Examkin

Soru

Zorluk: ZorAnalyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines

An enterprise organization is establishing a secure continuous integration and continuous delivery (CI/CD) pipeline on Google Cloud to deploy containerized applications to Google Kubernetes Engine (GKE) under strict Binary Authorization compliance policies. Arrange the operational pipeline stages in the correct chronological order from the initial developer code check-in to successful pod scheduling in the cluster.

  1. 1Developer pushes source code to the version control repository, which automatically triggers a Cloud Build workflow execution via a repository webhook.
  2. 2Cloud Build executes automated unit testing and builds the container image within an isolated worker pool environment.
  3. 3Cloud Build pushes the built image to Artifact Registry, where Container Analysis automatically conducts vulnerability scanning against known CVE databases.
  4. 4An automated Cloud Build step verifies that Container Analysis detected zero critical vulnerabilities and requests a signature from a dedicated Cloud KMS key to generate an attestor signature.
  5. 5The GKE cluster admitter validates the image digest against the Binary Authorization policy to confirm the presence of a valid attestor signature prior to deployment.

Cevap

The correct operational sequence for a secure GKE CI/CD pipeline starts with the developer code commit triggering Cloud Build, followed by image creation and unit testing, uploading the image to Artifact Registry for automated Container Analysis vulnerability scanning, cryptographically signing the image via Cloud KMS to create a Binary Authorization attestation, and finally evaluating the attestation at the GKE admission controller during pod deployment.
A secure GCP continuous deployment pipeline enforces supply chain security in a strict linear sequence: Source Code Repository Trigger -> Automated Compilation & Unit Testing -> Artifact Storage & Vulnerability Scanning -> Policy Attestation Signature via Cloud KMS -> Runtime Enforcement at GKE Admission.

Adım Adım Çözüm

1
Identify the pipeline trigger stage
Developer pushes code to version control, which invokes the Cloud Build webhook trigger.
CI/CD execution begins with source revision control events.
2
Identify artifact construction and local verification
Cloud Build compiles, unit tests, and packages application binaries into a container image.
Code must pass local quality gates prior to repository registration.
3
Identify vulnerability evaluation stage
The container image is pushed to Artifact Registry, triggering Container Analysis scanning.
Artifact Registry integration is necessary for automated vulnerability and metadata extraction.
4
Identify attestation creation stage
Upon successful scan results, Cloud Build requests Cloud KMS signing to generate a Binary Authorization attestation.
Attestations certify that compliance and security standard checks passed.
5
Identify final runtime deployment admission
GKE Binary Authorization admission controller verifies the attestation signature before allowing pod scheduling.
Binary Authorization enforces trust policies at runtime deploy time in the Kubernetes API server.

Anahtar Kavram

End-to-End Secure Software Supply Chain Integration with Cloud Build, Artifact Registry, Container Analysis, and Binary Authorization
Bu soruyu puanla

Konular

Analyzing Software Development Lifecycle (SDLC) and CI/CD Pipelines