Implementing Configuration as Code
1. Using Declarative Configuration
Example: Kong decK YAML
_format_version: "3.0"
_transform: true
services:
- name: orders
url: https://orders.internal
routes:
- name: orders-route
paths: ["/v1/orders"]
plugins:
- name: rate-limiting
config: { minute: 600, policy: redis }
# Apply: deck sync -s kong.yaml
2. Implementing GitOps Workflows
GitOps Flow
- Engineer commits config change to Git
- PR review + automated lint/diff
- Merge to main triggers CI
- CI runs
deck diff for preview
- Auto-deploy to dev / manual approval to prod
- Argo CD / Flux reconciles cluster state
- Audit log of all changes (Git history)
terraform {
required_providers {
kong = { source = "kevholditch/kong", version = "~> 6.0" }
}
}
resource "kong_service" "orders" {
name = "orders"
url = "https://orders.internal:8443"
}
resource "kong_route" "orders" {
service_id = kong_service.orders.id
paths = ["/v1/orders"]
methods = ["GET", "POST"]
}
4. Using Kubernetes CRDs
| CRD | Resource |
| Gateway API | Gateway, HTTPRoute, GRPCRoute |
| Istio | VirtualService, DestinationRule |
| Kong | KongPlugin, KongConsumer |
| Traefik | IngressRoute, Middleware |
5. Implementing Configuration Validation
| Tool | Use |
| Schema validation | JSON Schema, OpenAPI |
deck validate | Kong config syntax |
| OPA / Conftest | Policy checks (no * CORS) |
| kubeconform | K8s manifests |
| tflint, checkov | Terraform best practices |
6. Setting Up Environment Variables
| Variable | Purpose |
${ENV_NAME} | Substituted at apply |
DATABASE_URL | Per-env connection |
LOG_LEVEL | debug/info/warn |
OIDC_ISSUER | Per-env IdP |
7. Using Secret Management
| Tool | Use |
| HashiCorp Vault | Dynamic secrets, transit |
| AWS Secrets Manager | Managed, auto-rotation |
| Azure Key Vault | Azure-native |
| Sealed Secrets | GitOps-safe |
| SOPS + KMS | Encrypted at rest in Git |
| External Secrets Operator | K8s sync from vault |
Warning: Never commit plaintext secrets to Git. Use git-secrets, trufflehog, or pre-commit hooks.
8. Configuring Dynamic Configuration
| Source | Reload |
| etcd/Consul watch | Push, sub-second |
| Polling | 30-60s |
| Admin API push | On demand |
| SIGHUP | Process reload |
| xDS (Envoy) | Streaming gRPC |
9. Implementing Configuration Rollback
| Method | Detail |
| Git revert | One commit, re-apply |
| Snapshot restore | deck dump backup |
| Argo CD rollback | Built-in UI button |
| Blue/green configs | Switch live pointer |
10. Using Configuration Versioning
| Approach | Tool |
| Git tags | SemVer per release |
| Helm chart versions | App + config bundled |
| OCI artifact | ORAS-pushed configs |
| Snapshot ID | Track in change DB |