Examkin

Question

Difficulty: MediumAutomating Continuous Deployment Pipelines and Release Strategies

An architecture team is establishing an automated progressive release pipeline for a mission-critical microservice deployed on Google Kubernetes Engine (GKE). The deployment process must strictly enforce container security attestations, progressive traffic shifting, and continuous automated health monitoring before achieving full production rollout. Place the operational stages of this release strategy in the correct chronological order from first to last.

  1. 1Cloud Build compiles the source code, builds the container artifact, and stores the image digest in Artifact Registry.
  2. 2Container Analysis scans the image for vulnerabilities, and a Binary Authorization attestor signs the image digest.
  3. 3Google Cloud Deploy initiates a pipeline release and provisions the validated image to the target GKE staging environment for integration testing.
  4. 4Cloud Deploy updates the GKE service ingress configuration to shift 10% of live production traffic to the canary deployment.
  5. 5Cloud Monitoring tracks Service Level Indicators (SLIs) during the canary window before Cloud Deploy promotes the release to receive 100% of production traffic.

Answer

The correct execution order begins with building and storing the container image in Artifact Registry, followed by Container Analysis scanning and Binary Authorization attestation signing. Next, Cloud Deploy provisions the workload to the staging environment. Once staging tests pass, Cloud Deploy routes 10% of live traffic to the canary release. Finally, Cloud Monitoring evaluates real-time SLIs before Cloud Deploy automatically promotes the release to 100% production traffic.
The sequence follows standard Google Cloud continuous delivery best practices: Code must first be compiled into an artifact in Artifact Registry. Security verification via Container Analysis and Binary Authorization attestation occurs next to ensure image compliance. The image is then deployed to staging via Google Cloud Deploy. Following successful staging validation, Cloud Deploy shifts a initial fraction (10%) of production traffic to the canary pods. Cloud Monitoring continuously tracks error rates and latency during this canary phase, permitting final promotion to 100% traffic only after stability criteria are satisfied.

Step-by-Step Solution

1
Source Compilation & Artifact Build
Container image created and pushed to Artifact Registry with a unique digest.
Source code must be packaged into an immutable container artifact before security scanning or deployment.
2
Vulnerability Scanning & Policy Attestation
Binary Authorization attestor generates a cryptographic signature confirming compliance.
GKE Binary Authorization admission controllers block deployments unless the image digest contains required attestations.
3
Staging Environment Deployment
Cloud Deploy renders Kubernetes manifests and deploys the workload to the staging target.
Initial deployment to non-production environments verifies deployment rendering and pre-release integration tests.
4
Canary Traffic Shifting
GKE ingress/service routes a controlled 10% fraction of user traffic to the canary pods.
Progressive delivery minimizes blast radius by testing new code against a small portion of live production traffic.
5
Automated SLI Validation & Production Promotion
Cloud Deploy shifts remaining 90% traffic to complete the production rollout after metrics verification.
Real-time monitoring of error rates and latency guarantees system stability before full traffic promotion.

Key Concept

Automated CI/CD Pipeline Execution Order with Progressive Canary Delivery and Binary Authorization
Rate this question

Topics

Automating Continuous Deployment Pipelines and Release Strategies