Validating Configs from Code to Deployment in the GitOps World
summary
Claims a working pipeline that prevents Kubernetes misconfigurations from code through deployment by validating YAML at multiple stages and blocking bad applies, citing an open source tool with 6,000 stars. Describes concrete validators: kubeconform and yq for schema/syntax checks, a Datree CLI that pulls central policies during CI, and an admission controller webhook that denies noncompliant kubectl applies. Notes a production outage at a company with ~400 engineers as motivation and shows the policy distribution and remediation workflow.
AI-written summary · about
chapters (12)
- 0:00Validating configs in GitOps
- 1:54Misconfigurations cause outages
- 4:00Three misconfig types in Kubernetes
- 6:52Tools for syntax and schema errors
- 9:25Balancing autonomy and guardrails
- 12:33Automatic config validation
- 15:21Managing policies at scale
- 18:27Clear remediation guidelines
- 20:14Tree prevents misconfigs
- 23:03GitOps with policy enforcement
- 25:34Custom rules with JSON Schema
- 27:19Summary
related talks
29mDeploy With Confidence: Pre-Deployment Tasks and Manifests Management
32mBuilding a Secure By-Design Pipeline with an Open Source Stack
10mIt's Time We Start Securing Our CICD Pipelines
37mDevOps - The Automation of Compliance
27mSecure by Design: Embedding DevSecOps into Your GitOps Workflows
23mBuilding a Secure By-Design Pipeline with an Open-Source Stack
30mAdventures in Production with GitOps, Secure Pipelines & Compliance
38mGitOps for Istio - Manage Istio Config like Code