Google Associate Cloud Engineer Question 199
Select 3Google Cloud PlatformYou are managing a Google Kubernetes Engine (GKE) cluster and want to configure it to pull container images from Google Cloud's Artifact Registry. Which steps should you take to ensure the GKE nodes can access the Artifact Registry?
- A
Ensure that the GKE nodes have the 'Artifact Registry Reader' IAM role.
- B
Use a service account key and configure it on each node manually.
- C
Enable the Artifact Registry API in your Google Cloud project.
- D
Add the '--enable-artifact-registry' flag when creating the GKE cluster.
- E
Configure Workload Identity to allow GKE to authenticate with Artifact Registry.
Show answer and explanation
Correct answers: A, C, E
Explanation
To allow GKE nodes to pull images from Artifact Registry, you need to ensure they have the necessary IAM permissions by assigning the 'Artifact Registry Reader' role. Additionally, enabling the Artifact Registry API in your project is crucial for accessing Artifact Registry features. Configuring Workload Identity is a best practice for securely managing authentication between GKE and Artifact Registry.
- A. Correct.
Assigning the 'Artifact Registry Reader' IAM role to the GKE nodes allows them to pull images stored in Artifact Registry.
- B. Incorrect.
Using a service account key manually on each node is not recommended due to security risks and maintenance overhead.
- C. Correct.
Enabling the Artifact Registry API is necessary for using Artifact Registry features in your project.
- D. Incorrect.
There is no '--enable-artifact-registry' flag available when creating a GKE cluster.
- E. Correct.
Configuring Workload Identity allows GKE workloads to authenticate with Artifact Registry securely, without needing long-lived credentials.