Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!
Prepare and test your skills
Prepare and test your skills
Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.
Keep the momentum going with these hand-picked practice scenarios
Want more questions like this?
Get a free certification question every week.
Last updated
An enterprise is running containerized microservices in a Google Kubernetes Engine (GKE) cluster. Currently, these microservices access Google Cloud APIs by mounting long-lived service account private key JSON files stored as Kubernetes secrets.
The security compliance team has flagged this practice due to the severe risk of credential leakage and unauthorized key export. They require an authentication architecture that eliminates static keys and enforces least privilege access for each individual microservice workload.
Which solution should the cloud architect implement?
Implement an automated Cloud Function to regenerate and rotate service account JSON keys every 24 hours, updating the Kubernetes secrets accordingly.
Store the service account private key JSON files in Secret Manager and configure microservices to dynamically fetch the keys using Secret Manager API at startup.
Grant the necessary IAM roles directly to the default Compute Engine service account attached to the GKE cluster node pool.
Enable Workload Identity on the GKE cluster, configure each pod to use a dedicated Kubernetes Service Account (KSA), bind the KSA to a Google Service Account (GSA) using the Workload Identity User role, and annotate the KSA.
Implement an automated Cloud Function to regenerate and rotate service account JSON keys every 24 hours, updating the Kubernetes secrets accordingly.
Store the service account private key JSON files in Secret Manager and configure microservices to dynamically fetch the keys using Secret Manager API at startup.
Grant the necessary IAM roles directly to the default Compute Engine service account attached to the GKE cluster node pool.
Enable Workload Identity on the GKE cluster, configure each pod to use a dedicated Kubernetes Service Account (KSA), bind the KSA to a Google Service Account (GSA) using the Workload Identity User role, and annotate the KSA.
Workload Identity is the recommended best practice for authenticating workloads running on Google Kubernetes Engine (GKE) against Google Cloud APIs. It links a native Kubernetes Service Account (KSA) inside the cluster to a specific Google Service Account (GSA) in IAM, allowing pods to authenticate seamlessly without needing downloadable service account keys.
StudyCerts
StudyCertsroles/iam.workloadIdentityUser IAM role to tightly govern which Kubernetes namespaces and service accounts can act as the GSA.Compared to managing Kubernetes secrets or node pool service accounts, Workload Identity provides strong security isolation, eliminates operational key management overhead, and ensures compliance with enterprise zero-trust security standards.