Google Professional Cloud Developer Question 233
Select 3Google Cloud PlatformYou are developing a microservice that needs to connect to a Cloud SQL instance securely. The microservice is deployed on Google Kubernetes Engine (GKE). Which of the following steps should you take to authenticate to the Cloud SQL instance using the Cloud SQL Auth proxy?
- A
Ensure the GKE cluster has a service account with the 'Cloud SQL Client' role attached.
- B
Install the Cloud SQL Auth proxy as a sidecar container in the application's pod.
- C
Manually configure the database credentials in a Kubernetes Secret and mount it to the pod.
- D
Enable the Cloud SQL Admin API in the Google Cloud project.
- E
Use IAM database authentication to allow users to authenticate with their Google credentials.
Show answer and explanation
Correct answers: A, B, D
Explanation
To securely authenticate to a Cloud SQL instance from a GKE workload, you should attach a service account with the 'Cloud SQL Client' role to the GKE cluster, enable the Cloud SQL Admin API, and use the Cloud SQL Auth proxy. The Cloud SQL Auth proxy handles authentication and connection management, avoiding the need to hard-code credentials in your application. Using IAM database authentication is unnecessary for this scenario, as it is not intended for service-to-service authentication.
- A. Correct.
Correct. The GKE cluster's service account requires the 'Cloud SQL Client' role to authorize connections to the Cloud SQL instance using the Cloud SQL Auth proxy.
- B. Correct.
Correct. Running the Cloud SQL Auth proxy as a sidecar container allows the application to securely connect to the Cloud SQL instance without embedding credentials.
- C. Incorrect.
Incorrect. Manually configuring database credentials in Kubernetes Secrets is not recommended for secure authentication in this case, as the Cloud SQL Auth proxy handles authentication and connection management.
- D. Correct.
Correct. The Cloud SQL Admin API must be enabled to allow the Cloud SQL Auth proxy to connect to the Cloud SQL instance.
- E. Incorrect.
Incorrect. While IAM database authentication is a feature of Cloud SQL, it is intended for specific use cases involving user authentication, not for service-to-service authentication using the Cloud SQL Auth proxy.