Your organization is designing a CI/CD pipeline using Cloud Build to automatically build container images and deploy them to a Google Kubernetes Engine (GKE) cluster. Following Google Cloud security best practices for pipeline design, how should you configure IAM permissions for the Cloud Build service account?
- Grant the Cloud Build service account fine-grained predefined roles, such as Kubernetes Engine Developer, required specifically for deployment operations.Cevap
- BAssign the primitive Owner role to the Cloud Build service account across the project to guarantee build steps complete without permission errors.
- CGrant the Service Account Admin role to the Cloud Build service account so that build steps can manage service account permissions dynamically during deployment.
- DDisable control plane authorized networks on the target GKE cluster so Cloud Build worker nodes can access the cluster endpoint over the public internet.
Cevap
Grant the Cloud Build service account fine-grained predefined roles, such as Kubernetes Engine Developer, required specifically for deployment operations.
Granting fine-grained predefined roles tailored to the pipeline's duties (such as Kubernetes Engine Developer) enforces the principle of least privilege, ensuring Cloud Build has sufficient permission to deploy without granting unnecessary administrative access.
Adım Adım Çözüm
Anahtar Kavram
Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design and IAM Least Privilege