Answer-first summary for fast verification
Answer: Create an attestation for the builds that pass the load test by using a private key stored in Cloud Key Management Service (Cloud KMS) authenticated through Workload Identity.
To ensure that only builds that have passed the load test are deployed to production in a Google Kubernetes Engine (GKE) environment using Binary Authorization, the recommended practice by Google involves creating an attestation for the builds that pass the load test. This attestation should be created using a private key stored in Cloud Key Management Service (Cloud KMS) authenticated through Workload Identity. This approach leverages Google's best practices for security and automation, ensuring that the attestation process is both secure and does not require manual intervention by individuals, such as the lead quality assurance engineer. Options A and D involve manual steps which are not recommended for automation purposes. Option B, while secure, involves storing a service account JSON key as a Kubernetes Secret, which is less secure and less recommended than using Workload Identity for authentication. Therefore, the correct answer is C, as it aligns with Google's recommended practices for security and automation in CI/CD pipelines.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
How should you configure a CI/CD pipeline on Google Cloud to automatically load-test builds in a pre-production GKE environment and ensure only passing builds are deployed to production, following Google-recommended practices with Binary Authorization?
A
Create an attestation for the builds that pass the load test by requiring the lead quality assurance engineer to sign the attestation by using their personal private key.
B
Create an attestation for the builds that pass the load test by using a private key stored in Cloud Key Management Service (Cloud KMS) with a service account JSON key stored as a Kubernetes Secret.
C
Create an attestation for the builds that pass the load test by using a private key stored in Cloud Key Management Service (Cloud KMS) authenticated through Workload Identity.
D
Create an attestation for the builds that pass the load test by requiring the lead quality assurance engineer to sign the attestation by using a key stored in Cloud Key Management Service (Cloud KMS).
No comments yet.