Declarative Infrastructure Management with GitOps, Policy Validation with Rego and Kustomize

The Challenge of Consistency in Distributed Systems

Managing servers, networks, and applications at scale used to be an exercise of manual script execution or scattered command runs. In practice, this meant that two machines were never completely identical, creating unpredictable failures that only surfaced in production. To solve this headache, modern engineering adopted infrastructure as code, where the description of what must exist lives in text files.

However, merely writing configuration files does not solve the problem of knowing who changed what and when. Modern distributed systems require a single source of truth, a central place where any change goes through human reviews and automated testing before becoming reality. It is precisely in this scenario that the modern ecosystem of continuous delivery and policy validation tools comes into play.

GitOps Architecture as a Single Source of Truth

The concept behind GitOps is simple at its core: the Git repository becomes the absolute mirror of everything running on the servers. In practice, if an engineer needs to update a service version, they modify the code in the repository and submit it for review, rather than directly accessing the cluster control panel. An agent installed on the servers monitors this repository and automatically applies the necessary modifications.

This approach eliminates the dreaded configuration drift, a situation where manual tweaks made directly on the server corrupt the system's official state. If someone alters the infrastructure manually, the reconciliation agent detects the divergence and reverts the environment back to the secure standard defined in Git. This brings unparalleled native auditing, as every modification has an author, a justification, and an immutable history.

Manifest Customization with Kustomize

When managing multiple environments like development, staging, and production, the biggest challenge is avoiding excessive code duplication. Older tools used complex variable interpolation, turning configuration files into an unreadable mess. Kustomize solves this limitation by introducing the concept of base files and overlays, allowing you to reuse the same pure Kubernetes structure and apply only the modifications needed for each scenario.

In practice, the base file defines the default structure of an application, while environment folders apply targeted fixes, such as changing replica counts or injecting specific database variables. All of this happens without turning files into unreadable templates, maintaining the ecosystem's native readability and allowing any developer to quickly understand the file tree without needing to master complex templating languages.

Static Policy Validation with Rego

Writing correct files is not enough if they violate company security or compliance standards. This is where Rego comes in, a language developed by the Open Policy Agent project designed specifically to express business rules and security constraints as declarative code. With Rego, you write policies that inspect the manifests generated by Kustomize before they ever reach the production environment.

For example, you can create a Rego rule that prohibits any container from running with superuser privileges or that strictly mandates memory consumption limits. In practice, validation happens within the continuous integration pipeline, automatically blocking the code and sending a detailed alert to the developer if a policy is violated, saving precious time for the operations team.

Practical Implementation of the Declarative Pipeline

To put this architecture into operation, we structure a repository containing clean folders for Kustomize bases and overlays, alongside automated Rego tests. The daily engineering workflow involves creating a policy file, adjusting environment settings, and submitting everything via version control for automated validation.

apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - ../../base
patches:
  - path: patch-replicas.yaml
    target:
      kind: Deployment
      name: web-app

The code snippet above demonstrates how a simple Kustomize overlay inherits core resources from a shared base and applies targeted modifications. This modular design ensures long-term maintainability, allowing teams to scale their systems without losing control over what is executing in production.

Final Considerations

The combination of GitOps, Kustomize, and Rego validation represents an evolutionary leap in the operational maturity of software engineering and infrastructure teams. By treating server configurations with the exact same rigor, tests, and standards applied to application code, we drastically reduce the risk of human error. The result is a more resilient, auditable ecosystem prepared to absorb continuous growth without operational friction.