Question

A company runs microservices on a GKE cluster in a project named prod-apps. Each microservice currently authenticates to Cloud Storage and Pub/Sub using a downloaded service account JSON key mounted as a Kubernetes secret. The security team wants to eliminate long-lived service account keys entirely while allowing each Kubernetes service account to map to a distinct Google service account with least-privilege access. What should you implement?

Accepted Answer

Enable Workload Identity on the GKE cluster and node pools, then bind each Kubernetes service account to a Google service account using the iam.workloadIdentityUser role

Answer

Attach a single highly privileged Google service account to the GKE node pool so all pods inherit its permissions automatically

Answer

Rotate the service account JSON keys automatically every 24 hours using a Cloud Scheduler job and Secret Manager

Answer

Configure workload identity federation with an external OIDC provider pointed at the cluster's Kubernetes API server