Question

Your team uses Cloud Deploy to promote a release through dev, staging, and production targets. During an incident review, you discover that the container image deployed to production had a slightly different digest than the one tested in staging, because a rebuild was triggered between promotions using the same mutable tag. You must redesign the pipeline so that the exact same artifact tested in earlier stages is guaranteed to reach production. What is the most effective way to achieve this?

Accepted Answer

Create a single Cloud Deploy release that references images by immutable digest, and promote that same release across all targets rather than creating a new release per environment.

Answer

Configure each target to rebuild the image from source before deployment so the artifact is always freshly produced from the same commit.

Answer

Use a Cloud Build trigger to push a new image with a 'latest' tag before each promotion so all environments pull the current build.

Answer

Enable Binary Authorization on the production cluster to block any image whose tag does not match the staging tag.