Question

Your team uses Cloud Deploy to release a microservice to GKE across dev, staging, and prod targets. A recent production incident was caused by a bad Kubernetes manifest that referenced a nonexistent ConfigMap; the error was only discovered after the rollout began. The manifests are generated by Skaffold using Kustomize overlays that differ per target. You want to catch rendering and manifest correctness issues for the exact production configuration BEFORE any pipeline promotion reaches the production target, without deploying to prod. What should you do?

Accepted Answer

Enable Cloud Deploy render inspection by reviewing the fully rendered manifests stored for the production target in the release, and add a Cloud Deploy verification (verify) phase in the skaffold profile that runs after deploy to each earlier target.

Answer

Add a canary deployment strategy to the production target so a small percentage of traffic validates the manifest before full rollout.

Answer

Configure Binary Authorization on the production cluster to block images that lack an attestation, preventing bad manifests from being applied.

Answer

Increase the production target's rollout timeout so failed manifests have more time to reconcile before Cloud Deploy marks the release failed.