Professional Cloud DeveloperDemo

By Google · Question Mode

QuestionQ289

Deploying applications

Your team operates a Google Kubernetes Engine (GKE) cluster that runs an application. Another team plans to integrate with this application. Before they begin the integration, you must ensure that the other team cannot modify your application, while still allowing them to deploy the integration on GKE. What should you do?

  • A Using Identity and Access Management (IAM), grant the Viewer IAM role on the cluster project to the other team.
  • B Create a new GKE cluster. Using Identity and Access Management (IAM), grant the Editor role on the cluster project to the other team.
  • C Create a new namespace in the existing cluster. Using Identity and Access Management (IAM), grant the Editor role on the cluster project to the other team.
  • D Create a new namespace in the existing cluster. Using Kubernetes role-based access control (RBAC), grant the Admin role on the new namespace to the other team.
Explanation

Kubernetes RBAC can grant permissions at the namespace level. Creating a separate namespace and granting the other team the Admin role only in that namespace allows them to deploy and manage their integration there without authorizing changes to workloads in the application’s namespace. IAM roles such as Editor operate at the Google Cloud project level and cannot be limited to a particular Kubernetes namespace.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!