Examkin

Question

Difficulty: MediumContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

A cloud engineering team is designing a secure, automated Continuous Integration and Continuous Delivery (CI/CD) pipeline on Google Cloud to deploy containerized microservices to Google Kubernetes Engine (GKE) using Cloud Build, Artifact Registry, Binary Authorization, and Cloud Deploy. Arrange the operational pipeline stages in the correct chronological execution order from initial code commit to production rollout.

  1. 1Developers push code changes to the source repository, triggering Cloud Build to compile application code, run unit tests, and push the container image to Artifact Registry.
  2. 2Container Analysis scans the container image for vulnerabilities, and a KMS-backed attestor signs the image digest to generate a Binary Authorization attestation.
  3. 3Cloud Deploy creates a release referencing the attested image digest and initiates an automated deployment rollout to the staging GKE cluster.
  4. 4Automated integration tests run successfully in the staging environment, prompting Cloud Deploy to require explicit approval from a release manager before advancing.
  5. 5Upon receiving authorization, Cloud Deploy executes a progressive canary rollout strategy to deploy the new container release across the production GKE cluster.

Answer

The correct chronological sequence of pipeline stages is: (1) Source code commit triggers Cloud Build to compile code and push the container image to Artifact Registry, (2) Container Analysis scans the image and Cloud KMS signs the digest for Binary Authorization, (3) Cloud Deploy creates a release and deploys the attested image to the staging GKE cluster, (4) Integration tests pass in staging and Cloud Deploy requests explicit manual approval, and (5) Cloud Deploy executes a progressive canary rollout to the production GKE cluster upon approval.
The proper sequence aligns with Google Cloud CI/CD best practice architecture: artifact compilation (Cloud Build to Artifact Registry) -> security vulnerability scanning and attestation (Container Analysis and Binary Authorization) -> non-production deployment (Cloud Deploy to staging GKE) -> automated qualification testing and approval gating -> production rollout (Cloud Deploy progressive canary deployment).

Step-by-Step Solution

1
Identify the build phase (Continuous Integration)
Developers push code, which triggers Cloud Build to build the container image and upload it to Artifact Registry.
Building and publishing the container artifact must take place before security attestation scanning or deployment can begin.
2
Identify image security verification and attestation
Container Analysis performs vulnerability scanning and a KMS key signs the image digest for Binary Authorization.
GKE clusters configured with Binary Authorization require cryptographic attestations created from image digests prior to cluster admission.
3
Identify non-production release creation and deployment
Cloud Deploy creates a release specifying the signed digest and deploys to the staging GKE cluster.
Cloud Deploy manages continuous delivery across target environments, deploying first to pre-production targets.
4
Identify environment qualification and approval gating
Staging integration tests succeed and Cloud Deploy triggers a manual approval requirement for production rollout.
Enterprise governance requires automated staging validation followed by human authorization before production changes occur.
5
Identify final production deployment execution
Cloud Deploy carries out a progressive canary deployment to the production GKE cluster.
Canary rollouts safely update production workloads incrementally while monitoring for metrics regressions.

Key Concept

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design
Estimated Time:1m 30s
Rate this question

Topics

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

More questions from this topic