Container images are stored in Container Registry in one project. You will create a GKE cluster in another project and need the cluster nodes to pull those images. What should you do?
Choose an answer
Tap an option to check your answer.
Correct answer: In the project where the images are stored, grant the Storage Object Viewer IAM role to the service account used by the Kubernetes nodes..
Why this is the answer
GKE nodes use a service account to interact with Google Cloud APIs. To pull images from Container Registry (which uses Cloud Storage for storage), this service account needs the Storage Object Viewer IAM role in the project where the images reside. This grants read-only access to the image data. "Allow full access to all Cloud APIs" is overly permissive and not recommended for fine-grained control. Creating a P12 key and using imagePullSecrets is an older, less secure method for authentication compared to using service account permissions directly. Configuring ACLs on individual images is cumbersome and not the standard way to manage access for Container Registry, which relies on IAM roles.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed