A platform engineering team is establishing a progressive canary release pipeline for microservices running on Google Kubernetes Engine (GKE) using Cloud Deploy. The deployment pipeline must ensure secure execution with minimal privileges and support automated verification with automatic rollback if operational performance degrades during traffic shifting. Which TWO deployment pipeline practices should the team implement to fulfill these requirements?
- Configure Cloud Deploy deployment verification to run automated post-rollout checks that validate Cloud Monitoring error rates before proceeding with subsequent canary phases.Cevap
- Configure Workload Identity Federation for the CI/CD deployment service account with short-lived tokens and specific predefined IAM roles for deployment management.Cevap
- CGrant the primitive Owner role to the CI/CD service account to ensure uninterrupted resource provisioning during canary target deployment.
- DStore the infrastructure deployment state files inside the unversioned local directory of the deployment worker container to speed up execution.
- EConfigure load balancer ingress health checks to perform deep database queries on every health probe to verify full downstream stack availability before shifting canary traffic.
Cevap
The correct practices are configuring Cloud Deploy deployment verification to execute post-rollout monitoring checks and using Workload Identity Federation with least-privilege IAM roles for the CI/CD deployment pipeline.
Automating post-deployment verification using Cloud Deploy allows progressive canary traffic promotion alongside automated error-budget rollbacks. Combining this with Workload Identity Federation ensures that continuous delivery pipelines run securely under least-privilege constraints without long-lived credentials.
Adım Adım Çözüm
Anahtar Kavram
Continuous Delivery and Automated Canary Release Verification in Cloud Deploy