Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Gke Cicd Iac Least Privilege Automation

Section: Understanding the principles and recommendations of the operational excellence pillar of the Google Cloud Well-Architected Framework

An enterprise is standardizing its deployment process across multiple Google Kubernetes Engine (GKE) environments (development, staging, and production) to align with the Operational Excellence pillar of the Google Cloud Well-Architected Framework.

Currently, developers manually run kubectl commands from their local workstations, leading to configuration drift, deployment inconsistencies, and elevated credential sprawl.

The team wants to implement an automated CI/CD pipeline using Cloud Build that satisfies the following requirements:

Deployments must be declarative, version-controlled, and repeatable across all environments
Manual configuration errors must be eliminated
The pipeline service account must follow the principle of least privilege by having permissions to create, update, and rollback application workloads (such as container.deployments.create and container.deployments.update) without broad administrative control over the cluster

Which strategy should the cloud architect recommend?

Execute imperative kubectl rollout commands directly from developer machines using shared service account keys that possess roles/container.developer

Store deployment configurations in Cloud Storage and grant the Cloud Build service account the Kubernetes Engine Admin role (roles/container.admin) at the project level

Configure Cloud Build to deploy workloads using the Project Viewer role (roles/viewer) along with container.ingresses.get permissions

Store Kubernetes resource manifests in a centralized Git repository, automate deployments via a Cloud Build CI/CD pipeline, and assign the pipeline service account the Kubernetes Engine Developer role (roles/container.developer) scoped to the cluster

Professional Cloud Architect

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Gke Cicd Iac Least Privilege Automation

Section: Understanding the principles and recommendations of the operational excellence pillar of the Google Cloud Well-Architected Framework

Currently, developers manually run kubectl commands from their local workstations, leading to configuration drift, deployment inconsistencies, and elevated credential sprawl.

The team wants to implement an automated CI/CD pipeline using Cloud Build that satisfies the following requirements:

Deployments must be declarative, version-controlled, and repeatable across all environments
Manual configuration errors must be eliminated
The pipeline service account must follow the principle of least privilege by having permissions to create, update, and rollback application workloads (such as container.deployments.create and container.deployments.update) without broad administrative control over the cluster

Which strategy should the cloud architect recommend?

Execute imperative kubectl rollout commands directly from developer machines using shared service account keys that possess roles/container.developer

Store deployment configurations in Cloud Storage and grant the Cloud Build service account the Kubernetes Engine Admin role (roles/container.admin) at the project level

Configure Cloud Build to deploy workloads using the Project Viewer role (roles/viewer) along with container.ingresses.get permissions

Explanations

What Declarative CI/CD with Scoped IAM Is

This strategy combines Infrastructure as Code (IaC), GitOps/declarative delivery pipelines, and role-based access management to automate workload lifecycles reliably within Google Kubernetes Engine (GKE).

How It Meets the Requirements

Repeatable, declarative deployments: Storing manifests in a central Git repository establishes a single source of truth, enabling automated, consistent rollouts across development, staging, and production environments via Cloud Build.
Minimizing manual errors: Eliminating manual kubectl execution removes operator error and prevents environment drift.
Principle of least privilege: The roles/container.developer role provides granular permissions to manage workloads—including container.deployments.create, container.deployments.update, container.deployments.rollback, and container.ingresses.create—without granting cluster administration rights.

Key Advantages and Capabilities

Auditability and Traceability: Every deployment change is tracked via commit histories and Cloud Build execution logs.
Fine-Grained Security: Limits blast radius by restricting the automation service account from modifying underlying cluster configurations or node pools.
Automated Rollbacks: Simplifies recovery by leveraging automated pipeline triggers and native Kubernetes rollout/rollback mechanisms.
Consistency: Guarantees identical deployment logic across staging and production clusters.

Why This Is Optimal

Using declarative manifests combined with a least-privilege CI/CD service account aligns directly with the Operational Excellence pillar by replacing error-prone manual interactions with standardized, secure automation.

View source documentation

Professional Cloud Architect

Gke Cicd Iac Least Privilege Automation

Professional Cloud Architect

Gke Cicd Iac Least Privilege Automation

What Declarative CI/CD with Scoped IAM Is

How It Meets the Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions