Your team uses Cloud Build for all CI/CD pipelines. You want to use the kubectl builder for Cloud Build to deploy new images to Google Kubernetes Engine (GKE). You need to authenticate to GKE while…

Question

Options

• AAssign the Container Developer role to the Cloud Build service account.
• BSpecify the Container Developer role for Cloud Build in the cloudbuild.yaml file.
• CCreate a new service account with the Container Developer role and use it to run Cloud Build.
• DCreate a separate step in Cloud Build to retrieve service account credentials and pass these to

• A
  88% (14)
• C
  6% (1)
• D
  6% (1)

Explanation

Cloud Build runs all pipeline steps using its own service account (the Cloud Build service account). The simplest and lowest-effort way to grant it access to GKE is to assign the Kubernetes Engine Developer role (or Container Developer role) directly to that existing service account via IAM. No additional credentials, steps, or accounts are needed-Cloud Build automatically uses this service account when executing steps. Option B is incorrect because you cannot grant IAM roles through the cloudbuild.yaml file; that file only defines build steps. Option C (creating a new service account) adds unnecessary complexity. Option D (a separate step to retrieve credentials) requires additional scripting and secret management, increasing development effort.

No community discussion yet for this question.