Exam Professional Cloud DevOps Engineer topic 1 question 93 discussion

Actual exam question from Google's Professional Cloud DevOps Engineer

Question #: 93
Topic #: 1

[All Professional Cloud DevOps Engineer Questions]

You are creating a CI/CD pipeline to perform Terraform deployments of Google Cloud resources. Your CI/CD tooling is running in Google Kubernetes Engine (GKE) and uses an ephemeral Pod for each pipeline run. You must ensure that the pipelines that run in the Pods have the appropriate Identity and Access Management (IAM) permissions to perform the Terraform deployments. You want to follow Google-recommended practices for identity management. What should you do? (Choose two.)

A. Create a new Kubernetes service account, and assign the service account to the Pods. Use Workload Identity to authenticate as the Google service account.
B. Create a new JSON service account key for the Google service account, store the key as a Kubernetes secret, inject the key into the Pods, and set the GOOGLE_APPLICATION_CREDENTIALS environment variable.
C. Create a new Google service account, and assign the appropriate IAM permissions.
D. Create a new JSON service account key for the Google service account, store the key in the secret management store for the CI/CD tool, and configure Terraform to use this key for authentication.
E. Assign the appropriate IAM permissions to the Google service account associated with the Compute Engine VM instances that run the Pods.

Show Suggested Answer

Suggested Answer: AC 🗳️

by PrayasMohanty at Oct. 6, 2023, 4:43 a.m.

Comments

Submit Cancel

manishk39

3 months, 3 weeks ago

Selected Answer: AC

the best options are A and C, which involve creating a Google service account, assigning the necessary IAM permissions, and using Workload Identity to securely authenticate the Pods running the CI/CD pipeline.

upvoted 1 times

...

JonathanSJ

4 months ago

Selected Answer: AC

I will go for AC

upvoted 1 times

...

6a8c7ad

10 months ago

Selected Answer: CD

C and D. Gke service account needs to impersonate.

upvoted 1 times

...

xhilmi

1 year, 6 months ago

Selected Answer: AC

Option A: Suggests creating a new Kubernetes service account and assigning it to the Pods. This service account is then associated with a Google service account using Workload Identity. This setup enables seamless authentication of Pods as the specified Google service account without relying on manual management of service account keys. Option C: Complements the approach by emphasizing the creation of a new Google service account and assigning the necessary IAM permissions. While the Kubernetes service account establishes the identity within the GKE cluster, the Google service account is associated with the underlying Google Cloud resources, ensuring that the appropriate permissions are granted for Terraform deployments.

upvoted 4 times

...

khoukha

1 year, 7 months ago

Selected Answer: AC

A.for the pod to authenticate as service account with the necessary permissions without handling keys C.to perform operations on google cloud ressources

upvoted 4 times

...

Jason_Cloud_at

1 year, 7 months ago

Selected Answer: AC

I would go with A,C

upvoted 3 times

...

ldgomez

1 year, 7 months ago

I think is A, C Workload Identity is the recommended way to authenticate to Google Cloud services from GKE. reference: https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform

upvoted 4 times

...