Examkin

Soru

Zorluk: OrtaContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

A software engineering team is designing a CI/CD pipeline using Cloud Build to automate infrastructure updates with Terraform and deploy microservices to a private Google Kubernetes Engine (GKE) cluster. The pipeline needs to read and update Terraform state files stored in a Cloud Storage bucket, interact with the GKE control plane, and execute containerized deployments. To adhere to Google Cloud security best practices and the principle of least privilege, how should the Cloud Build pipeline permissions and network configuration be designed?

  1. A
    Assign the primitive Owner role to the Cloud Build service account at the project level to ensure full administrative access to Cloud Storage state files and GKE resources.
  2. Grant fine-grained roles such as Storage Object Admin on the specific state bucket and Kubernetes Engine Developer on the cluster, while routing Cloud Build traffic through a private worker pool authorized to access the GKE control plane.Cevap
  3. C
    Grant the Cloud Build service account the Service Account Admin role across the project so that it can elevate its privileges dynamically during pipeline execution.
  4. D
    Store the Terraform state files on local ephemeral disks within the Cloud Build build steps to avoid granting Cloud Storage IAM permissions.

Cevap

Grant fine-grained roles such as Storage Object Admin on the specific state bucket and Kubernetes Engine Developer on the cluster, while routing Cloud Build traffic through a private worker pool authorized to access the GKE control plane.
The solution follows security best practices by assigning minimal, resource-scoped IAM roles (Storage Object Admin on the state bucket and Kubernetes Engine Developer on the cluster) and utilizing Cloud Build Private Pools to securely communicate with the private GKE master endpoint.

Adım Adım Çözüm

1
Identify the minimum required IAM permissions for each pipeline operation
The pipeline requires Object Admin rights restricted to the specific Terraform state bucket and Developer access to the GKE cluster, rather than project-wide primitive or service account admin roles.
Enforces the principle of least privilege and prevents unauthorized operational modifications across other project resources.
2
Establish secure network connectivity between Cloud Build and private GKE control plane endpoints
Cloud Build Private Pools connected via VPC peering allow worker nodes to access private GKE master IP ranges.
Default public Cloud Build workers cannot access private GKE control planes unless authorized IP ranges or private worker pools are configured.
3
Ensure durable infrastructure state management
Remote persistent storage in Cloud Storage with object versioning guarantees state file preservation across automated pipeline builds.
Ephemeral runner storage causes loss of state and breaks infrastructure automation.

Anahtar Kavram

Least-privilege IAM configuration and private network isolation for Cloud Build pipelines interacting with GKE and Cloud Storage
Bu soruyu puanla

Konular

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

Bu konudan daha fazla soru