You are running code in Google Kubernetes Engine (GKE) containers in Google Cloud that require access to objects stored in a Cloud Storage bucket. You need to securely grant the Pods access to the…

Question

Options

• ACreate a service account. Grant bucket access to the Pods by using Workload Identity Federation
• BCreate a service account with keys. Store the keys in Secret Manager with a 30-day rotation
• CCreate a service account with keys. Store the keys as a Kubernetes secret. Reference the keys in
• DCreate a service account with keys. Store the keys in Secret Manager. Reference the keys in the

• A
  80% (36)
• B
  11% (5)
• C
  7% (3)
• D
  2% (1)

Explanation

Workload Identity Federation (WIF) is the recommended, keyless way to grant GKE Pods access to Google Cloud services like Cloud Storage. WIF allows a Kubernetes service account to impersonate a Google Cloud service account without any long-lived credentials. This eliminates key rotation, storage, and lifecycle management overhead entirely. Options B, C, and D all involve creating and managing service account key files - a pattern Google explicitly discourages because keys can be leaked, require rotation, and introduce significant management burden. WIF is the principle of least privilege in action: the Pod gets exactly the access it needs with no static secret material to manage.

No community discussion yet for this question.