A logistics enterprise is deploying an automated CI/CD pipeline using Infrastructure as Code to provision Compute Engine virtual machines and Google Kubernetes Engine (GKE) node pools across multiple projects. The deployment pipeline runs under a dedicated service account and must support rapid scaling without encountering deployment failures, while strictly adhering to the principle of least privilege. Which TWO configuration steps should the cloud architect recommend to meet these requirements?
- Submit regional vCPU and compute resource quota increase requests in advance of major infrastructure deployment events.Cevap
- BAssign the primitive Editor role to the CI/CD deployment pipeline service account at the project level to streamline infrastructure creation.
- Grant the Service Account User role to the CI/CD deployment service account on the specific service accounts attached to compute instances.Cevap
- DDeploy private GKE clusters with public control plane endpoints disabled while leaving control plane authorized networks unconfigured.
- EStore Terraform state files on the local file system of the ephemeral CI/CD runner to reduce remote storage API overhead.
Cevap
The cloud architect should recommend submitting regional compute quota increase requests in advance and granting the Service Account User role on workload service accounts to the deployment service account.
Proactively requesting quota increases ensures that automated pipelines do not fail due to regional vCPU bottlenecks when provisioning GKE nodes or Compute Engine instances. Granting the Service Account User role allows the deployment pipeline to assign identity service accounts to virtual machines and node pools while following least privilege guidelines.
Adım Adım Çözüm
Anahtar Kavram
Provisioning Compute Resources and Identity Scoping
Tahmini Süre:2m 0s