A healthcare enterprise is establishing an automated, zero-trust software delivery pipeline on Google Cloud. The architecture must automatically build, scan, certify, and deploy microservice container updates to a production Google Kubernetes Engine (GKE) cluster. In what sequential order should the CI/CD pipeline execute these operational stages from code check-in to production deployment?
- 1Cloud Build compiles the application source code and builds a container image upon receiving a git push event.
- 2Artifact Analysis conducts automated vulnerability scanning on the newly created container image.
- 3Artifact Registry stores the scanned image, and a KMS key is used to generate a signed cryptographic attestation.
- 4Binary Authorization checks the deployment policy and validates the cryptographic attestation signature.
- 5Cloud Deploy executes a progressive rollout of the verified container image to the production GKE cluster.
Answer
The correct operational sequence begins with Cloud Build constructing the container image, followed by Artifact Analysis performing vulnerability scans, storing the image and signing an attestation in Artifact Registry, enforcing security policies through Binary Authorization, and concluding with Cloud Deploy releasing the image to GKE.
The sequence reflects Google Cloud secure software supply chain best practices: first, Cloud Build packages the application; second, Artifact Analysis performs vulnerability scanning; third, the artifact is stored in Artifact Registry with a signed attestation; fourth, Binary Authorization verifies the attestation signature against organizational policy; and fifth, Cloud Deploy delivers the image to production GKE.
Step-by-Step Solution
Key Concept
Analyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines