Google Professional Cloud Developer Question 377
Select 2Google Cloud PlatformYou are a cloud developer tasked with integrating Kubernetes RBAC and Google Cloud IAM for a GKE cluster. You need to ensure that members of the 'dev-team' Google Group can access the Kubernetes cluster and manage resources within the 'dev-namespace' without granting them overly permissive roles. What steps should you include in your setup?
- A
Grant the 'Kubernetes Engine Developer' IAM role to the 'dev-team' Google Group.
- B
Create a Kubernetes RoleBinding in the 'dev-namespace' that binds the 'dev-team' Google Group to a Kubernetes Role with appropriate permissions.
- C
Grant the 'Kubernetes Engine Admin' IAM role to the 'dev-team' Google Group to allow full cluster management.
- D
Create a Kubernetes ClusterRoleBinding that binds the 'dev-team' Google Group to a ClusterRole with cluster-wide permissions.
- E
Enable Workload Identity on the GKE cluster to allow seamless integration of Google Cloud IAM and Kubernetes RBAC.
Show answer and explanation
Correct answers: A, B
Explanation
Integrating Kubernetes RBAC with IAM involves granting appropriate IAM roles for cluster authentication and then using Kubernetes RBAC to enforce fine-grained permissions within namespaces. By granting the 'Kubernetes Engine Developer' role, you enable authentication to the cluster, and by creating a RoleBinding in the specific namespace, you ensure that permissions are scoped to the required resources. This approach adheres to the principle of least privilege.
- A. Correct.
Granting the 'Kubernetes Engine Developer' IAM role allows members of the 'dev-team' Google Group to authenticate to the GKE cluster without giving them excessive permissions.
- B. Correct.
Creating a Kubernetes RoleBinding in the 'dev-namespace' ensures that the 'dev-team' Google Group has access to manage resources within the namespace. This aligns with the principle of least privilege.
- C. Incorrect.
The 'Kubernetes Engine Admin' role grants full administrative access to the GKE cluster, which is overly permissive and does not adhere to the principle of least privilege.
- D. Incorrect.
A ClusterRoleBinding with cluster-wide permissions is unnecessary and overly permissive for granting access to a single namespace.
- E. Incorrect.
While Workload Identity is useful for integrating Kubernetes Pods with Google Cloud IAM, it is not directly related to granting access to users or groups to manage Kubernetes resources within a namespace.