A cloud engineering team is establishing an automated continuous delivery pipeline for a containerized microservice running on Google Kubernetes Engine (GKE). The architecture requires container image building, vulnerability scanning, cryptographic image attestation, progressive canary deployment, and metric-driven production promotion using Cloud Build, Artifact Registry, Binary Authorization, Cloud Deploy, and Cloud Monitoring. In what chronological sequence should these operational pipeline stages execute from source commit to full release verification?
- 1Cloud Build triggers on source commit to compile code, build the container image, and push it to Artifact Registry.
- 2Container Analysis scans the image for vulnerabilities, and Cloud Key Management Service (Cloud KMS) generates a Binary Authorization attestation upon validation.
- 3Cloud Deploy initiates a release to deploy the attested container image to the GKE canary target, shifting 10% of ingress traffic to the new revision.
- 4Cloud Monitoring tracks Service Level Indicators (SLIs) during the canary window, allowing Cloud Deploy to promote the release to 100% production traffic upon meeting error budget criteria.
Answer
The correct pipeline execution order is: 1) Triggering Cloud Build to construct and store the container image in Artifact Registry, 2) Scanning the image and creating a signed Binary Authorization attestation with Cloud KMS, 3) Deploying via Cloud Deploy to a GKE canary target with 10% traffic, and 4) Validating metrics via Cloud Monitoring before promoting to 100% production traffic.
The sequence logically progresses through CI build generation, automated vulnerability scanning and policy attestation signing, initial low-risk deployment (canary), and metric-driven full release promotion.
Step-by-Step Solution
Key Concept
Automated CI/CD Pipeline Sequencing with Cryptographic Attestation and Progressive Delivery