Examkin

Question

Difficulty: MediumAutomating Continuous Deployment Pipelines and Release Strategies

An enterprise architecture team is designing an automated progressive delivery release pipeline using Google Cloud Deploy for a microservice deployed on Google Kubernetes Engine (GKE). The pipeline must enforce container image provenance via Binary Authorization and perform automated canary metric verification prior to full traffic shifting.

Arrange the following pipeline execution steps in the correct chronological order from source build to final production rollout.

  1. 1Cloud Build compiles the container image and generates a cryptographic signature using Cloud KMS to establish a Binary Authorization attestation.
  2. 2Cloud Build pushes the signed container artifact to Artifact Registry and registers a new release in Google Cloud Deploy.
  3. 3Google Cloud Deploy provisions the canary rollout phase in the target GKE cluster, directing 10% of live traffic to the new revision.
  4. 4Cloud Monitoring metrics evaluate Service Level Indicators (SLIs) such as HTTP error rates and latency over a defined observation window.
  5. 5Google Cloud Deploy advances the rollout phase to shift 100% of production traffic to the validated release revision.

Answer

The correct chronological sequence for the progressive delivery pipeline is: 1) Cloud Build compiles the image and generates a Binary Authorization attestation with Cloud KMS, 2) Cloud Build pushes the image to Artifact Registry and registers a release in Cloud Deploy, 3) Cloud Deploy provisions a canary rollout with 10% traffic routing, 4) Cloud Monitoring verifies SLIs during the observation window, and 5) Cloud Deploy advances the phase to route 100% of production traffic.
The deployment pipeline follows a logical progressive delivery workflow: artifact compilation and Binary Authorization attestation signing (via Cloud KMS in Cloud Build) must precede release registration in Google Cloud Deploy. Once registered, Cloud Deploy executes canary traffic shifting (routing 10% traffic), followed by automated SLI evaluation via Cloud Monitoring during an observation window. Only after metric verification completes successfully can Cloud Deploy promote the deployment phase to shift 100% of production traffic.

Step-by-Step Solution

1
Generate build artifacts and attestations in CI
Container image is built and signed via Cloud KMS for Binary Authorization enforcement.
Binary Authorization requires attestations to exist prior to image deployment in protected target environments.
2
Store artifact and trigger Continuous Delivery pipeline
Artifact is stored in Artifact Registry and a Cloud Deploy release is instantiated.
Cloud Deploy releases depend on immutable image digest references stored in Artifact Registry.
3
Execute initial canary phase deployment
Canary pod revision is deployed to GKE with 10% traffic split.
Progressive delivery starts with limited traffic exposure to restrict potential impact from regressions.
4
Perform automated metrics analysis
Cloud Monitoring validates error rates and latency SLIs over the observation period.
Automated telemetry checking confirms system stability before expanding deployment scope.
5
Promote to full production traffic
Cloud Deploy routes 100% of traffic to the new revision.
Successful metric evaluation allows the pipeline to conclude with full production promotion.

Key Concept

Automating Continuous Deployment Pipelines and Release Strategies using Google Cloud Deploy, Binary Authorization, and Canary Analysis
Rate this question

Topics

Automating Continuous Deployment Pipelines and Release Strategies