Your organization is establishing a secure SDLC pipeline on Google Cloud to ensure that only verified, vulnerability-scanned container images are deployed to Google Kubernetes Engine (GKE). Place the following CI/CD pipeline stages in the correct execution sequence from initial code build to production container deployment.
- 1Cloud Build compiles source code and builds the container image using a dedicated custom service account.
- 2Cloud Build pushes the container image to Artifact Registry, triggering Container Analysis for automated vulnerability scanning.
- 3An attestation authority validates vulnerability scan compliance and signs a Binary Authorization attestation.
- 4Cloud Deploy initiates deployment to GKE, where the Binary Authorization admission controller verifies the signature before allowing Pod creation.
Answer
The correct pipeline sequence begins with Cloud Build compiling code and building the image using a least-privilege custom service account, followed by pushing the image to Artifact Registry to trigger Container Analysis. Next, an attestation authority validates scan results and cryptographically signs a Binary Authorization attestation. Finally, Cloud Deploy triggers GKE deployment, where Binary Authorization verifies the attestation before container pods launch.
The standard secure CI/CD delivery pipeline follows a precise lifecycle sequence: 1) Source compilation and container image generation using custom least-privilege service accounts. 2) Artifact registration in Artifact Registry with automated vulnerability scanning via Container Analysis. 3) Attestation generation by signing the image digest once vulnerability checks pass. 4) Deployment triggering via Cloud Deploy with Binary Authorization enforcement on the target GKE cluster.
Step-by-Step Solution
Key Concept
Software Supply Chain Security & CI/CD Pipeline Order