Examkin

Question

Difficulty: MediumContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

A DevOps team is establishing a secure continuous delivery pipeline on Google Cloud to deploy microservices to Google Kubernetes Engine (GKE) using Cloud Build, Artifact Registry, Binary Authorization, and Cloud Deploy. Place the operational steps of the deployment pipeline in the correct chronological order from initial code commit to final production deployment.

  1. 1Developer pushes updated application source code to the Git repository, triggering a Cloud Build pipeline.
  2. 2Cloud Build executes automated unit tests, builds the container image, and pushes the image artifact to Artifact Registry.
  3. 3Security scanner verifies the container image and a digital attestation is signed by the KMS key for Binary Authorization.
  4. 4Cloud Deploy initiates a release and deploys the container workload to the staging GKE cluster after Binary Authorization validates the attestation.
  5. 5Following successful validation and approval in staging, Cloud Deploy promotes the release rollout to the production GKE cluster.

Answer

The correct chronological order of the CI/CD pipeline execution is: (1) Push source code to Git to trigger Cloud Build, (2) Execute tests, build the container image, and push it to Artifact Registry, (3) Perform vulnerability scanning and sign a Binary Authorization attestation, (4) Create a Cloud Deploy release to deploy the workload to the staging cluster under Binary Authorization policy enforcement, and (5) Promote the release rollout to the production cluster upon validation.
The deployment sequence follows secure software supply chain best practices on Google Cloud: Source control trigger -> Cloud Build artifact generation -> Binary Authorization attestation signing -> Staging deployment via Cloud Deploy -> Production promotion.

Step-by-Step Solution

1
Trigger continuous integration upon code commit.
Cloud Build pipeline execution is initiated by Git repository webhook integration.
CI pipelines begin with source code updates to validate changes early.
2
Build and store the container image.
Container image is compiled, verified via unit tests, and published to Google Cloud Artifact Registry.
Centralizing artifacts in Artifact Registry is required before vulnerability scanning or deployment can take place.
3
Enforce supply chain security via digital attestations.
Binary Authorization attestation is generated using Cloud KMS after security checks pass.
Binary Authorization policy mandates that container images carry valid signed attestations prior to cluster deployment.
4
Deploy workload to staging via Cloud Deploy.
Cloud Deploy creates a release and provisions the deployment into the staging GKE cluster.
Deploying to non-production environments first ensures runtime stability and validation before production promotion.
5
Promote release to production target.
Cloud Deploy executes the production deployment rollout.
Promoting through predefined target delivery pipelines guarantees progressive and reliable release management.

Key Concept

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design
Rate this question

Topics

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

More questions from this topic