You are using Container Registry to centrally store your company's container images in a separate project. In another project, you want to create a Google Kubernetes Engine (GKE) cluster. You want to

Question

Options

• AIn the project where the images are stored, grant the Storage Object Viewer IAM role to the
• BWhen you create the GKE cluster, choose the Allow full access to all Cloud APIs option under
• CCreate a service account, and give it access to Cloud Storage. Create a P12 key for this service
• DConfigure the ACLs on each image in Cloud Storage to give read-only access to the default

• A
  81% (47)
• B
  12% (7)
• C
  5% (3)
• D
  2% (1)

Explanation

IAM permissions determine who can access resources. All users, service accounts, and other identities that interact with Container Registry must have the appropriate Cloud Storage By default, Google Cloud use default service accounts to interact with resources within the same project. For example, the Cloud Build service account can both push and pull images when Container Registry is in the same project. You must configure or modify permissions yourself if: You are using a service account in one project to access Container Registry in a different project You are using a default service account with read-only access to storage, but you want to both pull and push images You are using a custom service account to interact with Container Registry https://cloud.google.com/container-registry/docs/access-control

No community discussion yet for this question.