A Go app in production GKE needs BigQuery access. Following Google best practices, how should you grant access?
Choose an answer
Tap an option to check your answer.
Correct answer: Create a Google service account and a Kubernetes service account, enable Workload Identity on the cluster, and bind the Kubernetes service account to the Google service account for the Deployment..
Why this is the answer
The correct approach is to use Workload Identity. This Google-recommended best practice securely allows Kubernetes service accounts to act as Google service accounts. You create a Google service account with the necessary BigQuery permissions and a Kubernetes service account. Then, you bind the Kubernetes service account to the Google service account and configure your Deployment to use the Kubernetes service account. This eliminates the need to manage and distribute service account keys, reducing security risks. The other options involve managing service account JSON keys, which is less secure. Storing keys directly in Kubernetes secrets or Secret Manager still requires handling sensitive credentials within your application or infrastructure, increasing the attack surface. Workload Identity handles credential rotation and distribution automatically, improving security and operational efficiency.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed