Question

Your team runs a microservice in a Google Kubernetes Engine (GKE) cluster that needs to read objects from a specific Cloud Storage bucket. Security policy prohibits creating and distributing service-account key files, and you must follow the principle of least privilege. What is the recommended way to grant the pods access?

Accepted Answer

Enable Workload Identity on the cluster, bind the Kubernetes service account to a Google service account granted roles/storage.objectViewer on the bucket.

Answer

Create a service-account key, store it in a Kubernetes Secret, and mount it into the pods as GOOGLE_APPLICATION_CREDENTIALS.

Answer

Grant the Compute Engine default service account the Editor role at the project level so all nodes can access the bucket.

Answer

Set the node pool's access scope to cloud-platform so the underlying VMs can reach Cloud Storage.