Examkin

Soru

Zorluk: OrtaProgrammatic GCP Interaction via SDK, CLI, and APIs

A financial services organization deploys a Go-based microservice on Google Kubernetes Engine (GKE) that programmatically ingests data by publishing messages to Cloud Pub/Sub and writing records to Cloud Bigtable using official Google Cloud Client Libraries. During high-volume market events, the application experiences transient HTTP 429429 (Too Many Requests) rate limit errors and HTTP 503503 (Service Unavailable) errors. The security and platform architecture teams require a solution that adheres to GCP authentication best practices while ensuring resilient API interaction and minimal operational overhead. Which implementation strategy should the cloud architect recommend?

  1. Utilize the built-in retry policies of the Google Cloud Client Libraries configured with truncated exponential backoff and randomized jitter, while authenticating via Application Default Credentials (ADC) bound to a Kubernetes Service Account using Workload Identity.Cevap
  2. B
    Generate a long-lived service account JSON key file, embed it directly into the application container image, and write a custom linear retry loop with fixed one-second delay intervals.
  3. C
    Assign the primitive Owner IAM role (roles/owner) to the GKE node pool's default service account to automatically bypass API rate limits and quota restrictions.
  4. D
    Persist failed API call states to an unversioned local file inside the container, and execute local Terraform commands from within the application to re-provision resources upon each failure.

Cevap

Utilize the built-in retry policies of the Google Cloud Client Libraries configured with truncated exponential backoff and randomized jitter, while authenticating via Application Default Credentials (ADC) bound to a Kubernetes Service Account using Workload Identity.
The option recommending built-in Google Cloud Client Library retry policies with truncated exponential backoff and jitter alongside Workload Identity correctly addresses both API rate limiting and secure authentication. Google Cloud Client Libraries natively support Application Default Credentials (ADC) and automatic retry handling for idempotent requests, avoiding static credential management and preventing thundering herd spikes.

Adım Adım Çözüm

1
Analyze authentication requirements for GKE applications
Workload Identity allows Kubernetes Service Accounts to act as IAM Service Accounts using short-lived tokens via Application Default Credentials (ADC), eliminating the need for service account keys.
Hardcoding or bundling static JSON service account keys introduces security vulnerabilities.
2
Evaluate API resilience strategies for transient HTTP 429 and 503 errors
Official Google Cloud Client Libraries provide standard retry mechanisms that use truncated exponential backoff with randomized jitter.
Exponential backoff prevents overwhelming APIs during overload spikes, while jitter prevents synchronization thundering herd problems.
3
Synthesize the architecture recommendation
Combine Workload Identity for identity management with native Client Library retry logic for programmatic GCP API interaction.
This satisfies both security and operational resilience standards for GCP cloud architecture.

Anahtar Kavram

Programmatic GCP API Resilience and Secure Authentication via ADC
Bu soruyu puanla

Konular

Programmatic GCP Interaction via SDK, CLI, and APIs

Bu konudan daha fazla soru