GCP Professional Cloud Architect Practice Question

Your team builds container images in Artifact Registry using Cloud Build on each merge to main. You must implement a managed, auditable release process that automatically deploys the image to a staging GKE cluster, runs smoke tests, then waits for an SRE approval before promoting the exact same release to a production Cloud Run service in another project. Which design best meets these requirements?

Invoke Deployment Manager templates from a Cloud Function that is triggered by a Pub/Sub message from Artifact Registry; use IAM conditions to require SRE approval before the function deploys to production.
Install and configure Spinnaker on a GKE cluster to watch Artifact Registry, adding a manual judgment stage between separate deploy stages for staging and production.
Create a multi-step Cloud Build pipeline that kubectl-applies manifests to the staging cluster, inserts a manual wait step for SRE sign-off, and then runs gcloud run deploy to push the image to production.
Use Cloud Deploy to define a delivery pipeline with two targets: the first deploys to the staging GKE cluster, the second to the production Cloud Run service. Set requireApproval to true on the production target, and have the Cloud Build trigger create a release that Cloud Deploy rolls out.

Report Issue

Answer Description

Cloud Deploy is Google Cloud's managed continuous-delivery service. A delivery pipeline can define multiple ordered targets, such as a staging GKE cluster followed by a production Cloud Run service in another project. Setting the production target's requireApproval field to true causes Cloud Deploy to pause the rollout and record an approval decision before promotion, satisfying the manual-gate and audit requirements. A Cloud Build trigger can invoke the clouddeploy releases create command so that every successful build automatically produces a release that Cloud Deploy rolls out across the defined targets. The other options rely on self-managed tooling, custom scripting, or ad-hoc IAM work-arounds rather than using the purpose-built managed service that natively supplies multi-target pipelines, approvals, and release integrity guarantees.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.