Google Professional Cloud Developer Question 134
Single answerGoogle Cloud PlatformYou are deploying a microservice on Google Kubernetes Engine (GKE) that needs to access resources in Google Cloud Storage. You want to ensure the service operates with the principle of least privilege and without using long-lived credentials like service account keys. How should you configure authentication for this service?
- A
Use Workload Identity to bind a Kubernetes service account to a Google Cloud service account with the required permissions.
- B
Generate a service account key for the Google Cloud service account and mount it as a secret in the Kubernetes pod.
- C
Use Workload Identity Federation to authenticate the microservice using an external identity provider without requiring a Google Cloud service account.
- D
Manually assign the required permissions to the Kubernetes node's default service account to allow access to Google Cloud Storage.
Show answer and explanation
Correct answer: A
Explanation
The best way to ensure least-privileged, keyless access for a GKE workload is to use Workload Identity. This binds a Kubernetes service account to a Google Cloud service account, allowing the workload to authenticate securely without needing long-lived credentials like service account keys. It also ensures that permissions are scoped specifically to the workload, adhering to security best practices.
- A. Correct.
Correct. Workload Identity is the recommended approach to enable keyless, least-privilege access for GKE workloads. It binds a Kubernetes service account to a Google Cloud service account, ensuring secure and scoped access.
- B. Incorrect.
Incorrect. Using service account keys introduces long-lived credentials, which is not secure or aligned with Google Cloud's best practices for keyless authentication.
- C. Incorrect.
Incorrect. Workload Identity Federation is designed for external identity providers, not for GKE workloads accessing Google Cloud resources.
- D. Incorrect.
Incorrect. Granting permissions to the Kubernetes node's default service account violates the principle of least privilege and introduces unnecessary security risks.