Examkin

Soru

Zorluk: ZorDeploying and Managing Google Kubernetes Engine (GKE) Clusters and Workloads

A Cloud Engineer needs to securely configure a workload running on Google Kubernetes Engine (GKE) to access Cloud Storage using Workload Identity instead of downloading service account keys. Arrange the following configuration and deployment steps in the correct chronological order required to grant the GKE workload secure access to Cloud Storage.

  1. 1Create a Google Cloud IAM Service Account (GSA) and grant it the required IAM storage roles.
  2. 2Create a Kubernetes Service Account (KSA) within the target namespace of the GKE cluster.
  3. 3Add an IAM policy binding to grant the KSA the `roles/iam.workloadIdentityUser` role on the GSA.
  4. 4Annotate the Kubernetes Service Account with the email address of the Google Cloud IAM Service Account.
  5. 5Set `spec.serviceAccountName` in the Deployment manifest to the KSA and apply the manifest to the cluster.

Cevap

The correct chronological order to configure Workload Identity on GKE is: 1) Create the Google Cloud Service Account (GSA) and assign IAM roles, 2) Create the Kubernetes Service Account (KSA) in the cluster, 3) Bind the KSA to the GSA using the Workload Identity User role, 4) Annotate the KSA with the GSA email address, and 5) Reference the KSA under `spec.serviceAccountName` in the workload deployment manifest before applying it.
The correct sequence starts with provisioning the GCP identity (GSA) and cluster identity (KSA). Next, IAM impersonation trust is established by granting `roles/iam.workloadIdentityUser` to the KSA principal. The KSA is then annotated with the GSA email so the GKE metadata server can handle token exchange. Finally, the workload deployment manifest is configured to use the KSA and applied to the cluster.

Adım Adım Çözüm

1
Create the Google Cloud IAM Service Account (GSA) and assign permissions.
GCP identity is provisioned with appropriate Cloud Storage access roles.
Cloud permissions must exist on the GCP side before linking Kubernetes resources.
2
Create the Kubernetes Service Account (KSA) in GKE.
In-cluster identity is created within the specified namespace.
GKE workloads require a KSA identity to participate in Workload Identity mapping.
3
Grant `roles/iam.workloadIdentityUser` on the GSA to the KSA member identity (`serviceAccount:PROJECT_ID.svc.id.goog[NAMESPACE/KSA_NAME]`).
IAM policy allows the KSA to impersonate the GSA.
Without this role binding, GCP IAM will reject impersonation requests from GKE.
4
Annotate the KSA using `iam.gke.io/gcp-service-account=GSA_NAME@PROJECT_ID.iam.gserviceaccount.com`.
The GKE metadata server links KSA credential requests to the specified GSA.
The annotation informs the GKE metadata server which GSA identity to issue tokens for.
5
Configure `spec.serviceAccountName` in the Deployment spec and apply it to the cluster.
Pods run under the authenticated KSA identity and gain access to GCP resources.
Pods must explicitly select the configured KSA to inherit Workload Identity authentication.

Anahtar Kavram

GKE Workload Identity Configuration Sequence
Bu soruyu puanla

Konular

Deploying and Managing Google Kubernetes Engine (GKE) Clusters and Workloads