An organization is setting up an automated continuous delivery pipeline for a microservice deployed to Cloud Run using Google Cloud Deploy. The architecture team requires progressive traffic shifting to canary instances during release rollout and mandatory container image security attestation before deployment. Which TWO deployment pipeline configurations should you implement to satisfy these requirements?
- Configure a Google Cloud Deploy delivery pipeline with a canary deployment strategy specifying explicit traffic split percentages.Answer
- Enable Binary Authorization policy enforcement on the target environment to validate attestations signed by the CI/CD pipeline.Answer
- CAssign the primitive Owner role to the pipeline service account so that build steps have unrestricted resource access across all project targets.
- DStore the deployment infrastructure state file in local runner disk storage without Cloud Storage versioning enabled.
- EGrant the Service Account Admin role to the build service account to grant access to compute resources during the execution phase.
Answer
To establish a secure continuous delivery pipeline with canary release capabilities on Google Cloud, you should configure a Cloud Deploy delivery pipeline with explicit canary traffic split percentages and enforce Binary Authorization policy validation for container image attestations.
Configuring Cloud Deploy with a canary delivery strategy allows automated progressive traffic management for Cloud Run targets. Combining this with Binary Authorization ensures that only container images that have passed vulnerability scans and signed attestations can be deployed into the target environment.
Step-by-Step Solution
Key Concept
Automating progressive canary deployments using Cloud Deploy combined with Binary Authorization container security policy enforcement.