Google Professional Cloud Developer Question 376
Select 3Google Cloud PlatformYou are deploying a Kubernetes application on Google Kubernetes Engine (GKE) and want to integrate Kubernetes role-based access control (RBAC) with Google Cloud IAM to ensure that only specific Google Cloud users can access certain Kubernetes resources. What steps should you take to achieve this integration?
- A
Bind Kubernetes RBAC roles to Google Cloud IAM roles using Kubernetes RoleBindings or ClusterRoleBindings.
- B
Enable the Workload Identity feature on your GKE cluster to map Kubernetes service accounts to Google Cloud service accounts.
- C
Use the gcloud CLI to directly map Google Cloud IAM roles to Kubernetes namespaces.
- D
Configure Kubernetes RoleBindings or ClusterRoleBindings to associate Kubernetes roles with Google Cloud IAM users via their email addresses.
- E
Enable Google Cloud’s Identity and Access Management (IAM) integration for your GKE cluster.
Show answer and explanation
Correct answers: B, D, E
Explanation
Integrating Kubernetes RBAC with Google Cloud IAM requires leveraging mechanisms like Workload Identity to map Kubernetes service accounts to Google Cloud service accounts and enabling IAM integration for the GKE cluster. Additionally, Kubernetes RoleBindings or ClusterRoleBindings are used to associate Kubernetes roles with IAM users via their email addresses. These steps ensure secure and seamless access control between Kubernetes and Google Cloud.
- A. Incorrect.
Kubernetes RBAC roles are not directly bound to Google Cloud IAM roles. Instead, you use mechanisms like Workload Identity and email-based associations to map access.
- B. Correct.
Enabling Workload Identity is a key step to map Kubernetes service accounts to Google Cloud service accounts, facilitating integration with IAM.
- C. Incorrect.
The gcloud CLI does not directly map IAM roles to Kubernetes namespaces. Instead, RoleBindings or ClusterRoleBindings must be used for access control within Kubernetes.
- D. Correct.
RoleBindings and ClusterRoleBindings can associate Kubernetes roles with Google Cloud IAM users by using their email addresses as subject identifiers.
- E. Correct.
Enabling Google Cloud IAM integration for GKE clusters is a necessary step to allow IAM policies to influence access to the Kubernetes API.