Professional Cloud DeveloperDemo

By Google · Question Mode

QuestionQ20

Integrating applications with Google Cloud services

You are building a microservice-based application that will run on Google Kubernetes Engine (GKE). Some services must access different Google Cloud APIs. How should you configure authentication for these services in the cluster according to Google-recommended best practices?

Choose two
  • A Use the service account attached to the GKE node.
  • B Enable Workload Identity in the cluster via the gcloud command-line tool.
  • C Access the Google service account keys from a secret management service.
  • D Store the Google service account keys in a central secret management service.
  • E Use gcloud to bind the Kubernetes service account and the Google service account using roles/iam.workloadIdentity.
Explanation

Workload Identity Federation for GKE is the recommended mechanism for workloads to access Google Cloud APIs because it provides distinct, fine-grained IAM identities without service-account key files. Enable it on the GKE cluster, then bind each Kubernetes service account to the appropriate Google service account using the roles/iam.workloadIdentityUser role.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!