Professional Cloud DeveloperDemo

By Google · Question Mode

QuestionQ273

Integrating applications with Google Cloud services

You are a developer at a large organization. An application written in Go runs in a production Google Kubernetes Engine (GKE) cluster. You need to add a feature that requires access to BigQuery. You want to grant the GKE cluster access to BigQuery by following Google-recommended best practices. What should you do?

  • A Create a Google service account with BigQuery access. Add the JSON key to Secret Manager, and use the Go client library to access the JSON key.
  • B Create a Google service account with BigQuery access. Add the Google service account JSON key as a Kubernetes secret, and configure the application to use this secret.
  • C Create a Google service account with BigQuery access. Add the Google service account JSON key to Secret Manager, and use an init container to access the secret for the application to use.
  • D Create a Google service account and a Kubernetes service account. Configure Workload Identity on the GKE cluster, and reference the Kubernetes service account on the application Deployment.
Explanation

Workload Identity Federation for GKE provides Kubernetes workloads with a managed identity for access to Google Cloud APIs, including BigQuery, without exporting or storing service-account JSON keys. An IAM service account can receive the necessary BigQuery role, while the Deployment runs under the corresponding Kubernetes service account.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!