Examkin

Soru

Zorluk: OrtaManaging Google Kubernetes Engine Resources

A cloud engineer is managing a stateless application on a Google Kubernetes Engine (GKE) cluster. The application needs to read data from a Google Cloud Storage bucket securely. To adhere to Google Cloud security best practices, the application must authenticate without using long-lived service account key files stored inside Kubernetes secrets or container images. Which approach should the engineer implement?

  1. Configure GKE Workload Identity by binding the Kubernetes ServiceAccount used by the pod to a Google Cloud IAM Service Account assigned the required Storage role.Cevap
  2. B
    Create a service account JSON key in the Cloud Console, store it as a Kubernetes Secret, and mount it as a volume into the application pod.
  3. C
    Migrate the application deployment to a GKE Autopilot cluster so that Google Cloud automatically manages object-level Storage permissions for all pods.
  4. D
    Enable the GKE Cluster Autoscaler on the node pool to dynamically attach IAM service account credentials whenever new nodes are provisioned.

Cevap

Configure GKE Workload Identity by binding the Kubernetes ServiceAccount used by the pod to a Google Cloud IAM Service Account assigned the required Storage role.
The correct approach is to configure GKE Workload Identity. Workload Identity binds a Kubernetes ServiceAccount to a Google Cloud IAM Service Account, enabling application pods to securely authenticate to Google Cloud services like Cloud Storage using short-lived tokens without storing long-lived service account keys.

Adım Adım Çözüm

1
Identify the authentication requirements for GKE workloads accessing GCP resources.
Recognize that long-lived service account JSON keys should be avoided in favor of short-lived tokens.
Security best practices demand least privilege and credential-less access paradigms for containerized workloads.
2
Select GKE Workload Identity as the recommended solution.
Map the Kubernetes ServiceAccount (KSA) to a Google Cloud IAM Service Account (GSA).
Workload Identity securely bridges Kubernetes RBAC identity with GCP IAM identity.
3
Grant the required IAM roles to the IAM Service Account.
The application pod assumes the permissions of the IAM Service Account via short-lived token exchange.
This allows fine-grained, secure access to Cloud Storage without mounting key files.

Anahtar Kavram

GKE Workload Identity Authentication
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Managing Google Kubernetes Engine Resources