An enterprise development team is deploying an automated Python application inside a Google Kubernetes Engine (GKE) Pod. The application needs to programmatically upload archived files to a Cloud Storage bucket using the official Google Cloud Python Client Library. Which TWO actions should the team take to securely authenticate and execute these API calls? (Select TWO)
- Configure Workload Identity on the GKE cluster and map the Kubernetes Service Account to a Google IAM Service Account configured with least-privilege storage permissions.Cevap
- Initialize the Cloud Storage client in the application code without passing explicit key paths, relying on Application Default Credentials (ADC) to detect runtime credentials.Cevap
- CGenerate a service account JSON key file and hardcode the key directly within the container image or application source repository.
- DAssign the primitive Owner role (roles/owner) to the underlying service account so the application can bypass API scope restrictions.
Cevap
The correct practices are to bind the Kubernetes Service Account to a Google IAM Service Account using Workload Identity, and to instantiate the client library relying on Application Default Credentials (ADC).
Enabling Workload Identity maps the Kubernetes Service Account to a Google Cloud IAM Service Account, providing secure short-lived identity tokens to the Pod. Relying on Application Default Credentials (ADC) inside the Python client library allows the SDK to automatically discover these tokens without hardcoded credentials or manual token handling.
Adım Adım Çözüm
Anahtar Kavram
Workload Identity and Application Default Credentials (ADC) for secure SDK interaction