Your team manages a Google Kubernetes Engine (GKE) cluster where an application is running. A different team is planning to integrate with this application. Before they start the integration, you…

Question

Options

• AUsing Identity and Access Management (IAM), grant the Viewer IAM role on the cluster project to
• BCreate a new GKE cluster. Using Identity and Access Management (IAM), grant the Editor role on
• CCreate a new namespace in the existing cluster. Using Identity and Access Management (IAM),
• DCreate a new namespace in the existing cluster. Using Kubernetes role-based access control

• A
  5% (1)
• B
  5% (1)
• C
  11% (2)
• D
  79% (15)

Explanation

Kubernetes RBAC provides namespace-scoped permissions, which is precisely the right tool here. By creating a separate namespace for the other team and granting them a Role/RoleBinding limited to that namespace (e.g., edit role on their namespace), they can deploy freely in their own namespace while having no access to yours. IAM roles (A, B, C) are GKE cluster-level and cannot be scoped to a specific namespace - granting Viewer (A) would prevent the other team from deploying anything, and granting Editor (B) on the project gives too much access. Option C uses IAM for namespace isolation, which IAM cannot enforce; only Kubernetes RBAC can enforce namespace-level boundaries.

No community discussion yet for this question.