All 28 GitOps Principles questions
More in GitOps Principles
How does GitOps support disaster recovery? What are the trade-offs and limitations of GitOps? How do you promote changes across environments in GitOps? What are common anti-patterns in GitOps? How do you separate application code repos from configuration repos, and why?
Advertisement
ArgoCD › GitOps Principles

How do you validate manifests before they reach the cluster (policy as code)?

Advanced

Answer

Gate merges in CI with schema validation (kubeconform), policy engines (OPA/Gatekeeper, Kyverno, Conftest), and dry-runs. Admission controllers on the cluster enforce policy at apply time too. This shifts errors left so only compliant, valid manifests are merged and reconciled.
Real-world example A CI step runs Conftest policies so a manifest missing resource limits fails the PR before it can be synced.

Common follow-ups: What is policy as code? | Where do admission controllers fit?

RBAC Sync & Health GitOps Principles
All 28 GitOps Principles questions