This is the principle of least privilege. Always apply the minimal access level required Use groups as a best practice as well. Control who can change policies and group memberships. Enforce audit policy changes and always enable audit logs to record project-level permission changes

A service account is a special kind of account used by an application or compute workload, such as a Compute Engine virtual machine (VM) instance, rather than a person. Applications use service accounts to make authorized API calls, authorized as either the service account itself, or as Google Workspace or Cloud Identity users through domain-wide delegation.

For example, a service account can be attached to a Compute Engine VM, so that applications running on that VM can authenticate as the service account. In addition, the service account can be granted IAM roles that let it access resources. The service account is used as the identity of the application, and the service account's roles control which resources the application can access.

Reference

https://cloud.google.com/compute/docs/access/service-accounts

dependsOn You can specify these dependencies using the dependsOn option in your configuration files or templates. When you add the dependsOn option for a resource, Deployment Manager creates or updates the dependencies before creating or updating the resource.

Reference

https://cloud.google.com/deployment-manager/docs/configuration/create-explicit-dependencies

You can create two types of managed instance groups: A zonal managed instance group, which contains instances from the same zone. A regional managed instance group, which contains instances from multiple zones across the same region. Lastly, don’t confused over an unmanaged instance group.

Reference

https://cloud.google.com/compute/docs/instance-groups/

The command syntax to inspect pods is the same as you would use for your on-premises deployments. kubectl get pods

App Engine is a Platform as a Service (PaaS). It was built to Develop, Scale and Test applications.

Reference

https://cloud.google.com/appengine/

Binary Authorization is a deploy-time security control that ensures only trusted container images are deployed on Google Kubernetes Engine (GKE). Using Binary Authorization, you can require images to be signed by trusted authorities during the development process and then enforce signature validation when deploying.

Reference

https://cloud.google.com/binary-authorization

Global resources are accessible by any resource in any zone within the same project. When you create a global resource, you do not need to provide a scope specification.

Global resources include: Snapshots are accessible by any resource in any zone within the same project. When you create a global resource, you do not need to provide a scope specification.

Global resources include: Images can be used by any instance or disk resource in the same project as the image. Google provides preconfigured images that you can use to boot your instance. You can customize one of these images, or you can build your own image.

Reference

https://cloud.google.com/compute/docs/regions-zones/global-regional-zonal-resources

You can create namespace using below command: kubectl create namespace.

Reference

https://kubernetes.io/docs/tasks/administer-cluster/namespaces/#creating-a-new-namespace

docker push command will push an image or a repository to a registry such as Container Registry. Specify the hostname which specifies location where you will store the image.. To specify use these prefixes (multi-region). gcr.io hosts images in data centers in the United States, but the location may change in the future. us.gcr.io hosts image in data centers in the United States, in a separate storage bucket from images hosted by gcr.io. eu.gcr.io hosts the images in the European Union. asia.gcr.io hosts images in data centers in Asia. The Docker credential helper is the simplest way to configure Docker to authenticate directly with Container Registry.

You then use the docker command to tag, push, and pull images. Alternatively, you can use the client libraries to manage container images, or you can interact directly with the Docker API