Gitops on DevOps & Rock'N'Roll

Wrapping Kyverno policies into a chart you can actually tune

Tue, 07 Jul 2026 00:08:30 +0000

Kyverno’s policy library is excellent and you should read it. It is also a directory of static YAML files, which means adopting it looks like copying twenty ClusterPolicy manifests into your GitOps repo and then editing them by hand, per cluster, forever.

That works until the second cluster. Dev wants audit where prod wants enforce. The infra cluster needs the CRI socket policy relaxed because your monitoring agent legitimately mounts it. A new namespace needs to be excluded from the Flux label requirement. Each of these is a one-line change to a file that’s now duplicated across three repositories, and none of them are visible from a single place.

A FluxCD repo layout that survives forty applications

Tue, 05 May 2026 00:08:30 +0000

Every GitOps repository starts beautiful. One cluster, five apps, a flat apps/ directory, and a Kustomization that reconciles the lot. Then the second cluster appears. Then staging needs a different replica count. Then somebody needs their own namespace with their own RBAC and no access to anyone else’s. Six months later you are grepping through forty kustomization.yaml files trying to work out why a change to a shared ConfigMap took down two environments.

Yet another Vault story

Fri, 06 Oct 2023 00:08:30 +0000

One can find a million blog posts about various aspects of using Hashicorp Vault, this solution has truly received massive adoption. So now you don’t even question what you’re going to use as secrets storage, but the matter is more of “how”.

Being a complete and inveterate gitops’er, one of my primary objectives is to store as much as I can in Git and to deploy that into Kubernetes. This brought me to the BanzaiCloud Bank Vaults solution bundle that allows you to achieve exactly this. It provides the ability to configure Vault as a Custom Resource and store all its primary settings on a repository. This is not very far from the official Helm chart deployment with their values, but BanzaiCloud give you a bit more: