A platform engineering team is configuring Workload Identity on a Google Kubernetes Engine (GKE) cluster to enable passwordless authentication to Google Cloud resources. A pod running in the namespace `data-pipeline` uses the Kubernetes service account `exporter-ksa` and needs to write files to Cloud Storage. The target Google service account `[email protected]` has already been assigned the Cloud Storage Object Creator role on the destination bucket. Which IAM role binding configuration is required on `storage-writer-sa` to allow the Kubernetes workload to impersonate it?
- Grant the Workload Identity User role (roles/iam.workloadIdentityUser) to serviceAccount:prod-analytics.svc.id.goog[data-pipeline/exporter-ksa] on storage-writer-sa.Cevap
- BExport a service account JSON key file for storage-writer-sa and mount it as a Kubernetes Secret inside the data-pipeline pod.
- CGrant the Owner primitive role (roles/owner) to serviceAccount:[email protected] at the project level.
- DGrant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) to the Kubernetes service account at the organization level so permissions inherit automatically.
Cevap
Grant the Workload Identity User role (roles/iam.workloadIdentityUser) to serviceAccount:prod-analytics.svc.id.goog[data-pipeline/exporter-ksa] on storage-writer-sa.
To enable a GKE workload to act as a Google Service Account, GKE Workload Identity maps the Kubernetes service account to the Google service account. This is achieved by granting the `roles/iam.workloadIdentityUser` role on the target Google service account to the member formatted as `serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]`.
Adım Adım Çözüm
Anahtar Kavram
Configuring Workload Identity bindings between Kubernetes Service Accounts (KSA) and Google Service Accounts (GSA)