Google Professional Cloud Developer Question 111
Single answerGoogle Cloud PlatformYou are deploying a web application on Google Kubernetes Engine (GKE) that needs to access a Google Cloud Storage bucket to fetch user-uploaded files. The application should use the most secure and recommended approach to authenticate to Google Cloud services. What should you do?
- A
Use a service account and configure Application Default Credentials (ADC) on all your application nodes.
- B
Generate a JSON key for a service account and include it in the application's container image.
- C
Use Workload Identity to allow the application to impersonate a service account.
- D
Configure user credentials using OAuth 2.0 and store them in the application's environment variables.
Show answer and explanation
Correct answer: C
Explanation
The most secure and recommended way for applications running on GKE to authenticate to Google Cloud services is by using Workload Identity. Workload Identity allows GKE workloads to impersonate a Google Cloud service account without the need to manage service account keys, reducing the risk of credential leaks and simplifying authentication management.
- A. Incorrect.
This approach is less secure and not recommended as it requires manual setup on each node and may expose sensitive credentials.
- B. Incorrect.
Embedding a service account key in the container image is a security risk and violates best practices for managing credentials.
- C. Correct.
Workload Identity is the recommended and most secure way to authenticate applications running on GKE to Google Cloud services, as it eliminates the need for storing and managing service account keys.
- D. Incorrect.
OAuth 2.0 is designed for end-user authentication scenarios and is not suitable for service-to-service authentication in this context.