Google Professional Cloud Developer Question 232
Select 3Google Cloud PlatformYou are developing a cloud-based application that needs to connect to a Cloud SQL database securely without embedding credentials in the code. Your application is running on Google Kubernetes Engine (GKE). Which of the following steps must you take to ensure secure and seamless authentication using the Cloud SQL Auth proxy?
- A
Grant the GKE node's service account the 'Cloud SQL Client' IAM role.
- B
Deploy the Cloud SQL Auth proxy as a sidecar container alongside your application in the GKE pod.
- C
Manually generate a database user password and embed it in the application code.
- D
Configure the Cloud SQL Auth proxy to use the GKE workload identity for authentication.
- E
Enable the 'Public IP' setting in the Cloud SQL instance to allow external access.
Show answer and explanation
Correct answers: A, B, D
Explanation
To securely connect to Cloud SQL from a GKE application, you must ensure that the GKE node's service account has the necessary IAM permissions, deploy the Cloud SQL Auth proxy as a sidecar container, and configure it to use GKE workload identity for authentication. This approach avoids hardcoding credentials and provides a secure, scalable solution for accessing Cloud SQL.
- A. Correct.
Granting the GKE node's service account the 'Cloud SQL Client' IAM role is required to allow the service account to access the Cloud SQL instance via the Auth proxy.
- B. Correct.
Deploying the Cloud SQL Auth proxy as a sidecar container in the same pod as your application ensures secure communication with the Cloud SQL instance without embedding credentials in the application code.
- C. Incorrect.
Manually embedding database credentials in the application code is insecure and not recommended. The Cloud SQL Auth proxy eliminates the need for this approach.
- D. Correct.
Configuring the Cloud SQL Auth proxy to use GKE workload identity ensures the application can securely authenticate to Cloud SQL using IAM without hardcoding secrets.
- E. Incorrect.
Enabling the 'Public IP' setting is not required in this scenario, as the Cloud SQL Auth proxy uses private communication and IAM for a secure connection.