A DevOps team is designing an enterprise CI/CD pipeline on Google Cloud for a mission-critical application hosted on Google Kubernetes Engine (GKE). The pipeline architecture must satisfy the following technical and operational requirements: Container Artifact Management: Build container images and securely push them to Artifact Registry using immutable SHA256 digests. Supply Chain Security: Automatically analyze container configurations, scan for package vulnerabilities, and enforce cryptographic attestation before release. Continuous Delivery & Verification: Progressively deliver workloads across staging and production GKE clusters, executing automated post-deployment validation tests to minimize downtime and prevent regression. Which end-to-end pipeline workflow should the team implement?

Configure a Cloud Build pipeline that builds the container image, pushes it to Artifact Registry using an image digest, executes Container Structure Tests, and triggers Artifact Analysis scanning. Enforce Binary Authorization attestations on the image, then invoke Google Cloud Deploy to create a release utilizing Skaffold for manifest rendering, progressive rollout across GKE targets, and post-deployment verification.: What the Cloud Build and Cloud Deploy Architecture Is This architecture establishes an end-to-end, enterprise-grade Continuous Integration and Continuous Delivery (CI/CD) pipeline using Cloud Build, Artifact Registry, Artifact Analysis, Binary Authorization, and Google Cloud Deploy with Skaffold. How It Meets the Requirements Container Artifact Management: Cloud Build builds the container image, tags it with its cryptographic SHA256 image digest, and pushes the artifact directly into Artifact Registry. Supply Chain Security: Security scanning is applied across multiple layers. Cloud Build executes Container Structure Tests (verifying metadata, content, and system commands) while Artifact Analysis automatically scans system and language packages for Common Vulnerabilities and Exposures (CVEs). Binary Authorization acts as the deploy-time policy enforcer by requiring valid cryptographic attestations before images can be scheduled on GKE clusters. Continuous Delivery & Verification: Cloud Build triggers Google Cloud Deploy to create a release. Cloud Deploy uses skaffold.yaml to execute skaffold render and skaffold apply to deploy workloads progressively across targets (e.g., staging and production). Following each deployment stage, Cloud Deploy executes automated deployment verification jobs configured in Skaffold to validate service health and minimize downtime. Key Advantages and Capabilities Immutable Deployments: Referencing containers by SHA256 digest prevents tag mutation and ensures deployment reproducibility across all environments. Shift-Left Security: Integrates structural validation and vulnerability scanning early in the CI phase, preventing non-compliant images from reaching runtime environments. Automated Lifecycle Governance: Google Cloud Deploy natively decouples delivery pipelines and target infrastructure from application code, providing structured rollouts, approval gates, and integrated verification. Why This Is Optimal This solution follows Google Cloud's recommended golden path and enterprise blueprint for secure software delivery. It centralizes artifact governance, enforces strict software supply chain security via SLSA frameworks, and eliminates fragile custom deployment scripts.

StudyCerts

Professional Cloud DevOps Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Build Deploy Gke Cicd Pipeline Design

Section: CI/CD of applications and infrastructure

A DevOps team is designing an enterprise CI/CD pipeline on Google Cloud for a mission-critical application hosted on Google Kubernetes Engine (GKE). The pipeline architecture must satisfy the following technical and operational requirements:

Container Artifact Management: Build container images and securely push them to Artifact Registry using immutable SHA256 digests.
Supply Chain Security: Automatically analyze container configurations, scan for package vulnerabilities, and enforce cryptographic attestation before release.
Continuous Delivery & Verification: Progressively deliver workloads across staging and production GKE clusters, executing automated post-deployment validation tests to minimize downtime and prevent regression.

Which end-to-end pipeline workflow should the team implement?

Configure Cloud Build to build and push tagged images to Artifact Registry, execute inline kubectl apply commands against each GKE target cluster in sequential build steps, and use Cloud Scheduler to trigger periodic post-deployment curl health checks.

Configure Cloud Build to package source code into Cloud Storage archives, grant Compute Engine default service accounts container admin access, and trigger Google Cloud Deploy to download the source archives, compile container images on cluster nodes, and deploy directly without Skaffold.

Configure a Cloud Build trigger to build container images, store them in Artifact Registry, deploy to GKE using the Recreate deployment strategy in Kubernetes manifests to stop all older pods before deploying new pods, and inspect image security manually using the Artifact Registry console.

Configure a Cloud Build pipeline that builds the container image, pushes it to Artifact Registry using an image digest, executes Container Structure Tests, and triggers Artifact Analysis scanning. Enforce Binary Authorization attestations on the image, then invoke Google Cloud Deploy to create a release utilizing Skaffold for manifest rendering, progressive rollout across GKE targets, and post-deployment verification.

Professional Cloud DevOps Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Cloud Build Deploy Gke Cicd Pipeline Design

Section: CI/CD of applications and infrastructure

Container Artifact Management: Build container images and securely push them to Artifact Registry using immutable SHA256 digests.
Supply Chain Security: Automatically analyze container configurations, scan for package vulnerabilities, and enforce cryptographic attestation before release.
Continuous Delivery & Verification: Progressively deliver workloads across staging and production GKE clusters, executing automated post-deployment validation tests to minimize downtime and prevent regression.

Which end-to-end pipeline workflow should the team implement?

Explanations

What the Cloud Build and Cloud Deploy Architecture Is

This architecture establishes an end-to-end, enterprise-grade Continuous Integration and Continuous Delivery (CI/CD) pipeline using Cloud Build, Artifact Registry, Artifact Analysis, Binary Authorization, and Google Cloud Deploy with Skaffold.

How It Meets the Requirements

Container Artifact Management: Cloud Build builds the container image, tags it with its cryptographic SHA256 image digest, and pushes the artifact directly into Artifact Registry.
Supply Chain Security: Security scanning is applied across multiple layers. Cloud Build executes Container Structure Tests (verifying metadata, content, and system commands) while Artifact Analysis automatically scans system and language packages for Common Vulnerabilities and Exposures (CVEs). Binary Authorization acts as the deploy-time policy enforcer by requiring valid cryptographic attestations before images can be scheduled on GKE clusters.
Continuous Delivery & Verification: Cloud Build triggers Google Cloud Deploy to create a release. Cloud Deploy uses skaffold.yaml to execute skaffold render and skaffold apply to deploy workloads progressively across targets (e.g., staging and production). Following each deployment stage, Cloud Deploy executes automated deployment verification jobs configured in Skaffold to validate service health and minimize downtime.

Key Advantages and Capabilities

Immutable Deployments: Referencing containers by SHA256 digest prevents tag mutation and ensures deployment reproducibility across all environments.
Shift-Left Security: Integrates structural validation and vulnerability scanning early in the CI phase, preventing non-compliant images from reaching runtime environments.
Automated Lifecycle Governance: Google Cloud Deploy natively decouples delivery pipelines and target infrastructure from application code, providing structured rollouts, approval gates, and integrated verification.

Why This Is Optimal

This solution follows Google Cloud's recommended golden path and enterprise blueprint for secure software delivery. It centralizes artifact governance, enforces strict software supply chain security via SLSA frameworks, and eliminates fragile custom deployment scripts.

View source documentation

Professional Cloud DevOps Engineer

Cloud Build Deploy Gke Cicd Pipeline Design

Professional Cloud DevOps Engineer

Cloud Build Deploy Gke Cicd Pipeline Design

What the Cloud Build and Cloud Deploy Architecture Is

How It Meets the Requirements

Key Advantages and Capabilities

Why This Is Optimal

Related questions