Your organization uses a GitOps workflow with Config Sync to manage Kubernetes resource manifests and security policies across multiple Google Kubernetes Engine (GKE) clusters. To prevent broken configurations and security policy regressions from reaching production clusters, you need to establish an automated gating and approval process with the following requirements: Manifest syntax and cluster configuration structure must be automatically validated whenever a pull request (PR) is opened against the configuration repository. Automated validation must pass successfully before human reviewers can approve the pull request. Merges into the protected repository branches used by the clusters must require explicit review and sign-off from designated platform and security team members. Which solution should you implement?

Configure a Cloud Build trigger on pull requests to execute `nomos vet` containerized validation, configure Git branch protection rules requiring this status check to pass, and require merge approvals from platform and security Code Owners.: ### What the solution is This solution integrates automated CI validation directly into the Git repository workflow using **Cloud Build** and **branch protection rules**. By executing the `nomos vet` command on every change request, the pipeline automatically verifies that all Config Sync manifests are syntactically correct and structurally valid before any human intervention occurs. ### How it meets the requirements - **Automated manifest validation on PRs**: Integrating a **Cloud Build trigger** (or the Cloud Build GitHub application) ensures that any opened or updated pull request automatically runs `nomos vet` in a container to validate the configuration syntax. - **Prerequisite for review and merge**: Branch protection rules mandate that the Cloud Build check passes successfully as a required status check before a pull request can be merged. - **Designated peer approvals**: Enforcing **Code Owners** and required peer reviews ensures that members of both the platform and security teams must inspect and approve changes to protected branches before deployment. ### Key advantages - **Shift-left validation**: Identifies malformed YAML, invalid Kubernetes schemas, and broken Config Sync directory structures before code enters production branches. - **Automated gating**: Eliminates manual toil by ensuring reviewers only evaluate changes that have already passed all automated syntax and structural checks. - **Separation of duties**: Guarantees that no individual developer can bypass compliance policies or push unreviewed changes directly to live clusters. - **Containerized portability**: The `nomos vet` check runs within standard container environments, providing repeatable results across development and CI/CD pipelines. ### Why this is optimal This approach aligns with CI/CD and GitOps best practices by establishing a strict gating pipeline where automated testing serves as a mandatory gate for manual approval. It protects cluster stability while enforcing peer review requirements across platform and security teams.

Config Sync Gke Automated Validation Approval Gate | Professional Cloud DevOps Engineer

Config Sync Gke Automated Validation Approval Gate

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your organization uses a GitOps workflow with Config Sync to manage Kubernetes resource manifests and security policies across multiple Google Kubernetes Engine (GKE) clusters.

To prevent broken configurations and security policy regressions from reaching production clusters, you need to establish an automated gating and approval process with the following requirements:

Manifest syntax and cluster configuration structure must be automatically validated whenever a pull request (PR) is opened against the configuration repository.
Automated validation must pass successfully before human reviewers can approve the pull request.
Merges into the protected repository branches used by the clusters must require explicit review and sign-off from designated platform and security team members.

Which solution should you implement?

Configure local Git pre-commit hooks on developer workstations to run client-side syntax linting and bypass branch protection rules for platform team members.

Configure a Cloud Scheduler job to run nomos status on clusters every hour and email failure reports to reviewers before they manually approve pull requests.

Apply Policy Controller constraints directly to production clusters using enforcementAction: deny and allow developers to merge pull requests directly without automated CI checks.

Configure a Cloud Build trigger on pull requests to execute nomos vet containerized validation, configure Git branch protection rules requiring this status check to pass, and require merge approvals from platform and security Code Owners.

Professional Cloud DevOps Engineer

Config Sync Gke Automated Validation Approval Gate

Related questions