Examkin

Question

Difficulty: HardAutomating Continuous Deployment Pipelines and Release Strategies

An enterprise media streaming company is designing an automated continuous delivery pipeline for microservices deployed on Cloud Run using Cloud Build and Google Cloud Deploy. The architecture team requires progressive traffic shifting with automated rollback whenever latency or error rate metrics exceed defined thresholds during a release. Additionally, all container images deployed to production must be verifiably built by the authorized continuous integration pipeline, and individual developers must be prevented from executing direct manual deployments to production environments. Which TWO architectural configurations should the team implement to satisfy these requirements? (Select TWO)

  1. Define Google Cloud Deploy targets and release pipelines configured with automated canary deployment strategies, integrating verification routines and automated rollbacks driven by Cloud Monitoring metric checks.Answer
  2. Configure Binary Authorization on the target Cloud Run services requiring attestations generated by Cloud Build, and restrict production deployment permissions strictly to the Cloud Deploy service account using IAM service account impersonation.Answer
  3. C
    Grant the Cloud Build service account the primitive Owner role (`roles/owner`) on the target Google Cloud project to allow full administrative override capability across Cloud Run and Cloud Monitoring resources.
  4. D
    Configure local developer workstations with direct gcloud CLI deployment access to production Cloud Run instances to enable emergency manual overrides bypassing IaC and continuous deployment pipelines.
  5. E
    Grant developers the Service Account Admin role (`roles/iam.serviceAccountAdmin`) on the Cloud Deploy execution service account so they can update service account credentials directly during build runs.

Answer

The team should configure Google Cloud Deploy progressive canary release strategies with automated rollback capabilities based on metric checks, and enforce Binary Authorization attestations signed by Cloud Build while restricting deployment IAM permissions to the Cloud Deploy execution service account.
To achieve secure, automated release management on GCP, Google Cloud Deploy provides built-in progressive delivery features like canary deployments with automated rollback options upon metric or phase check failures. Pairing this with Binary Authorization ensures container images deployed to Cloud Run originate strictly from the verified Cloud Build pipeline. Restricting IAM rights to the deployment pipeline service account ensures compliance and prevents direct developer modifications.

Step-by-Step Solution

1
Configure progressive release automation
Google Cloud Deploy delivery pipelines execute automated canary releases that evaluate metrics via Cloud Monitoring and trigger rollbacks if thresholds are breached.
Meets the requirement for progressive traffic shifting and automated failure mitigation.
2
Enforce artifact governance and minimal IAM access
Binary Authorization ensures only authorized container builds are deployed to Cloud Run, and IAM restrictions prevent developers from deploying directly.
Satisfies supply chain security requirements and enforces centralized CI/CD deployment execution.

Key Concept

Automating Continuous Deployment Pipelines and Release Strategies
Rate this question

Topics

Automating Continuous Deployment Pipelines and Release Strategies