Examkin

Soru

Zorluk: ZorAutomating Continuous Deployment Pipelines and Release Strategies

A DevOps team is establishing an automated continuous delivery pipeline for a mission-critical web application on Google Kubernetes Engine (GKE) using Cloud Build, Artifact Registry, Binary Authorization, and Google Cloud Deploy. The deployment requirements mandate zero downtime, automated container security gates, and progressive canary traffic shifting with automated rollback capabilities. In what chronological sequence should the pipeline stages be executed to implement this secure release process?

  1. 1Cloud Build compiles the application code, builds the container image, scans for vulnerabilities, and signs the image with a Container Analysis attestor key.
  2. 2Google Cloud Deploy instantiates a new release, and GKE Binary Authorization validates the attestor signature at the admission controller level before pods are scheduled on the target cluster.
  3. 3Google Cloud Deploy applies the canary target configuration, routing 10% of live traffic to the candidate release while Cloud Monitoring tracks SLO metric thresholds.
  4. 4Google Cloud Deploy executes the advance rollout operation, shifting 100% of production traffic to the verified candidate release across all target clusters.

Cevap

The correct execution sequence for the deployment pipeline is: 1) Build container image and generate Binary Authorization attestation signature in Cloud Build, 2) Create Cloud Deploy release and validate attestation via GKE Binary Authorization admission control, 3) Route 10% traffic to canary target with Cloud Monitoring metric validation, and 4) Advance rollout to route 100% of traffic to the production targets.
The correct release sequence begins with artifact compilation, vulnerability scanning, and Binary Authorization attestation signing during the build stage. Next, Cloud Deploy creates the release, triggering GKE Binary Authorization admission control to verify image signatures before scheduling pods. Once admitted, Cloud Deploy initiates canary deployment by shifting 10% of traffic while monitoring SLO metrics. Finally, upon metric validation, the rollout is advanced to shift 100% of production traffic.

Adım Adım Çözüm

1
Build and Security Attestation
Container image created, scanned, and signed by a trusted attestor key.
Binary Authorization policy enforcement requires vulnerability scanning and valid cryptographically signed attestations before container deployment.
2
Release Delivery & Admission Control
Cloud Deploy release created and admitted into the GKE cluster.
Binary Authorization operates as a Kubernetes admission controller, evaluating container signatures prior to pod scheduling.
3
Canary Deployment & SLO Verification
Partial traffic (10%) directed to canary instances with active health verification.
Progressive delivery minimizes blast radius by testing real user traffic against canary instances before full release.
4
Full Production Promotion
Rollout advanced to 100% production traffic.
Once automated metrics confirm zero SLO regressions, the release is safely promoted across all production endpoints.

Anahtar Kavram

Automated Continuous Delivery Pipeline Sequencing with Security Attestation and Canary Delivery
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Automating Continuous Deployment Pipelines and Release Strategies