Several pods on the same GKE node need different Cloud Storage permissions. Which feature lets each pod authenticate to Google Cloud APIs with its own IAM identity instead of the node's service account?
Show answer and explanation
Answer: A
Workload Identity Federation for GKE binds a Kubernetes service account to a Google Cloud IAM service account. Each pod that uses that Kubernetes identity receives short-lived credentials for its own IAM account, so two workloads on the same node can hold different permissions. Without it, pods inherit the node's service account. No downloaded key files are needed. Shielded nodes verify boot integrity, Binary Authorization checks image provenance, and Network Policy governs pod-to-pod traffic.
Why the other options are wrong
- B. Shielded GKE Nodes add verified boot and integrity monitoring for node VMs. They protect the node itself but do not map individual pods to distinct IAM identities.
- C. Binary Authorization enforces deploy-time policy on container images using attestations. It does not decide which Google Cloud identity a pod uses for API calls.
- D. Network Policy restricts which pods can talk to each other over the network. It does not change the Google Cloud credentials that workloads present to APIs.