Professional-Cloud-DevOps-Engineer Exam Dumps : Google Cloud Certified - Professional Cloud DevOps Engineer Exam

 The best option for implementing guard rails on all GKE clusters to only allow the deployment of trusted and approved images is to use Binary Authorization to attest images during your CI/CD pipeline. Binary Authorization is a feature that allows you to enforce signature-based validation when deploying container images. You can use Binary Authorization to create policies that specify which images are allowed or denied in your GKE clusters. You can also use Binary Authorization to attest images during your CI/CD pipeline by using tools such as Container Analysis or third-party integrations. An attestation is a digital signature that certifies that an image meets certain criteria, such as passing vulnerability scans or code reviews. By using Binary Authorization to attest images during your CI/CD pipeline, you can ensure that only trusted and approved images are deployed to your GKE clusters.

To deploy only on new release tags, which follow a semantic versioning pattern (e.g., v1.2.3), you should use a tag filter with a regular expression matching semantic versions.

From the official documentation:

"You can configure Cloud Build to start a build automatically whenever there is a new tag in your source repository by using tag triggers."

— Cloud Build Triggers

Using a tag pattern like \d+\.\d+\.\d* ensures that builds only trigger on properly versioned release tags (minimizing unnecessary executions). This matches standard semver tags such as 1.0.0, 2.1.3, etc.

The Horizontal Pod Autoscaler changes the shape of your Kubernetes workload by automatically increasing or decreasing the number of Pods in response to the workload's CPU or memory consumption