Examkin

Soru

Zorluk: OrtaContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

An online retail enterprise is implementing an automated, secure continuous integration and continuous delivery (CI/CD) pipeline on Google Cloud to deploy microservices to Google Kubernetes Engine (GKE). Arrange the operational steps in the correct sequence from initial code commit to production release.

  1. 1Cloud Build triggers on a source code commit, compiles application binaries, and constructs the container image.
  2. 2Container Analysis performs vulnerability scanning on the built image, and Cloud KMS signs a Binary Authorization attestation.
  3. 3The verified container image and its corresponding cryptographic attestation metadata are pushed to Artifact Registry.
  4. 4Cloud Deploy creates a release referencing the image digest and initiates an automated deployment to the Staging GKE cluster.
  5. 5Binary Authorization validates image attestations at deployment time as Cloud Deploy executes a canary rollout to the Production GKE cluster.

Cevap

The correct order of pipeline execution is: (1) Cloud Build compiles source code into a container image; (2) Container Analysis scans the image and Cloud KMS signs a Binary Authorization attestation; (3) The signed image and attestation metadata are stored in Artifact Registry; (4) Cloud Deploy creates a release and deploys to the Staging GKE cluster; (5) Binary Authorization enforces attestation checks while Cloud Deploy executes a progressive canary deployment to Production GKE.
A well-architected GCP CI/CD pipeline enforces continuous integration, security attestation, artifact immutability, and progressive delivery in a sequential flow: (1) Source compilation and image build in Cloud Build; (2) Vulnerability scanning via Container Analysis and signing via Cloud KMS; (3) Storing the signed artifact in Artifact Registry; (4) Initial rollout to a staging environment using Cloud Deploy; and (5) Enforcing Binary Authorization policy gates during a progressive canary release to the production GKE cluster.

Adım Adım Çözüm

1
Identify the initial continuous integration build action.
Cloud Build executes upon code push to compile source code and build the container image.
Container creation is the prerequisite step before any scanning, artifact storage, or deployment can occur.
2
Determine the artifact security scanning and attestation sequence.
Container Analysis scans the newly built image and Cloud KMS generates a signed attestation.
Automated security scanning and attestation signing verify build integrity prior to storing the image in a release repository.
3
Identify the centralized artifact storage step.
The signed container image digest and attestation are uploaded to Artifact Registry.
Artifact Registry serves as the central, secure repository from which continuous delivery systems fetch validated artifacts.
4
Determine the initial delivery target deployment.
Cloud Deploy generates a pipeline release and deploys the artifact to the Staging GKE environment.
Continuous Delivery best practices require validating application releases in staging targets before promoting to production.
5
Identify the final admission control enforcement and production rollout.
Binary Authorization evaluates policy rules on the GKE cluster while Cloud Deploy performs a canary rollout to Production.
Binary Authorization acts as the mandatory runtime admission controller verifying image attestations prior to production traffic shifting.

Anahtar Kavram

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design with Cloud Build, Artifact Registry, Binary Authorization, and Cloud Deploy
Bu soruyu puanla

Konular

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

Bu konudan daha fazla soru