokens.
2
Configure short-lived gcloud CLI access in automation pipelines
Execute gcloud commands using service account impersonation by specifying the target service account email with the --impersonate-service-account flag or setting the auth/impersonate_service_account gcloud property.
This generates temporary tokens for gcloud execution without creating or storing key files.

Key Concept

Programmatic GCP Interaction via Keyless Authentication and Service Account Impersonation
Rate this question

Topics

Programmatic GCP Interaction via SDK, CLI, and APIs

More questions from this topic