Google Professional Cloud Developer Question 375
Select 2Google Cloud PlatformYou are developing a Kubernetes-based application hosted in Google Kubernetes Engine (GKE). The application requires integration between Kubernetes Role-Based Access Control (RBAC) and Google Cloud IAM to manage permissions. How can you ensure that developers in the 'dev-team' group are granted access to manage Kubernetes objects within a specific namespace, while following best practices for security and access control?
- A
Create a Google Cloud IAM role with the required permissions and bind it to the 'dev-team' group.
- B
Use Workload Identity to map Google Cloud IAM permissions to Kubernetes RBAC roles for the 'dev-team' group.
- C
Create a Kubernetes ClusterRole and bind it to the 'dev-team' group using a ClusterRoleBinding.
- D
Create a Kubernetes Role and bind it to the 'dev-team' group using a RoleBinding within the specific namespace.
- E
Grant the 'dev-team' group the 'Kubernetes Engine Admin' IAM role at the project level.
Show answer and explanation
Correct answers: B, D
Explanation
To integrate Kubernetes RBAC with Google Cloud IAM, you should use Workload Identity to map IAM permissions to Kubernetes entities, ensuring secure and manageable access control. Additionally, to restrict permissions within a specific namespace, you should create a Kubernetes Role and bind it using a RoleBinding. This approach adheres to the principle of least privilege and ensures that 'dev-team' developers have only the necessary access within the required namespace.
- A. Incorrect.
Incorrect: IAM roles alone cannot directly manage Kubernetes RBAC. IAM roles must be mapped to Kubernetes RBAC roles using Workload Identity or other mechanisms to make them effective within the cluster.
- B. Correct.
Correct: Workload Identity allows you to map Google Cloud IAM identities to Kubernetes ServiceAccounts, which can then be associated with Kubernetes RBAC roles. This is a best practice for integrating IAM with Kubernetes RBAC.
- C. Incorrect.
Incorrect: ClusterRoles and ClusterRoleBindings apply cluster-wide, which violates the requirement to limit access to a specific namespace.
- D. Correct.
Correct: Creating a Kubernetes Role and binding it to the 'dev-team' group using a RoleBinding within the specific namespace ensures that access is restricted to the intended namespace, following the principle of least privilege.
- E. Incorrect.
Incorrect: Granting the 'Kubernetes Engine Admin' IAM role at the project level provides excessive permissions and does not restrict access to the specific namespace, violating security best practices.