Containerisation and Orchestration as Code · Architecture as Code: the course

All courses / Architecture as Code / Module 2 / Chapter 7

Learning objectives

After the lesson the participant can:

Explain how the Kubernetes control plane enforces a declared architecture through reconciliation.
Describe the GitOps model and what it changes about rollback and audit.
List the guard rails that keep manifests trustworthy before they reach production.
Plan drift detection for a container platform beyond workload reconciliation.

Key concepts

Declarative orchestration: Kubernetes manifests capture the desired state for workloads, services and platform components. The control plane continuously reconciles the actual state with those declarations, which the chapter describes as enforcing Architecture as Code in real time.
GitOps: A practice that treats Git repositories as the source of truth. Continuous delivery tools such as Argo CD and Flux reconcile the declared state with running clusters when a pull request is merged; a rollback is a reverted commit.
Manifest guard rails: Schema and conformance checks in the pipeline, admission policies such as an OPA Gatekeeper constraint that prohibits privileged containers, image scanning and signing, so that every manifest is validated before it reaches production.
Service mesh as code: Meshes such as Istio and Linkerd provide a programmable data plane. Routing rules, mutual TLS, zero-trust access rules and traffic shaping such as retries and canary roll-outs are written as configuration and stored with the services.
Proactive drift detection: Scheduled comparisons of live configuration against Git, in addition to reconciliation loops, extended beyond workloads to backup jobs, storage policies and service mesh routes.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Sort

Capabilities of the container platform

Sort each capability into the part of the container platform that provides it, according to the chapter.

Interactive exercise 2 · Scenario

Live configuration no longer matches Git

Read the situation and choose what the chapter's reasoning leads to. Each choice gives feedback.

Teaching plan

15 min	Teacher presents containers, registries and Kubernetes as declared state, and explains the reconciliation loop on a whiteboard.
10 min	Read the two example manifests together: the Gatekeeper constraint against privileged containers and the Argo CD Application. Participants say what each one enforces.
10 min	Teacher covers service mesh, multi-cluster management, drift detection and declarative storage and backup.
20 min	Exercise: participants write a guard rail and drift plan for one cluster or platform.
5 min	Close with the transition the chapter makes: delivery speed creates security and governance demands that Part C answers.

Discussion

If the control plane already reconciles state continuously, why does the chapter still call proactive drift detection essential?
What changes for an incident team when a rollback becomes a matter of reverting a commit?
Which registry policies would you express as code first, and what would they stop from reaching production?

Written exercise

Exercise · 20 minutes

A guard rail and drift plan for a container platform

For a container platform in your own organisation, or one you plan, write a guard rail plan. List the checks that run before a manifest reaches production, in order: schema and conformance validation, policy checks, image scanning, signing and provenance. For each check name what it blocks and who owns the rule. State three admission policies you would enforce, starting with the prohibition of privileged containers used in the chapter. Then add a drift section: which scheduled comparisons run, against which source of truth, and what happens when a difference is found. Include one control outside workloads, such as backups or mesh routes.

Deliverable: A one-page plan listing ordered pre-production checks with owners, three admission policies, and a drift detection schedule with a response for each finding.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

What does the example OPA Gatekeeper constraint in the chapter prohibit?
Show the answer
B. Privileged containers
The chapter's minimal Gatekeeper example is a constraint that prohibits privileged containers, shown together with an Argo CD Application manifest that reconciles desired state.
In the GitOps model the chapter describes, how is a rollback performed?
Show the answer
C. By reverting the commit, after which the tool reconciles the cluster
Because Git is the source of truth and tools such as Argo CD and Flux reconcile clusters to it, rollbacks become a matter of reverting commits, with the audit trail preserved.
Which tools does the chapter name as exposing cloud resources as custom resource definitions, so that they are provisioned through the same API as workloads?
Show the answer
A. Crossplane and the Operator Framework
Crossplane, the Operator Framework and similar projects expose cloud resources as custom resource definitions, so databases, queues or networking can be provisioned through the Kubernetes API.