Topic 1 Question 191
You have an application deployed in Google Kubernetes Engine (GKE). You need to update the application to make authorized requests to Google Cloud managed services. You want this to be a one-time setup, and you need to follow security best practices of auto-rotating your security keys and storing them in an encrypted store. You already created a service account with appropriate access to the Google Cloud service. What should you do next?
Assign the Google Cloud service account to your GKE Pod using Workload Identity.
Export the Google Cloud service account, and share it with the Pod as a Kubernetes Secret.
Export the Google Cloud service account, and embed it in the source code of the application.
Export the Google Cloud service account, and upload it to HashiCorp Vault to generate a dynamic service account for your application.
ユーザの投票
コメント(5)
- 正解だと思う選択肢: A
A is the answer.
https://cloud.google.com/kubernetes-engine/docs/concepts/workload-identity Applications running on GKE might need access to Google Cloud APIs such as Compute Engine API, BigQuery Storage API, or Machine Learning APIs.
Workload Identity allows a Kubernetes service account in your GKE cluster to act as an IAM service account. Pods that use the configured Kubernetes service account automatically authenticate as the IAM service account when accessing Google Cloud APIs. Using Workload Identity allows you to assign distinct, fine-grained identities and authorization for each application in your cluster.
👍 1zellck2022/12/13 - 正解だと思う選択肢: A
option A
👍 1sharath252022/12/13 Answer A
👍 1TNT872022/12/25
シャッフルモード