Professional Cloud Developer · Free Practice Question Medium
Question 8
A microservice-based application is being developed for deployment on a Google Kubernetes Engine cluster. The application requires both read and write access to a Spanner database. Security best practices must be followed while minimizing changes to the existing code.
What is the recommended configuration for obtaining Spanner credentials for your application?
- A Set up the necessary routing rules and employ a VPC-native cluster to directly link to the database.
- B Save the application authentication data as Kubernetes Secrets and uncover them as environment variables.
- C Configure the appropriate service accounts and utilize Workload Identity to execute the pods.
- D Save the application authentication data using Cloud Key Management Service and obtain them whenever a database connection is established.
Reveal correct answer
Correct answer: C
Explanation
According to the Professional Google Cloud Developer documentation, one way to configure an application to retrieve Spanner credentials while following security best practices and minimizing code changes is to configure the appropriate service accounts and use Workload Identity to run the pods. This approach avoids the burden of generating individual IAM service accounts for each application and manually rotating the keys as Kubernetes secrets. Instead, Workload Identity allows pods to use their own identity and associated permissions, removing the need for managing service account keys as secrets. This approach also reduces the potential blind spots and management overhead associated with key inventory and rotation, making it a better method for authenticating GKE workloads.Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
You must be logged in to post a comment.
