Examkin

Soru

Zorluk: ZorContinuous Integration and Continuous Delivery (CI/CD) Pipeline Design

An enterprise organization is designing a secure CI/CD pipeline on Google Cloud to deploy microservices to Google Kubernetes Engine (GKE). The pipeline architecture must enforce automated container vulnerability scanning, software supply chain security using Binary Authorization attestations, and progressive delivery governance across staging and production environments. Sequence the steps required to execute a secure deployment from initial source code commit to final production rollout in the correct chronological order.

  1. 1Cloud Build triggers on a source repository commit to compile the application and execute automated unit tests.
  2. 2Container Analysis performs vulnerability scanning on the built image, and Cloud Build generates a Binary Authorization attestation signed with a Cloud KMS key.
  3. 3The container image digest along with its signed attestation metadata are published to Google Cloud Artifact Registry.
  4. 4Cloud Deploy creates a release referencing the image digest in Artifact Registry and automatically deploys the manifest to the Staging GKE cluster.
  5. 5Cloud Deploy requires explicit operational approval before executing a canary deployment strategy to progressively roll out the release to the Production GKE cluster.

Cevap

The correct sequence for a secure Google Cloud CI/CD pipeline is: 1) Trigger Cloud Build to compile code and run unit tests; 2) Perform Container Analysis scanning and generate Binary Authorization attestations via Cloud KMS; 3) Publish the signed container image and attestation metadata to Artifact Registry; 4) Use Cloud Deploy to create a release and deploy to the Staging GKE cluster; 5) Obtain operational approval and execute a canary rollout to the Production GKE cluster via Cloud Deploy.
A secure end-to-end cloud release pipeline begins by triggering Cloud Build to compile code and execute unit tests. Following image compilation, Container Analysis performs vulnerability scanning and Cloud Build uses Cloud KMS to produce a Binary Authorization attestation. The container digest and signed attestation are then published to Artifact Registry. Cloud Deploy picks up the release to deploy it first into the Staging GKE cluster. Finally, upon explicit operational approval, Cloud Deploy executes a progressive canary deployment to the Production GKE cluster.

Adım Adım Çözüm

1
Trigger build and test execution in Continuous Integration tool
Cloud Build compiles the source code into a container artifact and validates logic using unit testing.
Building and testing source code is the entry point of any CI/CD pipeline before artifacts are evaluated or promoted.
2
Perform security scanning and Binary Authorization attestation signing
Container Analysis scans the image for vulnerabilities, and Cloud Build uses Cloud KMS to cryptographically sign a payload attesting security compliance.
Attestations must be produced at build time so Binary Authorization policy enforcers on GKE cluster admission controllers can evaluate compliance.
3
Publish immutable container digest and attestation metadata
Artifact Registry receives and stores the container image digest and associated attestation details.
Centralizing attested container images in Artifact Registry provides an immutable source of truth for deployment targets.
4
Initiate Cloud Deploy release to staging environment
Cloud Deploy creates a pipeline release using the Artifact Registry digest and deploys the workload to the Staging GKE cluster.
Deploying to pre-production staging environments allows automated end-to-end integration and smoke testing before production promotion.
5
Approve and execute progressive production delivery
After manual approval, Cloud Deploy executes a canary release strategy to shift production traffic incrementally to the new GKE deployment.
Production deployments require administrative approval gates and progressive delivery mechanisms (such as canary rollouts) to minimize blast radius.

Anahtar Kavram

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Continuous Integration and Continuous Delivery (CI/CD) Pipeline Design

Bu konudan daha fazla soru