Google Professional Cloud Developer Question 373
Single answerGoogle Cloud PlatformYou are deploying a Kubernetes application on Google Kubernetes Engine (GKE) and want to enforce fine-grained access control over your cluster resources. You need to integrate Kubernetes Role-Based Access Control (RBAC) with Google Cloud Identity and Access Management (IAM) to allow an external team to manage specific namespaces without granting excessive permissions. Which approach should you take to achieve this?
- A
Bind a Google Cloud IAM role, such as
roles/container.admin, directly to the external team’s Google accounts. - B
Create a Kubernetes Role and RoleBinding in the targeted namespaces, and map them to a Google Cloud IAM service account using Workload Identity.
- C
Grant the external team a Kubernetes ClusterRole with full administrative access to the cluster and link it to their Google Cloud IAM accounts through Google Groups.
- D
Enable Workload Identity and map Google Cloud IAM roles to Kubernetes RBAC roles using a GKE-specific IAM policy binding.
Show answer and explanation
Correct answer: B
Explanation
To integrate Kubernetes RBAC with Google Cloud IAM while maintaining fine-grained access control, you should use Workload Identity. This approach allows you to map a Google Cloud IAM service account to a Kubernetes Role or RoleBinding in the targeted namespaces. This ensures that permissions are scoped to the necessary resources without granting excessive access, aligning with best practices for security and access management.
- A. Incorrect.
Binding a Google Cloud IAM role, such as
roles/container.admin, directly to the external team’s Google accounts grants them broad administrative access to the entire GKE cluster, which violates the principle of least privilege. This is not an appropriate approach for namespace-specific access management. - B. Correct.
Creating a Kubernetes Role and RoleBinding in the targeted namespaces and mapping them to a Google Cloud IAM service account through Workload Identity is the correct approach. It allows you to enforce fine-grained access control at the namespace level, ensuring that permissions are scoped appropriately.
- C. Incorrect.
Granting a Kubernetes ClusterRole with full administrative access to the cluster gives excessive permissions to the external team, which is unnecessary and insecure for managing specific namespaces.
- D. Incorrect.
Enabling Workload Identity and mapping Google Cloud IAM roles to Kubernetes RBAC roles using a GKE-specific IAM policy binding is not a valid configuration. Workload Identity is used to map Kubernetes service accounts to Google Cloud IAM service accounts, not for mapping IAM roles to RBAC roles.