Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!
Continuous integration and continuous deployment (CI/CD) are vital practices for modern cloud management. Continuous integration is the practice of merging code changes into a shared repository frequently to detect errors early. These automated processes help teams improve operational efficiency and reduce the risk of human error during software updates. Google Cloud provides integrated tools to design and evaluate these automated pipelines to ensure high-quality software delivery.
Cloud Build is a managed service that handles the automated build and testing of your application code. It uses triggers to start the build process automatically whenever a developer pushes a change to a source repository. This service can execute multiple steps in parallel to speed up the software delivery process. Common tasks performed during this stage include:
The Artifact Registry is used to store and manage the build artifacts created during the development process. It acts as a universal package manager, which is a central tool used to store, organize, and distribute software packages. This registry supports various formats, making it a versatile solution for different types of development projects. To ensure security, it integrates with Artifact Analysis to scan for vulnerabilities.
To move software into production, Cloud Deploy manages the continuous delivery process to targets like Google Kubernetes Engine (GKE). It automates the promotion of container images from staging to production while allowing for manual approval steps when necessary. This tool ensures that the application remains consistent as it moves through different stages of the software lifecycle. Using Skaffold helps standardize these configurations, making it easier for developers and operators to work together effectively.
Security and governance are integrated into the pipeline to protect the software supply chain. Tools like Binary Authorization act as a gatekeeper, ensuring that only trusted and verified images are allowed to run on your clusters. This process uses attestations, which are digital signatures that prove a build has passed all required security checks and tests. Following these practices helps organizations meet strict compliance requirements and prevent unauthorized code from running.
When designing pipelines, you must evaluate the confidentiality, integrity, and availability of your data. High-risk resources may require manual approvals or even bypass automated pipelines for better security. Access controls ensure that only authorized users can trigger or approve a release. The required level of review depends on the risk tier of the deployment:
Advanced strategies like Canary releases allow you to test new features on a small group of users before a full rollout. In contrast, Blue-green deployments provide a way to switch between two identical environments to minimize downtime. Automated rollbacks are essential for quickly returning to a working state if a new release fails. These patterns help maintain high availability during the delivery process.
Continuous monitoring is vital to track the health of your applications and detect failures early. Following DORA (DevOps Research and Assessment) capabilities helps organizations improve their software delivery and operational performance. Emergency access procedures should be in place to manage critical systems if the main pipeline becomes unavailable. This prevents a single point of failure from stopping business operations.
Code moves through distinct environments as it progresses through the software lifecycle. Development usually happens in a Sandbox environment where developers can experiment freely with new code. Before reaching Production, code must pass through a Preproduction environment for thorough end-to-end testing. This multi-stage process ensures that only verified and stable code reaches the live end-users.
MLOps applies CI/CD principles to machine learning by automating the testing of data and models. Unlike standard software, machine learning systems often require Continuous Training to keep models accurate as data changes over time. Automated triggers can start a new training cycle whenever performance drops or new data arrives. This keeps the machine learning system reliable and up to date.
A software supply chain includes all the code, people, and processes involved in creating and delivering software. To improve security, organizations should integrate security controls directly into their technical processes using a DevSecOps approach. Protecting the development environment is the first step in a secure CI/CD pipeline. Cloud Workstations provides managed environments that shift security left by using VPC Service Controls and Identity and Access Management (IAM).
Managing dependencies is critical because many applications rely on external open-source software that may have hidden risks. Artifact Registry serves as a central manager for all build artifacts, while Artifact Analysis provides automated vulnerability scanning. These services help teams detect and remediate threats before they reach production. Important features for managing dependencies include:
Securing the CI/CD pipeline itself prevents bad actors from tampering with the build process. Cloud Build supports SLSA Level 3, which provides high-level assurance for container images. It also generates build provenance, which is a verifiable record of how an artifact was created. Cloud Deploy then automates the delivery of these applications with built-in rollbacks and approval steps to ensure stability.
To maintain the integrity of the environment, organizations must use strict deployment controls. Binary Authorization is a service that enforces signature-based policies to ensure only trusted images are deployed. This works alongside Secret Manager to securely handle sensitive data like API keys. Following these security models ensures that confidentiality, integrity, and availability are maintained throughout the software lifecycle.
Prepare and test your skills
Prepare and test your skills
Continuous integration is the practice of merging code changes into a shared repository frequently to detect errors early. Continuous deployment automates the process of moving software into production, ensuring that code passing all tests is automatically deployed to users through managed services.
Cloud Build is a managed service that handles automated build and testing of application code. It uses triggers to start the build process automatically whenever a developer pushes a change to a source repository, and can execute multiple steps in parallel including building container images, testing for bugs, and scanning for security flaws.
Artifact Registry is used to store and manage build artifacts created during development. It acts as a universal package manager that serves as a central tool to store, organize, and distribute software packages in various formats, integrating with Artifact Analysis to scan for vulnerabilities.
Low risk deployments allow developers to self-approve. Moderate risk requires a team lead to approve every commit. High risk may require administrators to use manual sessions for better control. Access controls ensure only authorized users can trigger or approve a release based on these risk tiers.
Store credentials in Secret Manager, execute vulnerability scans manually through custom Compute Engine scripts, and configure Identity-Aware Proxy (IAP) with Cloud Armor at the GKE ingress to prevent unauthorized image execution.
Store build credentials as encrypted environment variables in Cloud Source Repositories, sign container images with Cloud KMS directly during build, and implement Kubernetes Network Policies with GKE Pod Security Standards to restrict running unapproved images.
Store sensitive build credentials in Secret Manager, enable automatic vulnerability scanning in Artifact Registry, configure the pipeline to sign images with an attestation, and enforce a Binary Authorization policy on the GKE cluster.
Store build secrets in Cloud Storage with IAM bucket policies, enable Artifact Registry vulnerability scanning, and deploy a custom mutating admission webhook in GKE to query Cloud Logging for build approval events.
An enterprise is designing an automated CI/CD pipeline on Google Cloud to deploy containerized workloads to Google Kubernetes Engine (GKE). The security team requires strict software supply chain controls and compliance enforcement across the SDLC:
Which combination of Google Cloud services and controls should the enterprise implement?
StudyCerts
StudyCerts