Google Associate Cloud Engineer Question 197
Select 3Google Cloud PlatformYou are tasked with configuring a Google Kubernetes Engine (GKE) cluster to pull container images from a private Artifact Registry repository. Which of the following steps should you take to ensure the GKE nodes have the necessary permissions to access the Artifact Registry?
- A
A. Enable the 'Artifact Registry' API in your Google Cloud project.
- B
B. Assign the 'Artifact Registry Reader' role to the Google Kubernetes Engine service account.
- C
C. Use a Kubernetes secret to store the Artifact Registry credentials and reference it in your deployment.
- D
D. Configure the GKE cluster to use Workload Identity.
- E
E. Create a custom IAM role with 'storage.objects.get' permission and assign it to the GKE nodes.
Show answer and explanation
Correct answers: A, B, D
Explanation
To configure GKE to access Artifact Registry, enabling the 'Artifact Registry' API and assigning the appropriate IAM roles are essential steps. Using Workload Identity is preferred for securely managing permissions without handling service account keys directly. Traditional methods like using Kubernetes secrets are not recommended when Workload Identity is available.
- A. Correct.
Enabling the 'Artifact Registry' API is necessary for using Artifact Registry services.
- B. Correct.
Assigning the 'Artifact Registry Reader' role to the GKE service account is required to grant read access to the Artifact Registry.
- C. Incorrect.
Using Kubernetes secrets for storing credentials is a traditional method, but not recommended for managing Artifact Registry access, especially with Workload Identity.
- D. Correct.
Configuring the GKE cluster to use Workload Identity allows for secure and manageable access to Artifact Registry without directly handling service account keys.
- E. Incorrect.
Creating a custom IAM role with 'storage.objects.get' is not sufficient as it does not cover the Artifact Registry API permissions, and it's not a standard practice.