Examkin

Soru

Zorluk: OrtaDeploying and Managing Google Kubernetes Engine (GKE) Clusters and Workloads

A cloud engineer needs to configure a Google Kubernetes Engine (GKE) workload to securely access Google Cloud Storage using Workload Identity. Arrange the administrative and deployment steps in the correct sequential order from start to finish.

  1. 1Create a Google Service Account (GSA) and grant it the required IAM roles for Cloud Storage access.
  2. 2Create a Kubernetes Service Account (KSA) in the GKE namespace where the workload will be deployed.
  3. 3Grant the `roles/iam.workloadIdentityUser` IAM role on the GSA to the KSA member.
  4. 4Annotate the KSA with `iam.gke.io/gcp-service-account=GSA_EMAIL`.
  5. 5Apply the Deployment manifest configured with `spec.template.spec.serviceAccountName` set to the annotated KSA.

Cevap

The correct sequence begins with creating the Google Service Account (GSA) and assigning GCP IAM permissions, followed by creating the Kubernetes Service Account (KSA) in GKE. Next, grant the Workload Identity User IAM role to allow the KSA to impersonate the GSA. Then, annotate the KSA with the GSA email address. Finally, deploy the application manifest referencing the annotated KSA.
To configure Workload Identity correctly, you must first provision the Google Service Account (GSA) and grant it GCP IAM roles. Next, create the Kubernetes Service Account (KSA) in the cluster namespace. Then, grant the Workload Identity User role on the GSA to the KSA so GCP permits token impersonation. Fourth, annotate the KSA with the GSA's email address so GKE metadata server routes authentication requests properly. Finally, deploy the application manifest configured to use the annotated KSA.

Adım Adım Çözüm

1
Create a Google Service Account (GSA) and assign required GCP IAM roles.
A GCP-level identity with Cloud Storage permissions is provisioned.
Workload Identity bridges Kubernetes identities to GCP Service Accounts, which hold actual GCP IAM permissions.
2
Create a Kubernetes Service Account (KSA) in the cluster namespace.
An in-cluster identity is defined for the workload.
Pods run under a KSA identity inside the Kubernetes cluster namespace.
3
Add an IAM policy binding granting `roles/iam.workloadIdentityUser` on the GSA to the KSA.
The GSA authorizes the KSA member `PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]` to act on its behalf.
Without this IAM binding, token exchange between GKE and GCP IAM will be rejected.
4
Annotate the KSA with the GSA email address.
The annotation `iam.gke.io/gcp-service-account` instructs GKE metadata server to issue tokens for the GSA.
The annotation tells GKE which GSA identity should be associated with pods using this KSA.
5
Deploy the application Pod or Deployment specifying `serviceAccountName` as the KSA.
The workload runs under the annotated KSA and securely authenticates to Google Cloud APIs.
When the application pod starts, its SDK calls the local GKE metadata server to obtain short-lived GSA credentials.

Anahtar Kavram

Configuring Workload Identity for GKE workloads
Bu soruyu puanla

Konular

Deploying and Managing Google Kubernetes Engine (GKE) Clusters and Workloads