Google Associate Cloud Engineer Question 371
Single answerGoogle Cloud PlatformAs a Google Cloud Associate Cloud Engineer, you are tasked with enabling a microservice running on Google Kubernetes Engine (GKE) to securely access a Cloud Storage bucket. The microservice is designed to scale up and down frequently, which requires short-lived credentials to be used for authentication. How should you configure the service to use short-lived service account credentials?
- A
Use a service account key file stored in a Kubernetes secret to authenticate the service.
- B
Use Workload Identity to associate a Kubernetes service account with a Google service account.
- C
Configure the application to use user credentials via OAuth 2.0 for authentication.
- D
Use a persistent service account key encoded in the application code.
Show answer and explanation
Correct answer: B
Explanation
Workload Identity is the recommended approach for managing short-lived service account credentials in Google Kubernetes Engine. It allows you to associate a Kubernetes service account with a Google Cloud service account, enabling the microservice to obtain short-lived, automatically managed credentials, thus enhancing security and reducing the risk associated with long-lived credentials.
- A. Incorrect.
Using a service account key file stored in a Kubernetes secret is not recommended for short-lived credentials, as key files are long-lived and pose a security risk if not managed properly.
- B. Correct.
Workload Identity allows you to bind a Kubernetes service account to a Google service account, enabling the application to use short-lived credentials automatically managed by Google Cloud.
- C. Incorrect.
User credentials via OAuth 2.0 are not suitable for microservices on GKE, as they are intended for user-based access rather than service-based authentication.
- D. Incorrect.
Embedding a persistent service account key in the application code is insecure and not suitable for short-lived credential scenarios.