Examkin

Soru

Zorluk: ZorDeploying and Managing Google Kubernetes Engine (GKE) Clusters and Workloads

A cloud engineer is tasked with deploying an application to a new Google Kubernetes Engine (GKE) cluster. The application must securely access Cloud Storage using Workload Identity instead of exported service account keys. The target Google Service Account (GSA) and its IAM permissions have already been created. In which chronological order should the engineer execute the steps below to set up the cluster, configure Workload Identity, and deploy the workload?

  1. 1Provision the GKE cluster with Workload Identity enabled via `gcloud container clusters create --workload-pool=PROJECT_ID.svc.id.goog`.
  2. 2Fetch cluster credentials and update `kubeconfig` using `gcloud container clusters get-credentials`.
  3. 3Create a Kubernetes Service Account (KSA) inside the cluster namespace using `kubectl create serviceaccount`.
  4. 4Grant the `roles/iam.workloadIdentityUser` role to the KSA principal on the GSA via `gcloud iam service-accounts add-iam-policy-binding`.
  5. 5Annotate the KSA with the GSA email address using `kubectl annotate serviceaccount` and deploy the workload manifest using `kubectl apply -f`.

Cevap

The correct sequence begins with provisioning the GKE cluster with Workload Identity enabled, fetching cluster credentials for kubectl, creating the Kubernetes Service Account (KSA), granting the IAM Workload Identity User role on the Google Service Account (GSA), and finally annotating the KSA and deploying the application manifest.
The proper deployment workflow requires creating infrastructure and establishing authentication boundaries before deploying application resources. First, provision the GKE cluster with Workload Identity enabled. Next, configure local cluster credentials with `gcloud container clusters get-credentials`. Third, create the Kubernetes Service Account (KSA) within the cluster. Fourth, bind the Google Service Account (GSA) to the KSA using `gcloud iam service-accounts add-iam-policy-binding` with `roles/iam.workloadIdentityUser`. Finally, annotate the KSA with the GSA email and deploy the workload manifest.

Adım Adım Çözüm

1
Provision the GKE cluster with Workload Identity enabled
GKE cluster created with Workload Identity pool initialized
You cannot configure Workload Identity or deploy workloads until the cluster control plane and nodes exist with workload identity capabilities enabled.
2
Run gcloud container clusters get-credentials
Local kubeconfig updated with cluster endpoint and authentication tokens
kubectl commands require an active cluster context and valid authentication credentials to interact with the API server.
3
Create the Kubernetes Service Account (KSA)
KSA resource registered in the Kubernetes namespace
A KSA must exist in the cluster before IAM policy bindings or Kubernetes annotations can reference it.
4
Add IAM policy binding for Workload Identity
GSA configured to trust the specific KSA via roles/iam.workloadIdentityUser
Google Cloud IAM must explicitly permit the KSA member identity string (`serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]`) to impersonate the GSA.
5
Annotate KSA and deploy workload manifest
Pods deployed and automatically mapped to the target GSA identity
The annotation `iam.gke.io/gcp-service-account` instructs GKE's metadata server to inject GSA tokens into pod workload containers upon deployment.

Anahtar Kavram

Workload Identity Configuration Sequence for GKE
Bu soruyu puanla

Konular

Deploying and Managing Google Kubernetes Engine (GKE) Clusters and Workloads