Secure Multicloud Pipeline Secret Manager Workload Identity

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise DevOps team is architecting a multi-cloud continuous deployment pipeline using Argo CD hosted on an external Kubernetes cluster. The pipeline needs to deploy application artifacts and fetch sensitive database credentials directly from Google Cloud Secret Manager across projects.

Corporate security policy strictly prohibits the creation, distribution, and storage of downloadable long-lived service account keys (.json key files) within external CI/CD systems.

Which solution should the team implement to authenticate the external pipeline to Google Cloud while maintaining least-privilege access control?

Store external cluster credentials in Secret Manager, retrieve the secret's resource name, and use basic HTTP authentication to fetch secrets over the public Secret Manager REST API.

Generate Google Cloud service account JSON keys programmatically via Cloud Functions, rotate them daily into Kubernetes Secret objects, and grant the service account the Secret Manager Admin role at the project level.

Configure Identity-Aware Proxy (IAP) TCP forwarding on the external runner nodes and grant the IAP-secured Tunnel User role to the external cluster's default compute service principal.

Configure Workload Identity Federation with an OIDC identity pool for the external cluster, map the Kubernetes service account to a Google Cloud service account, and grant that service account the Secret Manager Secret Accessor role on only the targeted secrets.

Professional Cloud DevOps Engineer

Secure Multicloud Pipeline Secret Manager Workload Identity

Related questions