Examkin

Soru

Zorluk: Çok zorContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

An enterprise financial technology platform requires a highly secure, automated continuous integration and deployment pipeline for containerized microservices running on Google Kubernetes Engine (GKE). The security policy strictly dictates that all artifacts must pass automated container scanning, have a Cryptographic Build Attestation signed by Cloud KMS, pass Binary Authorization policy checks, and follow a controlled canary release pattern using Cloud Deploy with automated metric validation. In what chronological sequence must the pipeline execute these operations from source code push to full release?

  1. 1Cloud Build compiles source code, builds the container image, pushes it to Artifact Registry, and waits for automated Artifact Analysis vulnerability scanning to complete clean.
  2. 2Cloud Build invokes a custom builder step that signs the build artifact's digest using a Cloud KMS key to generate a Binary Authorization vulnerability attestation note.
  3. 3Cloud Deploy initiates a release to the staging GKE cluster, where the GKE Binary Authorization enforcer verifies the signature against the KMS attestor policy prior to pod scheduling.
  4. 4Cloud Deploy executes a multi-target rollout phase, deploying a 10% canary traffic allocation to production while monitoring Cloud Logging and Cloud Monitoring metrics for latency and error rate anomalies.
  5. 5Cloud Deploy promotes the release to 100% production traffic upon successful metric evaluation, completing the delivery pipeline rollout.

Cevap

The correct end-to-end pipeline ordering is: (1) Image build, Artifact Registry push, and vulnerability scanning, (2) Cryptographic Binary Authorization attestation signing via Cloud KMS, (3) Cloud Deploy release to staging with Binary Authorization signature verification, (4) Cloud Deploy canary rollout in production with telemetry monitoring, and (5) Promotion to 100% production traffic.
The proper secure CI/CD pipeline progression establishes software supply chain security first (building, vulnerability scanning, and signing attestations via Cloud KMS), followed by environment delivery execution (Binary Authorization verification during deployment via Cloud Deploy to staging), and concludes with controlled progressive deployment (canary traffic split and monitoring evaluation prior to 100% promotion).

Adım Adım Çözüm

1
Build container image and complete vulnerability scan in Artifact Registry.
Immutable container digest is generated and verified clear of critical security vulnerabilities.
Container digest immobilizes code state, which is mandatory before cryptographically attesting security compliance.
2
Generate and sign Binary Authorization attestation with Cloud KMS.
Container digest is linked to a signed security attestation stored in Container Analysis.
Attestations prove build integrity and scan compliance prior to target cluster deployment authorization.
3
Deploy release candidate to Staging environment using Cloud Deploy.
GKE Binary Authorization admission controller verifies KMS signature before allowing container creation.
Enforcing policy on staging guarantees that unvetted binaries are rejected before entering release pipelines.
4
Initiate Canary deployment phase to Production GKE environment via Cloud Deploy.
A controlled fraction of live user traffic reaches the new container while Cloud Monitoring evaluates SLO metrics.
Canary progression isolates potential runtime defects without risking complete service outage.
5
Promote release to 100% production traffic.
Full production environment updated successfully.
Final promotion completes the continuous delivery pipeline after empirical runtime telemetry validation.

Anahtar Kavram

Secure Software Supply Chain & Automated Release Pipeline Integration
Bu soruyu puanla

Konular

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

Bu konudan daha fazla soru