Question

A team runs a Python application inside a GKE Standard cluster. The app needs to write objects to a Cloud Storage bucket. Following Google-recommended security practices, how should you provide the app with credentials to authenticate to Cloud Storage without managing long-lived key files?

Accepted Answer

Configure Workload Identity on the cluster, bind the Kubernetes service account to a Google service account that has the Storage Object Admin role, and annotate the pod's service account.

Answer

Create a service account key, store the JSON file in a Kubernetes Secret, and mount it into the pod, setting GOOGLE_APPLICATION_CREDENTIALS to its path.

Answer

Embed the service account key JSON directly in the container image so the application can read it at startup.

Answer

Grant the allUsers member the Storage Object Admin role on the bucket so the pod can write without any credentials.