Google Professional Cloud DevOps Engineer
Get started today
Ultimate access to all questions.
To ensure secure deployments in your container-based workflow, your organization needs to implement a mechanism that prevents unauthorized code changes from being pushed to production without proper approvals. Given that your team uses an automated build pipeline to deploy applications to a Kubernetes cluster, what steps should you take to enforce mandatory approvals before code reaches the production environment?
To ensure secure deployments in your container-based workflow, your organization needs to implement a mechanism that prevents unauthorized code changes from being pushed to production without proper approvals. Given that your team uses an automated build pipeline to deploy applications to a Kubernetes cluster, what steps should you take to enforce mandatory approvals before code reaches the production environment?
Explanation:
The question focuses on enforcing approvals to prevent unauthorized code changes in a container-based workflow with Kubernetes. The core issue is ensuring code changes go through automated testing and approval before reaching production. Analyzing the options:
-
Option A: Configuring protected branches with pull request approval in the build system (e.g., using Git features) directly addresses the concern. It mandates code reviews and approvals before merging changes into branches that trigger the production pipeline, ensuring changes are vetted. This aligns with DevOps best practices for governance.
-
Option B: Using an Admission Controller in Kubernetes validates API requests but targets cluster-level operations (e.g., pod creation), not the source code approval process. It doesn't prevent circumventing testing in the build pipeline.
-
Option C: Leveraging Kubernetes RBAC restricts user access to cluster resources but doesn't enforce pre-deployment code reviews or approvals. It only controls who can deploy, not how code changes are validated.
-
Option D: Enabling binary authorization ensures only signed container images run in Kubernetes but focuses on image integrity, not code change approvals. It doesn't require human reviews or block untested code from being built.
Option A is the correct answer because it enforces approvals at the source code level via protected branches, integrating seamlessly with the automated build pipeline to prevent unauthorized pushes.