An organization is architecting an enterprise-wide CI/CD pipeline on Google Cloud to manage both infrastructure deployment using Terraform and microservice releases to private Google Kubernetes Engine (GKE) clusters across multiple isolated projects. The architecture must enforce strict security and compliance controls: build tasks must execute in a fully private network environment without internet exposure to prevent data exfiltration, infrastructure state must be protected against concurrency conflicts and corruption, and administrative permissions must strictly comply with the principle of least privilege. Which combination of GCP CI/CD toolchain configuration and architecture design satisfies all security and operational requirements?
- Execute Cloud Build build jobs using Cloud Build Private Pools attached to a peered VPC network within a VPC Service Controls perimeter. Maintain Terraform state in a Cloud Storage backend with object versioning and state locking enabled, and grant the pipeline service account fine-grained resource roles along with roles/iam.serviceAccountUser on target workload service accounts.Cevap
- BExecute Cloud Build jobs using standard shared worker pools while relying on GKE authorized networks for network isolation. Store Terraform state in a version-controlled repository, and assign the primitive roles/editor role to the Cloud Build service account to guarantee provisioning operations succeed across all target projects.
- CExecute Cloud Build jobs in Cloud Build Private Pools, but store Terraform state files in ephemeral local build workspace storage. Grant the pipeline service account roles/iam.serviceAccountAdmin to allow dynamic management and impersonation of workload identities during deployment.
- DExecute Cloud Build jobs using Private Pools without VPC Service Controls perimeters, relying solely on IAM policies to restrict outbound network access. Store Terraform state files in standard Cloud Storage buckets without versioning or state locking, and keep GKE control planes open to all internal project subnets.
Cevap
Execute Cloud Build build jobs using Cloud Build Private Pools attached to a peered VPC network within a VPC Service Controls perimeter. Maintain Terraform state in a Cloud Storage backend with object versioning and state locking enabled, and grant the pipeline service account fine-grained resource roles along with roles/iam.serviceAccountUser on target workload service accounts.
The solution utilizing Cloud Build Private Pools inside a VPC Service Controls perimeter provides complete network isolation without public IP exposure. Using a Cloud Storage backend configured with state locking and object versioning ensures concurrent Terraform executions do not corrupt state files. Finally, assigning fine-grained predefined roles paired with the Service Account User role enforces strict least privilege without granting administrative control over service accounts.
Adım Adım Çözüm
Anahtar Kavram
Enterprise Secure CI/CD Architecture with Cloud Build, Private Pools, VPC SC, and IaC State Management
Tahmini Süre:3m 0s