Examkin

Soru

Zorluk: OrtaAutomating Continuous Deployment Pipelines and Release Strategies

A logistics organization is building an automated continuous deployment pipeline to manage multi-environment releases of a microservice application across Google Kubernetes Engine (GKE) clusters using Cloud Build and Cloud Deploy. The security and operations teams require that all Infrastructure as Code (IaC) updates executed during the release process maintain state integrity and concurrency locking, and that the execution service account follows the principle of least privilege when delegating compute workloads. Which deployment pipeline configuration fulfills these architectural requirements?

  1. Configure Cloud Build to execute Terraform using a Cloud Storage remote backend with versioning and object locking, assign the Service Account User role (roles/iam.serviceAccountUser) to the build execution service account for compute resource delegation, and use Cloud Deploy to automate progressive release rollouts.Cevap
  2. B
    Configure Cloud Build to store Terraform state files in a local directory on the temporary build worker instance to accelerate pipeline execution, grant the Service Account User role to the build service account, and execute release rollouts via Cloud Deploy.
  3. C
    Configure Cloud Build to use a Cloud Storage remote backend with state locking, grant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the pipeline execution service account, and use Cloud Deploy to manage release rollouts.
  4. D
    Configure Cloud Build to use a Cloud Storage remote backend with state locking, grant the primitive Owner role (roles/owner) to the deployment execution service account to eliminate permission errors during resource provisioning, and automate releases using Cloud Deploy.

Cevap

Configure Cloud Build to use a Cloud Storage backend with object locking and versioning for Terraform state management, grant roles/iam.serviceAccountUser to the execution service account for least privilege workload delegation, and use Cloud Deploy for automated releases.
The solution using Cloud Build with Cloud Storage remote state storage (featuring object versioning and state locking) ensures state file persistence and prevents concurrent modification errors. Granting the Service Account User role satisfies least-privilege security requirements for attaching service accounts to compute resources without exposing administrative management controls.

Adım Adım Çözüm

1
Analyze state management requirements for automated IaC pipelines
Identified the need for a remote backend using Cloud Storage with state locking to prevent state file corruption and concurrency conflicts during automated pipeline executions.
Local state files on ephemeral build runner instances are discarded after run completion, leading to configuration drift and state loss.
2
Determine least privilege IAM requirements for service account usage
Selected Service Account User role (roles/iam.serviceAccountUser) to allow resources to run under a target service account.
Granting administrative roles like Service Account Admin or primitive Owner roles violates IAM security governance.
3
Integrate Cloud Deploy for automated release pipelines
Configured Cloud Deploy to handle automated and progressive application delivery to GKE clusters.
Cloud Deploy provides managed continuous delivery with built-in release promotion and rollback capabilities.

Anahtar Kavram

Automated Continuous Deployment Pipelines with IaC State Locking and Least-Privilege IAM
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Automating Continuous Deployment Pipelines and Release Strategies