Google Professional Cloud Developer Question 378
Single answerGoogle Cloud PlatformYou are developing a Kubernetes application running on Google Kubernetes Engine (GKE). Your team wants to ensure that Kubernetes Role-Based Access Control (RBAC) is integrated with Google Cloud IAM, allowing developers to perform specific actions on Kubernetes resources based on their IAM permissions. Which approach should you take to achieve this?
- A
Enable Workload Identity on your GKE cluster and bind IAM roles to Kubernetes service accounts.
- B
Create Kubernetes RBAC roles and bind them directly to Google Cloud IAM users.
- C
Use Google Groups for RBAC and map them to Kubernetes roles.
- D
Configure Kubernetes ClusterRoleBindings and bind them to Google Cloud IAM roles.
Show answer and explanation
Correct answer: A
Explanation
Workload Identity is the recommended way to integrate Google Cloud IAM with Kubernetes RBAC. By enabling Workload Identity on the GKE cluster, you can associate Google Cloud IAM roles with Kubernetes service accounts. This allows developers to perform actions on Kubernetes resources based on their IAM permissions, ensuring a secure and seamless integration.
- A. Correct.
This is the correct approach. By enabling Workload Identity, you can integrate Google Cloud IAM with Kubernetes RBAC by binding IAM roles to Kubernetes service accounts, allowing fine-grained access control.
- B. Incorrect.
This is incorrect because Kubernetes RBAC roles cannot be directly bound to Google Cloud IAM users. Integration requires Workload Identity to bridge IAM and Kubernetes service accounts.
- C. Incorrect.
This is incorrect because Kubernetes RBAC does not natively support Google Groups. While Google Groups can be used in IAM, direct mapping to Kubernetes roles is not possible without additional tooling.
- D. Incorrect.
This is incorrect because Kubernetes ClusterRoleBindings do not support direct binding to Google Cloud IAM roles. Workload Identity is needed for IAM and Kubernetes RBAC integration.