GCP PCA · Question 26 · Domain 2: Managing and Provisioning a Solution Infrastructure
A pod running in GKE needs to access a Cloud Storage bucket. You want to follow the principle of least privilege and avoid managing service account keys manually. What is the recommended approach?
Answer options:
Export a JSON key and store it in a Kubernetes Secret.
Assign the required IAM role to the GKE Node's underlying Compute Engine service account.
Use Workload Identity to bind a Kubernetes Service Account to a Google Service Account.
Make the Cloud Storage bucket public.
50 questions · hints · full answers · grading
Expert