Examkin

Question

Difficulty: Very hardAutomating Continuous Deployment Pipelines and Release Strategies

A high-throughput logistics firm uses Google Cloud Deploy to automate release pipelines for a mission-critical fleet management service running on Google Kubernetes Engine (GKE). The team is configuring a progressive release strategy that deploys candidate releases through a canary phase followed by automated rollout to production GKE targets upon successful validation. The release management team needs to ensure the execution service account used by Cloud Deploy has minimal required permissions to perform render and deploy operations on the GKE targets, while preventing infrastructure state corruption during automated Infrastructure as Code (IaC) pipeline runs. Which combination of IAM roles and pipeline state management configurations should be implemented to satisfy these operational and security requirements?

  1. Grant roles/clouddeploy.jobRunner and roles/container.developer to the Cloud Deploy execution service account, grant roles/iam.serviceAccountUser on the target GKE service account, and store pipeline Terraform state in a remote Cloud Storage bucket with versioning and object locking enabled.Answer
  2. B
    Grant the primitive roles/owner role to the Cloud Deploy execution service account across target projects to streamline pipeline rendering and cluster deployment permissions.
  3. C
    Grant roles/iam.serviceAccountAdmin to the Cloud Deploy execution service account so it can manage runtime service account credentials and attach them to GKE workloads.
  4. D
    Grant roles/clouddeploy.jobRunner to the Cloud Deploy execution service account, but maintain the automated pipeline's Terraform state file in unversioned local directory storage on the build runner to maximize execution speed.

Answer

The optimal configuration grants roles/clouddeploy.jobRunner and roles/container.developer to the Cloud Deploy execution service account, grants roles/iam.serviceAccountUser on the target GKE workload service account, and uses a remote Cloud Storage bucket with versioning and state locking for Terraform state management.
The solution properly configures minimal necessary permissions using fine-grained roles (`roles/clouddeploy.jobRunner`, `roles/container.developer`, and `roles/iam.serviceAccountUser`) while securing automated infrastructure changes via Cloud Storage remote backend versioning and object locking.

Step-by-Step Solution

1
Analyze IAM least privilege requirements for Google Cloud Deploy execution service accounts.
Identify that Cloud Deploy execution requires roles/clouddeploy.jobRunner for executing render/deploy jobs, roles/container.developer to deploy workloads to GKE, and roles/iam.serviceAccountUser to act as the GKE workload service account.
Fine-grained predefined roles ensure minimal access without exposing administrative control over service account definitions or project resources.
2
Evaluate Infrastructure as Code (IaC) state management requirements within CI/CD pipelines.
Determine that shared CI/CD pipelines deploying infrastructure changes alongside code releases must store Terraform state centrally.
Using Cloud Storage with object versioning and state locking prevents concurrent apply operations from corrupting infrastructure state.
3
Synthesize security and release pipeline integrity requirements to select the correct design.
Combine fine-grained Cloud Deploy/GKE IAM permissions with a secure remote Terraform GCS backend.
This guarantees both least-privilege security compliance and reliable pipeline execution for GKE canary releases.

Key Concept

Continuous Deployment Security & State Management
Rate this question

Topics

Automating Continuous Deployment Pipelines and Release Strategies