Professional Cloud DeveloperDemo

By Google · Question Mode

QuestionQ214

Integrating applications with Google Cloud services

You are building a microservice-based application that will be deployed to a Google Kubernetes Engine cluster. The application must read from and write to a Spanner database. You want to follow security best practices while making minimal code changes. How should you configure the application to obtain Spanner credentials?

  • A Configure the appropriate service accounts, and use Workload Identity to run the pods.
  • B Store the application credentials as Kubernetes Secrets, and expose them as environment variables.
  • C Configure the appropriate routing rules, and use a VPC-native cluster to directly connect to the database.
  • D Store the application credentials using Cloud Key Management Service, and retrieve them whenever a database connection is made.
Explanation

Workload Identity Federation for GKE lets Pods use a Kubernetes service account with IAM permissions for Spanner and provides short-lived Application Default Credentials. This avoids storing static service-account credentials in Kubernetes Secrets or retrieving them from another service, while allowing standard Spanner client libraries to authenticate with minimal code changes.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!