Google Professional Cloud Developer Question 374
Single answerGoogle Cloud PlatformYou are deploying a Kubernetes application on Google Kubernetes Engine (GKE) and need to configure fine-grained access for developers. The requirement is to allow IAM users to access specific Kubernetes resources based on their roles within the organization. How can you achieve this by integrating Kubernetes RBAC with Google Cloud IAM?
- A
Bind IAM roles to Kubernetes service accounts and map the service accounts to Kubernetes RBAC roles.
- B
Use Workload Identity to map IAM identities to Kubernetes service accounts, then bind the service accounts to Kubernetes RBAC roles.
- C
Assign Kubernetes RBAC roles directly to IAM users in the cluster.
- D
Use Google Cloud IAM to directly assign permissions to Kubernetes namespaces.
Show answer and explanation
Correct answer: B
Explanation
To integrate Kubernetes RBAC with IAM, the recommended approach is to use Workload Identity. This allows you to map IAM identities to Kubernetes service accounts, which can then be bound to Kubernetes RBAC roles. This integration ensures that IAM users can access specific Kubernetes resources while leveraging Kubernetes' RBAC system for granular access control.
- A. Incorrect.
This is incorrect because IAM roles cannot be directly bound to Kubernetes service accounts. You need an intermediary process, such as Workload Identity, to bridge IAM and Kubernetes RBAC.
- B. Correct.
This is correct because Workload Identity allows you to map Google Cloud IAM identities to Kubernetes service accounts. You can then assign Kubernetes RBAC roles to those service accounts for fine-grained access control.
- C. Incorrect.
This is incorrect because Kubernetes RBAC roles cannot be directly assigned to IAM users. Kubernetes does not natively understand IAM users without integration through Workload Identity.
- D. Incorrect.
This is incorrect because Google Cloud IAM cannot directly assign permissions to Kubernetes namespaces. Kubernetes uses its own RBAC system for namespace-level access control.