Points to remember

The following are some important points to remember:

• GCP service accounts are used if GCP resources must have an identity that is tied to an application or a virtual machine.
• Kubernetes service accounts are users that are managed by the Kubernetes API.
• Cloud IAM defines who can view or change the configuration of a GKE cluster and Kubernetes RBAC defines who can view or change Kubernetes objects inside the specific GKE cluster.
• Workload Identity is used to access Google Cloud services from applications running within GKE. This prevents pods from accessing the Compute Engine metadata server.
• In RBAC, a Role connects API resources and verbs. An RBAC Role is cluster-wide scoped, while an RBAC ClusterRole is namespace scoped.
• In RBAC, RoleBindings connect Roles to subjects. A RoleBinding is cluster-wide scoped, while a ClusterRoleBinding is namespace scoped.
• Every GKE cluster has its own root CA.
• Pod Security Context and Pod Security...