The Google Cloud Certified - Professional Cloud DevOps Engineer Exam (Professional-Cloud-DevOps-Engineer)

https://cloud.google.com/compute/quotas#understanding_quotas

https://cloud.google.com/compute/quotas

https://cloud.google.com/kubernetes-engine/docs/concepts/custom-and-external-metrics#custom_metrics

https://github.com/GoogleCloudPlatform/k8s-stackdriver/blob/master/custom-metrics-stackdriver-adapter/README.md

Your application can report a custom metric to Cloud Monitoring. You can configure Kubernetes to respond to these metrics and scale your workload automatically. For example, you can scale your application based on metrics such as queries per second, writes per second, network performance, latency when communicating with a different application, or other metrics that make sense for your workload.https://cloud.google.com/kubernetes-engine/docs/concepts/custom-and-external-metrics

To exclude a subset of users or projects from Data Access audit logging, you use the exempted principals configuration. This allows you to selectively disable logs for specific groups, such as developers in the CustomerService folder.

" You can configure exempted principals so that audit logs are not generated for certain users, service accounts, or groups. "

— Configuring Audit Logs

" Data Access logs are disabled by default because of their high volume, and you can enable them at the organization, folder, or project level. "

— Audit Logs Overview

Thus, enabling audit logging org-wide and exempting a specific set of users (i.e., CustomerService folder) meets the need.

https://cloud.google.com/architecture/prep-kubernetes-engine-for-prod#roles_and_groups

https://www.terraform.io/docs/cloud/guides/recommended-practices/part3.3.html

Comprehensive and Detailed Explanation From General CI/CD Practices:

The issue is a runtime failure: the container fails to start due to a missing environment variable. This means the application expects an environment variable that wasn ' t provided when the container was run. The goal is to prevent this within the CI/CD workflow before it reaches deployment.

A. Run integration tests in the CI pipeline: Integration tests typically involve deploying the application (or a component of it) to a test environment and checking if its parts work together correctly. As part of this, the application would attempt to start up with its configured environment. An integration test suite could include a basic " smoke test " that simply verifies the application starts successfully. If a required environment variable is missing, the application would fail to start during this integration test phase in the CI pipeline, catching the error before a production deployment. Many integration test setups will try to mimic the target deployment environment including its configuration mechanisms (like environment variables).  

B. Implement static code analysis in the CI pipeline: Static code analysis tools check the code for potential bugs, style issues, and security vulnerabilities without actually running it. While useful, they are unlikely to catch a missing environment variable configuration, as this is an issue with the deployment configuration or runtime environment, not typically a static property of the code itself (unless the code hardcodes an expectation that could be flagged, but that ' s less direct).  

C. Use a canary deployment strategy: Canary deployments are a strategy for releasing software to production by first deploying to a small subset of users/servers. This helps limit the blast radius if an issue occurs in production. While a good practice for deployments, it doesn ' t prevent the issue from occurring in the first place; it just limits its impact once it does occur. The question asks to prevent recurrence within the CI/CD workflow (i.e., earlier).  

D. Enable Cloud Audit Logs for the deployment: Cloud Audit Logs record administrative actions and accesses within Google Cloud. While the deployment logs already indicated the failure, audit logs provide information about who did what and when regarding the deployment configuration or execution. They are useful for post-mortem analysis of the deployment process itself but don ' t directly prevent the application from failing due to a misconfiguration like a missing environment variable during the build and test stages.  

The most effective way to catch such an issue before a production deployment attempt is to have a test stage in the CI pipeline that attempts to run the application in an environment configured similarly to production, including expected environment variables. Integration tests (or even simpler smoke tests that check for successful startup) would achieve this.

Reference (Based on CI/CD best practices):

Continuous Integration (CI) principles emphasize automated testing at various levels (unit, integration, end-to-end) to catch issues early.  

A common CI pipeline stage is to build the application, then deploy it to a test/staging environment and run integration tests. If the application fails to start in this test environment due to a missing environment variable, the pipeline would fail, preventing a flawed release from proceeding further.

" Integration tests verify that different parts of your application work together correctly. This can include interactions with databases, external services, and ensuring the application starts and operates as expected with its runtime configuration. "  

Catching configuration errors like missing environment variables is a key benefit of running integration or smoke tests in a CI environment that mirrors production.

https://cloud.google.com/logging/docs/audit#access-control

The keywords here is " developers or operators " . Option A the operators could push images to production without approval (operators could touch the cluster directly and the cluster cannot do any action against them). Rest same as francisco_guerra.

The best option for managing all charts uniformly, with native access control and VPC Service Controls is to store public and private charts in OCI format by using Artifact Registry. Artifact Registry is a service that allows you to store and manage container images and other artifacts in Google Cloud. Artifact Registry supports OCI format, which is an open standard for storing container images and other artifacts such as Helm charts. You can use Artifact Registry to store public and private charts in OCI format and manage them uniformly. You can also use Artifact Registry’s native access control features, such as IAM policies and VPC Service Controls, to secure your charts and control who can access them.