Implementing Configuration as Code

1. Using Declarative Configuration

Example: Kong decK YAML

_format_version: "3.0"
_transform: true

services:
  - name: orders
    url: https://orders.internal
    routes:
      - name: orders-route
        paths: ["/v1/orders"]
        plugins:
          - name: rate-limiting
            config: { minute: 600, policy: redis }

# Apply: deck sync -s kong.yaml

2. Implementing GitOps Workflows

GitOps Flow

  1. Engineer commits config change to Git
  2. PR review + automated lint/diff
  3. Merge to main triggers CI
  4. CI runs deck diff for preview
  5. Auto-deploy to dev / manual approval to prod
  6. Argo CD / Flux reconciles cluster state
  7. Audit log of all changes (Git history)

3. Configuring Terraform Providers

Example: Terraform Kong provider

terraform {
  required_providers {
    kong = { source = "kevholditch/kong", version = "~> 6.0" }
  }
}

resource "kong_service" "orders" {
  name = "orders"
  url  = "https://orders.internal:8443"
}

resource "kong_route" "orders" {
  service_id = kong_service.orders.id
  paths      = ["/v1/orders"]
  methods    = ["GET", "POST"]
}

4. Using Kubernetes CRDs

CRDResource
Gateway APIGateway, HTTPRoute, GRPCRoute
IstioVirtualService, DestinationRule
KongKongPlugin, KongConsumer
TraefikIngressRoute, Middleware

5. Implementing Configuration Validation

ToolUse
Schema validationJSON Schema, OpenAPI
deck validateKong config syntax
OPA / ConftestPolicy checks (no * CORS)
kubeconformK8s manifests
tflint, checkovTerraform best practices

6. Setting Up Environment Variables

VariablePurpose
${ENV_NAME}Substituted at apply
DATABASE_URLPer-env connection
LOG_LEVELdebug/info/warn
OIDC_ISSUERPer-env IdP

7. Using Secret Management

ToolUse
HashiCorp VaultDynamic secrets, transit
AWS Secrets ManagerManaged, auto-rotation
Azure Key VaultAzure-native
Sealed SecretsGitOps-safe
SOPS + KMSEncrypted at rest in Git
External Secrets OperatorK8s sync from vault
Warning: Never commit plaintext secrets to Git. Use git-secrets, trufflehog, or pre-commit hooks.

8. Configuring Dynamic Configuration

SourceReload
etcd/Consul watchPush, sub-second
Polling30-60s
Admin API pushOn demand
SIGHUPProcess reload
xDS (Envoy)Streaming gRPC

9. Implementing Configuration Rollback

MethodDetail
Git revertOne commit, re-apply
Snapshot restoredeck dump backup
Argo CD rollbackBuilt-in UI button
Blue/green configsSwitch live pointer

10. Using Configuration Versioning

ApproachTool
Git tagsSemVer per release
Helm chart versionsApp + config bundled
OCI artifactORAS-pushed configs
Snapshot IDTrack in change DB