A DevOps team is designing an enterprise CI/CD pipeline on Google Cloud for a mission-critical application hosted on Google Kubernetes Engine (GKE). The pipeline architecture must satisfy the following technical and operational requirements: Container Artifact Management: Build container images and securely push them to Artifact Registry using immutable SHA256 digests. Supply Chain Security: Automatically analyze container configurations, scan for package vulnerabilities, and enforce cryptographic attestation before release. Continuous Delivery & Verification: Progressively deliver workloads across staging and production GKE clusters, executing automated post-deployment validation tests to minimize downtime and prevent regression. Which end-to-end pipeline workflow should the team implement?

Configure a Cloud Build pipeline that builds the container image, pushes it to Artifact Registry using an image digest, executes Container Structure Tests, and triggers Artifact Analysis scanning. Enforce Binary Authorization attestations on the image, then invoke Google Cloud Deploy to create a release utilizing Skaffold for manifest rendering, progressive rollout across GKE targets, and post-deployment verification.: ### What the Cloud Build and Cloud Deploy Architecture Is This architecture establishes an end-to-end, enterprise-grade **Continuous Integration and Continuous Delivery (CI/CD)** pipeline using **Cloud Build**, **Artifact Registry**, **Artifact Analysis**, **Binary Authorization**, and **Google Cloud Deploy** with **Skaffold**. ### How It Meets the Requirements - **Container Artifact Management:** **Cloud Build** builds the container image, tags it with its cryptographic **SHA256 image digest**, and pushes the artifact directly into **Artifact Registry**. - **Supply Chain Security:** Security scanning is applied across multiple layers. Cloud Build executes **Container Structure Tests** (verifying metadata, content, and system commands) while **Artifact Analysis** automatically scans system and language packages for Common Vulnerabilities and Exposures (CVEs). **Binary Authorization** acts as the deploy-time policy enforcer by requiring valid cryptographic attestations before images can be scheduled on GKE clusters. - **Continuous Delivery & Verification:** Cloud Build triggers **Google Cloud Deploy** to create a release. Cloud Deploy uses `skaffold.yaml` to execute `skaffold render` and `skaffold apply` to deploy workloads progressively across targets (e.g., staging and production). Following each deployment stage, Cloud Deploy executes automated **deployment verification** jobs configured in Skaffold to validate service health and minimize downtime. ### Key Advantages and Capabilities - **Immutable Deployments:** Referencing containers by **SHA256 digest** prevents tag mutation and ensures deployment reproducibility across all environments. - **Shift-Left Security:** Integrates structural validation and vulnerability scanning early in the CI phase, preventing non-compliant images from reaching runtime environments. - **Automated Lifecycle Governance:** Google Cloud Deploy natively decouples delivery pipelines and target infrastructure from application code, providing structured rollouts, approval gates, and integrated verification. ### Why This Is Optimal This solution follows Google Cloud's recommended golden path and enterprise blueprint for secure software delivery. It centralizes artifact governance, enforces strict software supply chain security via SLSA frameworks, and eliminates fragile custom deployment scripts.

Cloud Build Deploy Gke Cicd Pipeline Design | Professional Cloud DevOps Engineer

Cloud Build Deploy Gke Cicd Pipeline Design

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A DevOps team is designing an enterprise CI/CD pipeline on Google Cloud for a mission-critical application hosted on Google Kubernetes Engine (GKE). The pipeline architecture must satisfy the following technical and operational requirements:

Container Artifact Management: Build container images and securely push them to Artifact Registry using immutable SHA256 digests.
Supply Chain Security: Automatically analyze container configurations, scan for package vulnerabilities, and enforce cryptographic attestation before release.
Continuous Delivery & Verification: Progressively deliver workloads across staging and production GKE clusters, executing automated post-deployment validation tests to minimize downtime and prevent regression.

Which end-to-end pipeline workflow should the team implement?

Configure Cloud Build to package source code into Cloud Storage archives, grant Compute Engine default service accounts container admin access, and trigger Google Cloud Deploy to download the source archives, compile container images on cluster nodes, and deploy directly without Skaffold.

Configure a Cloud Build trigger to build container images, store them in Artifact Registry, deploy to GKE using the Recreate deployment strategy in Kubernetes manifests to stop all older pods before deploying new pods, and inspect image security manually using the Artifact Registry console.

Configure Cloud Build to build and push tagged images to Artifact Registry, execute inline kubectl apply commands against each GKE target cluster in sequential build steps, and use Cloud Scheduler to trigger periodic post-deployment curl health checks.

Configure a Cloud Build pipeline that builds the container image, pushes it to Artifact Registry using an image digest, executes Container Structure Tests, and triggers Artifact Analysis scanning. Enforce Binary Authorization attestations on the image, then invoke Google Cloud Deploy to create a release utilizing Skaffold for manifest rendering, progressive rollout across GKE targets, and post-deployment verification.

Professional Cloud DevOps Engineer

Cloud Build Deploy Gke Cicd Pipeline Design

Related questions