Question 175 of 202
Single answerYou are designing a new multi-tenant Google Kubernetes Engine (GKE) cluster for a customer. Your customer is concerned with the risks associated with long-lived credentials use. The customer requires that each GKE workload has the minimum Identity and Access Management (IAM) permissions set following the principle of least privilege (PoLP). You need to design an IAM impersonation solution while following Google-recommended practices. What should you do?
A. 1. Create a Google service account.
2. Create a node pool, and set the Google service account as the default identity.
3. Ensure that workloads can only run on the designated node pool by using node selectors, taints, and tolerations.
4. Repeat for each workload.
B. 1. Create a Google service account.
2. Create a node pool without taints, and set the Google service account as the default identity.
3. Grant IAM permissions to the Google service account.
C. 1. Create a Google service account.
2. Create a Kubernetes service account in a Workload Identity-enabled cluster.
3. Link the Google service account with the Kubernetes service account by using the roles/iam.workloadIdentityUser role and iam.gke.io/gcp-service-account annotation.
4. Map the Kubernetes service account to the workload.
5. Repeat for each workload.
D. 1. Create a Google service account.
2. Create a service account key for the Google service account.
3. Create a Kubernetes secret with a service account key.
4. Ensure that workload mounts the secret and set the GOOGLE_APPLICATION_CREDENTIALS environment variable to point at the mount path.
5. Repeat for each workload.
<p>C. 1. Create a Google service account.<br>2. Create a Kubernetes service account in a Workload Identity-enabled cluster.<br>3. Link the Google service account with the Kubernetes service account by using the roles/iam.workloadIdentityUser role and iam.gke.io/gcp-service-account annotation.<br>4. Map the Kubernetes service account to the workload.<br>5. Repeat for each workload.</p>
The correct answer is highlighted above. Review the wording carefully, then use the next question to continue building your understanding of Google certification topics.