Examkin

Question

Difficulty: EasyContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

A cloud engineering team is configuring an automated CI/CD deployment pipeline using Cloud Build to deploy containerized microservices to a Google Kubernetes Engine (GKE) cluster. To comply with organizational security governance and the principle of least privilege, the team needs to assign permissions to the Cloud Build service account. Which configuration represents the optimal approach for granting Cloud Build access to deploy workloads to the cluster?

  1. Grant the Cloud Build service account the Kubernetes Engine Developer role (roles/container.developer) on the target cluster.Answer
  2. B
    Grant the Cloud Build service account the primitive Owner role (roles/owner) at the GCP project level.
  3. C
    Grant the Cloud Build service account the Service Account Admin role (roles/iam.serviceAccountAdmin) at the project level.
  4. D
    Store the deployment pipeline's Terraform state file in an unversioned local directory within the Cloud Build runner context.

Answer

Grant the Cloud Build service account the Kubernetes Engine Developer role (roles/container.developer) on the target cluster.
Granting the predefined Kubernetes Engine Developer role (`roles/container.developer`) provides the Cloud Build service account with the exact set of permissions required to deploy, update, and manage containerized workloads in the GKE cluster while preventing unauthorized changes to cluster infrastructure.

Step-by-Step Solution

1
Determine the functional requirement of the CI/CD service account during deployment.
The pipeline requires permissions to apply Kubernetes manifests and manage application pods/services in the GKE cluster.
Identifying the specific runtime requirement helps narrow down the minimal required IAM scope.
2
Evaluate Google Cloud predefined IAM roles for Google Kubernetes Engine.
The predefined role `roles/container.developer` supplies complete workload management capabilities (such as deploy, update, and inspect) on GKE clusters without granting cluster creation, deletion, or node pool administration privileges.
Using predefined fine-grained roles ensures compliance with security governance and the principle of least privilege.

Key Concept

Configuring least privilege IAM service account permissions for Cloud Build CI/CD deployments to GKE
Estimated Time:1m 0s
Rate this question

Topics

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

More questions from this topic